# changelog

author: Packit <hello@packit.dev> - 75-1
changelog:
  - fix(storage): fix automated installations when boot drive is specified
  - fix(storage): fix manual partitioninig automated installations
  - fix(storage): fix empty error notifications when applyStorage fails


author: Packit <hello@packit.dev> - 76-1
changelog:
  - Move cockpit-ws config to anaconda-owned path with conf.d support
  - Stop D-Bus event monitors when installation starts
  - Add Restart button to post-installation screen for live media
    (Resolves: rhbz#2326672)
  - storage: sync destination modal selection with backend disk changes (Resolves:
    rhbz#2459685)
  - storage: Skip partitioning reset for kickstart scenarios
  - storage: Compare raw required space against filesystem free space
  - Rename "Reboot" button to installed system" to "Reboot"
  - Use the D-Bus Exit API for proper backend cleanup on exit


author: Packit <hello@packit.dev> - 77-1
changelog:
  - datetime: complete timezone after user sets it in incomplete kickstart
  - Add Bugzilla duplicate detection to the error reporting flow
  - accounts: Use backend CheckAdminUserExists for accounts page completeness
  - Set installer runtime language from kickstart lang command
  - storage: move storage editor entry point from kebab menu to Installation Method
  - storage: Add support for home reuse partitioning with Stratis
  - Encrypted Stratis support


author: Packit <hello@packit.dev> - 78-1
changelog:
  - Add Cockpit PIN authentication support
  - Add initial login page for remote installation
  - Wire up PIN authentication for remote installation
  - Add --remote-pin arg to webui_testvm script
  - Document how cockpit-pin-auth works
  - refactor: replace "magic" number with a proper constant (PROGRESS_STEPS_DONE)
  - refactor: deduplicate repetitive arg for onCritFail
  - feat: track installation status and pending errors on reconnection
  - refactor: deduplicate error handling in InstallationProgress
  - localization: complete language after user sets it in incomplete kickstart
  - datetime: mark timezone user-configured on screen entry, not on property change
  - spec: require slitherer for select spins, firefox for the res


author: Packit <hello@packit.dev> - 79-1
changelog:
  - wizard: use installation status for navigation instead of URL
  - boss: skip non-essential client init when installation is completed
  - Show "Stratis" for mountpoints on Stratis devices on review screen


author: Packit <hello@packit.dev> - 80-1
changelog:
  - Add TLS proxy for remote installation
  - Fix kickstart installations without storage pre-configured
  - Disable sidebar navigation to future steps


author: Packit <hello@packit.dev> - 81-1
changelog:
  - storage: only fetch free/total space for disk devices (gh1715)
  - fix: only enable PIN auth for remote installations


author: Packit <hello@packit.dev> - 82-1
changelog:
  - packaging: add fedora soas to spins using slitherer (Resolves: rhbz#2517903)
  - boss: do not stop boss event monitor during installation (Needs anaconda#7270 Relevant: rhbz#2521241)
  - progress: add debug logging for installation signal delivery (Relevant: rhbz#2521241)
  - network: remove Configure Network item from kebab menu (the screen is present if not hidden via profile config)


author: Packit <hello@packit.dev> - 83-1
changelog:
  - storage: fix LUKS kickstart race using GetUsableDisks tree walk
  - fix: reset boot drive on disk selection change and storage rescan
  - fix: return after onFail for bootloader on MDRAID detection
  - fix: wait for categoryProxy before subscribing to installation signals
  - fix: skip redundant re-renders during ProgressChanged signals
  - fix: disable cockpit transport health check during installation (Resolves: rhbz#2521241)


author: José Expósito <jexposit@redhat.com> - 3.01-2
changelog:
  - Use mesa-compat-libOSMesa on Fedora 42 and later
    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2373991


author: Cristian Le <git@lecris.dev> - 18.11.0-1
changelog:
  - Update to version 18.11.0
  - Atuin 18.9.0 fixes fish 4.x removal of `bind -k` (rhbz#2440541)
  - Add better documentation of how to handle MSRV
  - Move the profile.d script outside of the spec file


author: Aleksei Bavshin <alebastr@fedoraproject.org> - 4.0.4-1
changelog:
  - Update to 4.0.4 (rhbz#2426948)
  - Rewrite the spec according to the non-crate Rust project guidelines.


author: Emir Akdag <infraw.linux@proton.me> - 3.1.0-1
changelog:
  - Update to 3.1.0 (Complete rewrite in Rust) - Package transitioned from
    Python to Rust - Vendored Rust dependencies due to missing crates in
    Fedora - Skipped hardcoded file-path doctests in %check


author: Bastien Nocera <bnocera@redhat.com> - 5.86-4
changelog:
  - Re-add btmgmt as it does not require bluetoothd to be running,
    unlike bluetoothctl mgmt
  - Update audio output patch to be upstream version
  - Fix "bluetoothctl list" empty output (Closes: #2440346)


author: Timothée Ravier <tim@siosm.fr> - 2.26.0-4
changelog:
  - F44+: Ship OpenSSH config file specifying AuthorizedKeysFile
  - Have ignition-edge require the matching main ignition package


author: Steven Presti <spresti@redhat.com> - 2.27.0-1
changelog:
  - New Release
  - Butane config transpiler merged into Ignition repository
  - Butane now follows Ignition version numbering
  - Drop Patch0 (fix merged upstream)
  - Drop legacy fcct/fedora-coreos-config-transpiler provides


author: Frantisek Krenzelok <fkrenzel@redhat.com> - 2024.2.69_v8.0.401-8
changelog:
  - update-ca-trust: Added a temporary, compatibility option `--rhbz2387674` to
    the `extract` command. This flag restores legacy certificate
    symlinks (e.g., `/etc/ssl/cert.pem`) to address issues with older software
    that has not yet adapted to their removal. This essentially provides a
    temporary way to revert the "Dropping of cert.pem file".


author: rhel-developer-toolbox <krenzelok.frantisek@gmail.com> - 2025.2.80_v9.0.304-2
changelog:
  - Update to CKBI 2.80_v9.0.304 from NSS 3.114
  -    Adding:
  -     # Certificate "TWCA CYBER Root CA"
  -     # Certificate "TWCA Global Root CA G2"
  -     # Certificate "SecureSign Root CA12"
  -     # Certificate "SecureSign Root CA14"
  -     # Certificate "SecureSign Root CA15"
  -     # Certificate "D-TRUST BR Root CA 2 2023"
  -     # Certificate "TrustAsia SMIME ECC Root CA"
  -     # Certificate "TrustAsia SMIME RSA Root CA"
  -     # Certificate "TrustAsia TLS ECC Root CA"
  -     # Certificate "TrustAsia TLS RSA Root CA"
  -     # Certificate "D-TRUST EV Root CA 2 2023"
  -     # Certificate "SwissSign RSA SMIME Root CA 2022 - 1"
  -     # Certificate "SwissSign RSA TLS Root CA 2022 - 1"


author: Frantisek Krenzelok <fkrenzel@redhat.com> - 2025.2.80_v9.0.304-7
changelog:
  - Restore /etc/ssl/certs legacy structure and OpenSSL trusted bundles.
    This brings back certificate bundles in /etc/ssl/certs as they were before
    the "Dropping of cert.pem file" change, ensuring compatibility with software
    expecting the Debian-style file structure.


author: Krenželok František <fkrenzel@redhat.com> - 2026.2.90_v9.0.317-1
changelog:
  - Update to CKBI 2.90_v9.0.317 from NSS 3.126
    Removing:
    - XRamp Global CA Root
    - ePKI Root Certification Authority
    - certSIGN ROOT CA
    - Explicitly Distrust DigiNotar Root CA
    - CommScope Public Trust ECC Root-01
    - CommScope Public Trust ECC Root-02
    - CommScope Public Trust RSA Root-01
    - CommScope Public Trust RSA Root-02
    - FIRMAPROFESIONAL CA ROOT-A WEB
    - SecureSign Root CA12
    
    Adding:
    - OISTE Client Root ECC G1
    - OISTE Client Root RSA G1
    - OISTE Server Root ECC G1
    - OISTE Server Root RSA G1
    - e-Szigno TLS Root CA 2023
    - SecureSign Root CA16
    - SECOM TLS RSA Root CA 2024
    - SECOM TLS ECC Root CA 2024
    - SECOM SMIME RSA Root CA 2024
    - Telia EC Email Root CA v3
    - Telia EC TLS Root CA v3
    - Telia RSA Email Root CA v3
    - Telia RSA TLS Root CA v3
    - certSIGN
    - Chunghwa Telecom Co., Ltd.
    - XRamp Global Certification Authority


author: Than Ngo <than@redhat.com> - 150.0.7871.186-1
changelog:
  - Update to 150.0.7871.186
    * CVE-2026-16807: Out of bounds write in Codecs
    * CVE-2026-16806: Use after free in WebMCP
    * CVE-2026-16805: Use after free in Blink
    * CVE-2026-16804: Use after free in Input


author: Than Ngo <than@redhat.com> - 151.0.7922.71-1
changelog:
  - Update to 151.0.7922.71
    * CVE-2026-17650: Use after free in Compositing
    * CVE-2026-17651: Insufficient validation of untrusted input in Dawn
    * CVE-2026-17652: Use after free in Views
    * CVE-2026-17653: Use after free in Skia
    * CVE-2026-17654: Race in Updater
    * CVE-2026-17655: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-17656: Use after free in Ozone
    * CVE-2026-17657: Use after free in Navigation
    * CVE-2026-17658: Use after free in V8
    * CVE-2026-17659: Inappropriate implementation in SiteIsolation
    * CVE-2026-17660: Insufficient validation of untrusted input in Network
    * CVE-2026-17661: Use after free in Loader
    * CVE-2026-17662: Insufficient policy enforcement in Prefetch
    * CVE-2026-17663: Insufficient validation of untrusted input in GPU
    * CVE-2026-17664: Insufficient validation of untrusted input in Loader
    * CVE-2026-17665: Use after free in V8
    * CVE-2026-17666: Cryptographic Flaw in Enterprise
    * CVE-2026-17667: Uninitialized Use in ANGLE
    * CVE-2026-17668: Uninitialized Use in ANGLE
    * CVE-2026-17669: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17670: Use after free in Views
    * CVE-2026-17671: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-17672: Insufficient validation of untrusted input in Chromecast
    * CVE-2026-17673: Integer overflow in QUIC
    * CVE-2026-17674: Inappropriate implementation in HTML
    * CVE-2026-17675: Out of bounds write in ANGLE
    * CVE-2026-17676: Inappropriate implementation in ANGLE
    * CVE-2026-17677: Inappropriate implementation in ANGLE
    * CVE-2026-17678: Out of bounds read in ANGLE
    * CVE-2026-17679: Insufficient validation of untrusted input in Print Preview
    * CVE-2026-17680: Heap buffer overflow in Color
    * CVE-2026-17681: Insufficient validation of untrusted input in Web Authentication
    * CVE-2026-17682: Integer overflow in ANGLE
    * CVE-2026-17683: Inappropriate implementation in ANGLE
    * CVE-2026-17684: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17685: Use after free in Autofill
    * CVE-2026-17686: Insufficient validation of untrusted input in Passwords
    * CVE-2026-17687: Type Confusion in ANGLE
    * CVE-2026-17688: Use after free in Input
    * CVE-2026-17689: Uninitialized Use in ANGLE
    * CVE-2026-17690: Insufficient validation of untrusted input in PDF
    * CVE-2026-17691: Out of bounds write in ANGLE
    * CVE-2026-17692: Use after free in DataTransfer
    * CVE-2026-17693: Inappropriate implementation in FileSystem
    * CVE-2026-17694: Use after free in DOM
    * CVE-2026-17695: Inappropriate implementation in ANGLE
    * CVE-2026-17696: Side-channel information leakage in Media
    * CVE-2026-17697: Type Confusion in ANGLE
    * CVE-2026-17698: Insufficient validation of untrusted input in UI
    * CVE-2026-17699: Use after free in Views
    * CVE-2026-17700: Insufficient validation of untrusted input in Actor
    * CVE-2026-17701: Out of bounds read in ANGLE
    * CVE-2026-17702: Inappropriate implementation in Skia
    * CVE-2026-17703: Policy bypass in Chrome for iOS
    * CVE-2026-17704: Use after free in ANGLE
    * CVE-2026-17705: Integer overflow in libxml
    * CVE-2026-17706: Insufficient validation of untrusted input in Media
    * CVE-2026-17707: Uninitialized Use in Media
    * CVE-2026-17708: Use after free in Audio
    * CVE-2026-17709: Race in Downloads
    * CVE-2026-17710: Inappropriate implementation in MHTML
    * CVE-2026-17711: Race in Downloads
    * CVE-2026-17712: Race in Skia
    * CVE-2026-17713: Insufficient validation of untrusted input in Accessibility
    * CVE-2026-17714: Uninitialized Use in ANGLE
    * CVE-2026-17715: Inappropriate implementation in Passwords
    * CVE-2026-17716: Use after free in Updater
    * CVE-2026-17717: Integer overflow in ANGLE
    * CVE-2026-17718: Use after free in ANGLE
    * CVE-2026-17719: Use after free in Input
    * CVE-2026-17720: Insufficient policy enforcement in Passwords
    * CVE-2026-17721: Out of bounds write in ANGLE
    * CVE-2026-17722: Object lifecycle issue in WebView
    * CVE-2026-17723: Use after free in Media
    * CVE-2026-17724: Race in Chrome for iOS
    * CVE-2026-17725: Type Confusion in V8
    * CVE-2026-17726: Integer overflow in WebGL
    * CVE-2026-17727: Out of bounds write in WebGL
    * CVE-2026-17728: Inappropriate implementation in Extensions
    * CVE-2026-17758: Heap buffer overflow in Dawn
    * CVE-2026-17732: Inappropriate implementation in SVG
    * CVE-2026-17729: Use after free in V8
    * CVE-2026-17730: Side-channel information leakage in Autofill
    * CVE-2026-17731: Inappropriate implementation in Autofill
    * CVE-2026-17733: Inappropriate implementation in QUIC
    * CVE-2026-17734: Inappropriate implementation in Autofill
    * CVE-2026-17735: Insufficient validation of untrusted input in BFCache
    * CVE-2026-17736: Insufficient validation of untrusted input in WebView
    * CVE-2026-17737: Use after free in Bluetooth
    * CVE-2026-17738: Insufficient validation of untrusted input in Payments
    * CVE-2026-17739: Insufficient policy enforcement in Extensions
    * CVE-2026-17740: Uninitialized Use in ANGLE
    * CVE-2026-17741: Insufficient validation of untrusted input in WebView
    * CVE-2026-17742: Insufficient policy enforcement in Payments
    * CVE-2026-17743: Insufficient policy enforcement in ControlledFrame
    * CVE-2026-17744: Inappropriate implementation in File Input
    * CVE-2026-17745: Out of bounds read in Skia
    * CVE-2026-17746: Use after free in GPU
    * CVE-2026-17747: Insufficient validation of untrusted input in Payments
    * CVE-2026-17748: Inappropriate implementation in Extensions
    * CVE-2026-17749: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17750: Use after free in ANGLE
    * CVE-2026-17751: Inappropriate implementation in AdFilter
    * CVE-2026-17752: Use after free in Views
    * CVE-2026-17753: Inappropriate implementation in Autofill
    * CVE-2026-17754: Inappropriate implementation in Blink
    * CVE-2026-17755: Incorrect security UI in Extensions
    * CVE-2026-17756: Insufficient policy enforcement in Presentation
    * CVE-2026-17757: Uninitialized Use in Skia
    * CVE-2026-17759: Uninitialized Use in Codecs
    * CVE-2026-17760: Side-channel information leakage in NoStatePrefetch
    * CVE-2026-17761: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17762: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17763: Inappropriate implementation in GPU
    * CVE-2026-17764: Inappropriate implementation in FedCM
    * CVE-2026-17765: Inappropriate implementation in WebProtect
    * CVE-2026-17766: Insufficient validation of untrusted input in Clipboard
    * CVE-2026-17767: Insufficient validation of untrusted input in WebView
    * CVE-2026-17768: Insufficient validation of untrusted input in WebSockets
    * CVE-2026-17769: Insufficient validation of untrusted input in Cast
    * CVE-2026-17770: Out of bounds read in Media
    * CVE-2026-17771: Uninitialized Use in Skia
    * CVE-2026-17772: Out of bounds read in WebGL
    * CVE-2026-17773: Insufficient validation of untrusted input in Cast
    * CVE-2026-17774: Insufficient validation of untrusted input in Variations
    * CVE-2026-17775: Inappropriate implementation in PresentationAPI
    * CVE-2026-17776: Policy bypass in Receiver
    * CVE-2026-17777: Inappropriate implementation in Autofill
    * CVE-2026-17778: Use after free in Extensions
    * CVE-2026-17779: Inappropriate implementation in Site Isolation
    * CVE-2026-17780: Inappropriate implementation in Isolated Web Apps
    * CVE-2026-17781: Inappropriate implementation in Extensions
    * CVE-2026-17782: Incorrect security UI in Chrome for iOS
    * CVE-2026-17783: Inappropriate implementation in Loader
    * CVE-2026-17784: Use after free in Audio
    * CVE-2026-17785: Uninitialized Use in ANGLE
    * CVE-2026-17786: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17787: Inappropriate implementation in DevTools
    * CVE-2026-17788: Inappropriate implementation in Blink
    * CVE-2026-17789: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17790: Uninitialized Use in ANGLE
    * CVE-2026-17791: Insufficient validation of untrusted input in Payments
    * CVE-2026-17792: Inappropriate implementation in Credential Management
    * CVE-2026-17793: Inappropriate implementation in Messages
    * CVE-2026-17794: Insufficient validation of untrusted input in Mobile
    * CVE-2026-17795: Insufficient validation of untrusted input in GetUserMedia
    * CVE-2026-17796: Side-channel information leakage in WebXR
    * CVE-2026-17797: Inappropriate implementation in CSS
    * CVE-2026-17798: Inappropriate implementation in Cast
    * CVE-2026-17799: Insufficient validation of untrusted input in Safe Browsing
    * CVE-2026-17800: Side-channel information leakage in MediaRecording
    * CVE-2026-17801: Out of bounds memory access in ANGLE
    * CVE-2026-17802: Side-channel information leakage in GPU
    * CVE-2026-17803: Insufficient validation of untrusted input in Save to Drive
    * CVE-2026-17804: Use after free in Media
    * CVE-2026-17805: Insufficient policy enforcement in Glic
    * CVE-2026-17806: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17807: Use after free in V8
    * CVE-2026-17808: Uninitialized Use in WebGL
    * CVE-2026-17809: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17810: Uninitialized Use in Dawn
    * CVE-2026-17811: Use after free in ANGLE
    * CVE-2026-17812: Inappropriate implementation in DigitalCredentials
    * CVE-2026-17813: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-17814: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17815: Insufficient policy enforcement in GuestView
    * CVE-2026-17816: Inappropriate implementation in Speech
    * CVE-2026-17817: Inappropriate implementation in ReportingAndNEL
    * CVE-2026-17818: Inappropriate implementation in Network
    * CVE-2026-17819: Inappropriate implementation in WebAppInstalls
    * CVE-2026-17820: Insufficient policy enforcement in Autofill
    * CVE-2026-17821: Insufficient policy enforcement in Extensions
    * CVE-2026-17822: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17823: Insufficient policy enforcement in WebXR
    * CVE-2026-17824: Insufficient policy enforcement in ServiceWorker
    * CVE-2026-17825: Insufficient policy enforcement in Passwords
    * CVE-2026-17826: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17827: Inappropriate implementation in CSS
    * CVE-2026-17828: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17829: Insufficient policy enforcement in Passwords
    * CVE-2026-17830: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17831: Insufficient validation of untrusted input in Passwords
    * CVE-2026-17832: Use after free in ANGLE
    * CVE-2026-17833: Inappropriate implementation in Passwords
    * CVE-2026-17834: Inappropriate implementation in Passwords
    * CVE-2026-17835: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17836: Use after free in V8
    * CVE-2026-17837: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17838: Incorrect security UI in Chrome for iOS
    * CVE-2026-17839: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17840: Incorrect security UI in Passwords
    * CVE-2026-17841: Race in Chrome for iOS
    * CVE-2026-17842: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17843: Inappropriate implementation in CSS
    * CVE-2026-17844: Insufficient validation of untrusted input in Cast
    * CVE-2026-17845: Inappropriate implementation in CSS
    * CVE-2026-17846: Inappropriate implementation in Media
    * CVE-2026-17847: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-17848: Insufficient validation of untrusted input in Codecs
    * CVE-2026-17849: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17850: Inappropriate implementation in Permissions
    * CVE-2026-17851: Side-channel information leakage in Autofill
    * CVE-2026-17852: Inappropriate implementation in Media Router
    * CVE-2026-17853: Inappropriate implementation in DevTools
    * CVE-2026-17854: Insufficient policy enforcement in WebMCP
    * CVE-2026-17855: Race in DevTools
    * CVE-2026-17856: Inappropriate implementation in Network
    * CVE-2026-17857: Inappropriate implementation in Network
    * CVE-2026-17858: Uninitialized Use in WebNN
    * CVE-2026-17859: Side-channel information leakage in Favicons
    * CVE-2026-17860: Insufficient validation of untrusted input in Mobile
    * CVE-2026-17861: Insufficient validation of untrusted input in Updater
    * CVE-2026-17862: Use after free in Tracing
    * CVE-2026-17863: Inappropriate implementation in Browser
    * CVE-2026-17864: Inappropriate implementation in Updater
    * CVE-2026-17865: Inappropriate implementation in Crypto
    * CVE-2026-17866: Type Confusion in Tab
    * CVE-2026-17867: Insufficient validation of untrusted input in Dawn
    * CVE-2026-17868: Insufficient policy enforcement in USB
    * CVE-2026-17869: Out of bounds read in WebXR
    * CVE-2026-17870: Insufficient validation of untrusted input in Cast
    * CVE-2026-17871: Inappropriate implementation in Passwords
    * CVE-2026-17872: Cryptographic Flaw in WebAppInstalls
    * CVE-2026-17873: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-17874: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17875: Use after free in PDFium
    * CVE-2026-17876: Inappropriate implementation in Payments
    * CVE-2026-17877: Inappropriate implementation in Chromoting
    * CVE-2026-17878: Inappropriate implementation in CSS
    * CVE-2026-17879: Inappropriate implementation in Autofill
    * CVE-2026-17880: Inappropriate implementation in Autofill
    * CVE-2026-17881: Use after free in WebXR
    * CVE-2026-17882: Policy bypass in Extensions
    * CVE-2026-17883: Inappropriate implementation in Headless
    * CVE-2026-17884: Object lifecycle issue in WebRTC
    * CVE-2026-17885: Inappropriate implementation in Paint
    * CVE-2026-17886: Use after free in Enterprise
    * CVE-2026-17887: Use after free in TabStrip
    * CVE-2026-17888: Insufficient validation of untrusted input in WebUI
    * CVE-2026-17889: Uninitialized Use in WebXR
    * CVE-2026-17890: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17891: Use after free in ANGLE
    * CVE-2026-17892: Inappropriate implementation in WebXR
    * CVE-2026-17893: Insufficient validation of untrusted input in Updater
    * CVE-2026-17894: Use after free in Views
    * CVE-2026-17895: Inappropriate implementation in DataTransfer
    * CVE-2026-17896: Use after free in DevTools
    * CVE-2026-17897: Inappropriate implementation in ORB
    * CVE-2026-17898: Use after free in DevTools
    * CVE-2026-17899: Insufficient policy enforcement in DevTools
    * CVE-2026-17900: Inappropriate implementation in Enterprise
    * CVE-2026-17901: Inappropriate implementation in Sharing
    * CVE-2026-17902: Inappropriate implementation in Editing
    * CVE-2026-17903: Insufficient policy enforcement in Chromecast
    * CVE-2026-17904: Insufficient policy enforcement in NFC
    * CVE-2026-17905: Inappropriate implementation in SurfaceCapture
    * CVE-2026-17906: Insufficient validation of untrusted input in Bluetooth
    * CVE-2026-17907: Side-channel information leakage in Network
    * CVE-2026-17908: Insufficient validation of untrusted input in Printing
    * CVE-2026-17909: Insufficient validation of untrusted input in Isolated Web Apps
    * CVE-2026-17910: Insufficient policy enforcement in NFC
    * CVE-2026-17911: Insufficient policy enforcement in SVG
    * CVE-2026-17912: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17913: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17914: Side-channel information leakage in Skia
    * CVE-2026-17915: Inappropriate implementation in WebView
    * CVE-2026-17916: Insufficient policy enforcement in Settings
    * CVE-2026-17917: Policy bypass in Chrome for iOS
    * CVE-2026-17918: Use after free in Sync
    * CVE-2026-17919: Insufficient policy enforcement in Enterprise
    * CVE-2026-17920: Use after free in V8
    * CVE-2026-17921: Insufficient validation of untrusted input in Navigation
    * CVE-2026-17922: Inappropriate implementation in Enterprise
    * CVE-2026-17923: Policy bypass in Enterprise
    * CVE-2026-17924: Use after free in DNS
    * CVE-2026-17925: Inappropriate implementation in Cast
    * CVE-2026-17926: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17927: Insufficient policy enforcement in DevTools
    * CVE-2026-17928: Inappropriate implementation in DataTransfer
    * CVE-2026-17929: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17930: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17931: Inappropriate implementation in DevTools
    * CVE-2026-17932: Use after free in DataTransfer
    * CVE-2026-17933: Inappropriate implementation in DOMStorage
    * CVE-2026-17934: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17935: Heap buffer overflow in Codecs
    * CVE-2026-17936: Inappropriate implementation in DevTools
    * CVE-2026-17937: Inappropriate implementation in DevTools
    * CVE-2026-17938: Inappropriate implementation in FullScreen
    * CVE-2026-17939: Inappropriate implementation in Passwords
    * CVE-2026-17940: Insufficient validation of untrusted input in Picture-in-Picture
    * CVE-2026-17941: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17942: Side-channel information leakage in SVG
    * CVE-2026-17943: Inappropriate implementation in Parser
    * CVE-2026-17944: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17945: Inappropriate implementation in Navigation
    * CVE-2026-17946: Uninitialized Use in Dawn
    * CVE-2026-17947: Use after free in WebSockets
    * CVE-2026-17948: Type Confusion in V8
    * CVE-2026-17949: Uninitialized Use in GPU
    * CVE-2026-17950: Policy bypass in Safebrowsing
    * CVE-2026-17951: Heap buffer overflow in WebRTC
    * CVE-2026-17952: Inappropriate implementation in V8
    * CVE-2026-17953: Insufficient policy enforcement in WebView
    * CVE-2026-17954: Policy bypass in MHTML
    * CVE-2026-17955: Insufficient validation of untrusted input in Payments
    * CVE-2026-17956: Inappropriate implementation in Scheduling
    * CVE-2026-17957: Inappropriate implementation in CORS
    * CVE-2026-17958: Inappropriate implementation in Views
    * CVE-2026-17959: Inappropriate implementation in Network
    * CVE-2026-17960: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17961: Inappropriate implementation in Session
    * CVE-2026-17962: Inappropriate implementation in Blink
    * CVE-2026-17963: Inappropriate implementation in SVG
    * CVE-2026-17964: Incorrect security UI in UI
    * CVE-2026-17965: Incorrect security UI in Chrome for iOS
    * CVE-2026-17966: Inappropriate implementation in Views
    * CVE-2026-17967: Use after free in Chrome for iOS
    * CVE-2026-17968: Uninitialized Use in WebXR
    * CVE-2026-17969: Inappropriate implementation in Passwords
    * CVE-2026-17970: Insufficient validation of untrusted input in Passwords
    * CVE-2026-17971: Inappropriate implementation in Frame
    * CVE-2026-17972: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17973: Inappropriate implementation in Views
    * CVE-2026-17974: Insufficient policy enforcement in DevTools
    * CVE-2026-17975: Inappropriate implementation in IME
    * CVE-2026-17976: Policy bypass in Extensions
    * CVE-2026-17977: Policy bypass in CSS
    * CVE-2026-17978: Side-channel information leakage in WebCodecs
    * CVE-2026-17979: Race in V8
    * CVE-2026-17980: Inappropriate implementation in UI
    * CVE-2026-17981: Inappropriate implementation in Blink
    * CVE-2026-17982: Insufficient validation of untrusted input in Cast
    * CVE-2026-17983: Incorrect security UI in Global Media Controls
    * CVE-2026-17984: Inappropriate implementation in Browser
    * CVE-2026-17985: Insufficient policy enforcement in Speech
    * CVE-2026-17986: Insufficient policy enforcement in Bluetooth
    * CVE-2026-17987: Insufficient validation of untrusted input in Notifications
    * CVE-2026-17988: Insufficient validation of untrusted input in Navigation
    * CVE-2026-17989: Type Confusion in V8
    * CVE-2026-17990: Insufficient validation of untrusted input in WebAuthn
    * CVE-2026-17991: Insufficient validation of untrusted input in AI
    * CVE-2026-17992: Uninitialized Use in Skia
    * CVE-2026-17993: Race in Updater
    * CVE-2026-17994: Inappropriate implementation in Media
    * CVE-2026-17995: Out of bounds read in Dawn
    * CVE-2026-17996: Inappropriate implementation in Browser
    * CVE-2026-17997: Inappropriate implementation in Passwords
    * CVE-2026-17998: Incorrect security UI in Extensions
    * CVE-2026-17999: Incorrect security UI in PictureInPicture
    * CVE-2026-18000: Insufficient policy enforcement in USB
    * CVE-2026-18001: Inappropriate implementation in WebGL
    * CVE-2026-18002: Insufficient validation of untrusted input in Google Lens
    * CVE-2026-18003: Inappropriate implementation in Chrome for iOS
    * CVE-2026-18004: Insufficient policy enforcement in Speech
    * CVE-2026-18005: Inappropriate implementation in WebXR
    * CVE-2026-18006: Inappropriate implementation in Google Lens
    * CVE-2026-18007: Inappropriate implementation in Input
    * CVE-2026-18008: Inappropriate implementation in Settings
    * CVE-2026-18009: Insufficient validation of untrusted input in Passwords
    * CVE-2026-18010: Inappropriate implementation in Passwords
    * CVE-2026-18011: Inappropriate implementation in Chrome for iOS
    * CVE-2026-18012: Use after free in PDFium
    * CVE-2026-18013: Inappropriate implementation in Chrome for iOS
    * CVE-2026-18014: Insufficient validation of untrusted input in DevTools
    * CVE-2026-18015: Inappropriate implementation in Tint
    * CVE-2026-18016: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-18017: Use after free in Dawn
    * CVE-2026-18018: Inappropriate implementation in Updater
    * CVE-2026-18019: Side-channel information leakage in Media


author: Than Ngo <than@redhat.com> - 151.0.7922.108-1
changelog:
  - Update to 151.0.7922.108
    * CVE-2026-19137: Use after free in WebGL
    * CVE-2026-19138: Heap buffer overflow in CrashReporting
    * CVE-2026-19139: Race in CredentialProvider
    * CVE-2026-19140: Use after free in GPU
    * CVE-2026-19141: Use after free in Resources
    * CVE-2026-19142: Use after free in Views
    * CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs
    * CVE-2026-19144: Use after free in HTML
    * CVE-2026-19145: Use after free in Translate
    * CVE-2026-19146: Uninitialized Use in GPU
    * CVE-2026-19147: Use after free in Aura
    * CVE-2026-19148: Out of bounds write in GPU
    * CVE-2026-19149: Use after free in Aura
    * CVE-2026-19150: Inappropriate implementation in V8
    * CVE-2026-19151: Use after free in V8
    * CVE-2026-19152: Inappropriate implementation in Navigation
    * CVE-2026-19153: Insufficient validation of untrusted input in Workers
    * CVE-2026-19154: Use after free in Skia
    * CVE-2026-19155: Use after free in Payments
    * CVE-2026-19156: Heap buffer overflow in Base
    * CVE-2026-19157: Out of bounds write in ANGLE
    * CVE-2026-19158: Use after free in Views
    * CVE-2026-19159: Use after free in Views
    * CVE-2026-19160: Uninitialized Use in Skia
    * CVE-2026-19161: Uninitialized Use in Skia
    * CVE-2026-19162: Out of bounds write in V8
    * CVE-2026-19163: Use after free in Media
    * CVE-2026-19164: Insufficient validation of untrusted input in Codecs
    * CVE-2026-19165: Use after free in Extensions
    * CVE-2026-19166: Use after free in Web Authentication
    * CVE-2026-19167: Integer overflow in GPU
    * CVE-2026-19168: Inappropriate implementation in V8
    * CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks
    * CVE-2026-19170: Use after free in WebGL
    * CVE-2026-19171: Use after free in Media
    * CVE-2026-19172: Use after free in Views
    * CVE-2026-19173: Out of bounds write in Skia
    * CVE-2026-19174: Integer overflow in V8
    * CVE-2026-19175: Use after free in Payments
    * CVE-2026-19176: Use after free in Skia
    * CVE-2026-19177: Insufficient validation of untrusted input in UI


author: Than Ngo <than@redhat.com> - 151.0.7922.137-1
changelog:
  - Update to 151.0.7922.137
    * CVE-2026-19556: Use after free in V8
    * CVE-2026-19557: Use after free in TabStrip
    * CVE-2026-19558: Use after free in Extensions
    * CVE-2026-19559: Use after free in HTML
    * CVE-2026-19560: Use after free in Blink


author: Than Ngo <than@redhat.com> - 151.0.7922.169-1
changelog:
  - Update to 151.0.7922.169
    * CVE-2026-76034: Buffer overflow in WebGL
    * CVE-2026-76036: Buffer overflow in Dawn
    * CVE-2026-76033: Inappropriate implementation in CORS
    * CVE-2026-76037: Link following in CredentialProvider
    * CVE-2026-76044: Race condition in USB
    * CVE-2026-76039: Incorrect reference resolution in Core
    * CVE-2026-76040: Use after free in Browser
    * CVE-2026-76035: Inappropriate implementation in Media
    * CVE-2026-76042: Use of uninitialized resource in GPU
    * CVE-2026-76046: Buffer overflow in ANGLE
    * CVE-2026-76043: Incorrect calculation in V8
    * CVE-2026-76041: Information leak in Skia
    * CVE-2026-76047: Type confusion in V8
    * CVE-2026-76038: Type confusion in V8
    * CVE-2026-76045: Use after free in WebGL


author: Than Ngo <than@redhat.com> - 151.0.7922.173-1
changelog:
  - Update to 151.0.7922.173
    * CVE-2026-76017: Use after free in Chromoting
    * CVE-2026-76018: Privilege elevation in Import
    * CVE-2026-76019: Incorrect authorization in Workers
    * CVE-2026-76020: Race condition in V8
    * CVE-2026-76021: Use after free in DOM
    * CVE-2026-76022: Buffer overflow in Network
    * CVE-2026-76023: Improper resource control in Linux Toolkit Theming


author: Than Ngo <than@redhat.com> - 152.0.7977.64-1
changelog:
  - Update to 152.0.7977.64 
    * CVE-2026-79282: Use after free in ANGLE
    * CVE-2026-79290: Use after free in Aura
    * CVE-2026-79054: Use after free in Chromecast
    * CVE-2026-79121: Improper input validation in Chromecast
    * CVE-2026-79224: Use after free in Chromecast
    * CVE-2026-79052: Use after free in Aura
    * CVE-2026-79150: Use after free in Views
    * CVE-2026-78935: Use of uninitialized variable in Mobile
    * CVE-2026-79012: Use after free in Safebrowsing
    * CVE-2026-79200: Use after free in Aura
    * CVE-2026-78989: Out of bounds read in ANGLE
    * CVE-2026-79069: Memory corruption in Tint
    * CVE-2026-79175: Type confusion in Accessibility
    * CVE-2026-79218: Incorrect authorization in Sandbox
    * CVE-2026-79195: Use after free in Script
    * CVE-2026-78939: Use after free in Chromecast
    * CVE-2026-79194: Use after free in Chromoting
    * CVE-2026-79247: Use after free in Chromoting
    * CVE-2026-79219: Use after free in Bluetooth
    * CVE-2026-79047: Use after free in Views
    * CVE-2026-79292: Integer overflow in Chromecast
    * CVE-2026-78986: Uninitialized resource in GPU
    * CVE-2026-79039: Use after free in Mobile
    * CVE-2026-78934: Race condition in ReadAloud
    * CVE-2026-79011: UI misrepresentation in Browser
    * CVE-2026-78911: Incorrect authorization in USB
    * CVE-2026-79257: Use after free in Views
    * CVE-2026-79202: Use after free in Chromecast
    * CVE-2026-79212: Missing authorization in Passwords
    * CVE-2026-79183: Use after free in Accessibility
    * CVE-2026-79155: Race condition in FileSystem
    * CVE-2026-79093: Incorrect authorization in Paint
    * CVE-2026-79019: Out of bounds write in ANGLE
    * CVE-2026-79187: Use after free in WebRTC
    * CVE-2026-79288: Improper input validation in Autofill
    * CVE-2026-79130: Buffer overflow in ANGLE
    * CVE-2026-78965: Uninitialized resource in ANGLE
    * CVE-2026-79117: Race condition in WebAppInstalls
    * CVE-2026-79082: Incorrect authorization in Transactions Platform
    * CVE-2026-79111: Improper input validation in Dawn
    * CVE-2026-79072: Improper state validation in Performance
    * CVE-2026-79142: Buffer overflow in ANGLE
    * CVE-2026-78948: Buffer overflow in WebGL
    * CVE-2026-78908: Information leak in Canvas
    * CVE-2026-78895: Information leak in Paint
    * CVE-2026-79043: Out of bounds write in ANGLE
    * CVE-2026-79235: Use after free in WebGL
    * CVE-2026-79232: Use after free in Aura
    * CVE-2026-79118: Uninitialized resource in ANGLE
    * CVE-2026-79174: Incorrect authorization in Extensions
    * CVE-2026-78900: Improper input validation in Media
    * CVE-2026-79188: Out of bounds write in ANGLE
    * CVE-2026-79189: Out of bounds write in ANGLE
    * CVE-2026-79048: Out of bounds write in ANGLE
    * CVE-2026-79240: Out of bounds write in ANGLE
    * CVE-2026-79014: Race condition in Autofill
    * CVE-2026-79198: Use after free in Platform
    * CVE-2026-79131: Out of bounds write in ANGLE
    * CVE-2026-79149: Use after free in ANGLE
    * CVE-2026-79275: Use after free in ANGLE
    * CVE-2026-79138: Out of bounds write in ANGLE
    * CVE-2026-79026: Use after free in Extensions
    * CVE-2026-79027: Use after free in WebRTC
    * CVE-2026-78904: Type confusion in ANGLE
    * CVE-2026-78899: Use after free in V8
    * CVE-2026-78954: Incorrect authorization in Extensions
    * CVE-2026-79274: Information leak in GPU
    * CVE-2026-78938: Type confusion in V8
    * CVE-2026-78952: Out of bounds write in Crashpad
    * CVE-2026-79236: Type confusion in V8
    * CVE-2026-79078: Use after free in FedCM
    * CVE-2026-79209: Type confusion in Animation
    * CVE-2026-79030: Observable discrepancy in Autofill
    * CVE-2026-79216: Buffer overflow in Blink
    * CVE-2026-79007: Uninitialized resource in GPU
    * CVE-2026-78893: Information leak in QUIC
    * CVE-2026-79222: Incorrect authorization in CustomTabs
    * CVE-2026-79071: Race condition in GPU
    * CVE-2026-79076: Improper input validation in Sync
    * CVE-2026-79088: Incorrect authorization in FileSystem
    * CVE-2026-79104: Missing authorization in Sensor
    * CVE-2026-79044: Missing authorization in WebAppInstalls
    * CVE-2026-78958: Uninitialized resource in Skia
    * CVE-2026-78961: Incorrect authorization in Core
    * CVE-2026-79262: Incorrect authorization in Network
    * CVE-2026-79106: Improper input validation in Input
    * CVE-2026-79176: UI misrepresentation in Extensions
    * CVE-2026-78966: Externally controlled reference in QUIC
    * CVE-2026-79186: Incorrect authorization in Network
    * CVE-2026-79267: Race condition in Workers
    * CVE-2026-79016: Observable discrepancy in SVG
    * CVE-2026-79010: Operation on a resource after expiration or release in Network
    * CVE-2026-79286: Missing authorization in CustomTabs
    * CVE-2026-78945: Use after free in Views
    * CVE-2026-78999: Improper privilege management in Navigation
    * CVE-2026-78941: Information leak in Core
    * CVE-2026-79032: Improper input validation in Network
    * CVE-2026-79109: Improper input validation in Printing
    * CVE-2026-79256: Externally controlled reference in WebView
    * CVE-2026-79237: Incorrect authorization in Navigation
    * CVE-2026-78898: Incorrect authorization in Downloads
    * CVE-2026-78985: Incorrect reference resolution in FileSystem
    * CVE-2026-79028: Observable discrepancy in Network
    * CVE-2026-79210: Use after free in Audio
    * CVE-2026-79046: Race condition in Permissions
    * CVE-2026-79129: Use after free in Sessions
    * CVE-2026-78937: Use after free in Search
    * CVE-2026-78987: Information leak in Canvas
    * CVE-2026-78990: Use after free in Compositing
    * CVE-2026-78909: Use after free in Views
    * CVE-2026-79271: Information leak in DOM
    * CVE-2026-79144: Information leak in Skia
    * CVE-2026-79065: Improper input validation in Network
    * CVE-2026-79192: Improper input validation in Variations
    * CVE-2026-79140: Use after free in Views
    * CVE-2026-79128: Use after free in Views
    * CVE-2026-78942: Incorrect reference resolution in Loader
    * CVE-2026-79116: Missing authorization in Viz
    * CVE-2026-79006: Protection mechanism failure in HttpsUpgrades
    * CVE-2026-79095: Information leak in Payments
    * CVE-2026-79084: Inadequate encryption strength in Notifications
    * CVE-2026-78991: Race condition in WebProtect
    * CVE-2026-79248: Incorrect authorization in Input
    * CVE-2026-78891: Buffer overflow in WebRTC
    * CVE-2026-79031: Improper resource exposure in Preload
    * CVE-2026-79110: Missing authorization in Preload
    * CVE-2026-79136: Incorrect authorization in ServiceWorker
    * CVE-2026-78907: Incorrect authorization in WebProtect
    * CVE-2026-79087: Injection in Chrome Tabs
    * CVE-2026-79231: Buffer overflow in Media
    * CVE-2026-78969: Uninitialized resource in Video
    * CVE-2026-79137: Incorrect authorization in Extensions
    * CVE-2026-79057: Race condition in Start
    * CVE-2026-78894: Race condition in Payments
    * CVE-2026-79264: Incorrect reference resolution in Preload
    * CVE-2026-78910: Buffer overflow in V8
    * CVE-2026-79066: Improper input validation in Navigation
    * CVE-2026-79255: Improper input validation in WebRTC
    * CVE-2026-79086: Missing authorization in CustomTabs
    * CVE-2026-79038: Incorrect authorization in WebProtect
    * CVE-2026-78940: Improper initialization in Network
    * CVE-2026-79107: Incorrect authorization in TabGroups
    * CVE-2026-79120: Uninitialized resource in ANGLE
    * CVE-2026-79270: Uninitialized resource in ANGLE
    * CVE-2026-79067: Missing authorization in Network
    * CVE-2026-79213: Incorrect authorization in WebAppInstalls
    * CVE-2026-78943: Improper input validation in Editing
    * CVE-2026-79259: Improper input validation in Safebrowsing
    * CVE-2026-79208: Missing authorization in HTTP2
    * CVE-2026-79251: Improper input validation in Network
    * CVE-2026-79226: Improper privilege management in Regional Capabilities
    * CVE-2026-79042: Missing authorization in Payments
    * CVE-2026-79122: Information leak in SignIn
    * CVE-2026-79199: Incorrect authorization in Network
    * CVE-2026-79013: Improper input validation in Sync
    * CVE-2026-79074: Information leak in Network
    * CVE-2026-79215: Integer overflow in WebGL
    * CVE-2026-79049: Incorrect reference resolution in Passwords
    * CVE-2026-79132: Improper input validation in Input
    * CVE-2026-79201: Improper access control in Workers
    * CVE-2026-79051: Incorrect authorization in Loader
    * CVE-2026-79053: Missing authorization in Lighthouse
    * CVE-2026-79285: Uninitialized resource in ANGLE
    * CVE-2026-78906: Race condition in ANGLE
    * CVE-2026-79250: UI misrepresentation in Navigation
    * CVE-2026-79020: Out of bounds read in Skia
    * CVE-2026-79217: Incorrect authorization in Mobile
    * CVE-2026-79204: UI misrepresentation in Input
    * CVE-2026-78912: UI misrepresentation in Browser
    * CVE-2026-78955: Observable discrepancy in PerformanceAPIs
    * CVE-2026-79143: Incorrect authorization in FileSystem
    * CVE-2026-79241: Out of bounds read in GPU
    * CVE-2026-78967: Missing authorization in BFCache
    * CVE-2026-79214: Improper input validation in Preload
    * CVE-2026-79228: Incorrect authorization in SiteIsolation
    * CVE-2026-78953: Missing authorization in SiteIsolation
    * CVE-2026-79229: Uninitialized resource in ANGLE
    * CVE-2026-79002: Incorrect authorization in SiteIsolation
    * CVE-2026-79272: Improper input validation in FindInPage
    * CVE-2026-79127: Out of bounds write in ANGLE
    * CVE-2026-79151: Improper input validation in Safebrowsing
    * CVE-2026-78936: Observable discrepancy in CustomTabs
    * CVE-2026-78905: Type confusion in ANGLE
    * CVE-2026-79050: Incorrect authorization in Network
    * CVE-2026-79008: Improper input validation in GPU
    * CVE-2026-78975: Incorrect authorization in DOM
    * CVE-2026-79287: Observable discrepancy in Forms
    * CVE-2026-79094: Race condition in Workers
    * CVE-2026-79173: UI misrepresentation in WebAppInstalls
    * CVE-2026-78976: Improper input validation in StorageAccessAPI
    * CVE-2026-79276: Improper privilege management in FileSystem
    * CVE-2026-79191: Incorrect authorization in SiteIsolation
    * CVE-2026-79099: Missing authorization in Network
    * CVE-2026-79024: Information leak in ServiceWorker
    * CVE-2026-79193: Information leak in Canvas
    * CVE-2026-79242: Observable discrepancy in HTML
    * CVE-2026-79180: UI misrepresentation in CustomTabs
    * CVE-2026-79293: Information leak in Animation
    * CVE-2026-79023: Incorrect authorization in Editing
    * CVE-2026-79146: Information leak in CustomTabs
    * CVE-2026-79238: Incorrect authorization in ServiceWorker
    * CVE-2026-78949: Observable discrepancy in CustomTabs
    * CVE-2026-79291: Information leak in CSS
    * CVE-2026-79283: UI misrepresentation in Geometry
    * CVE-2026-78892: Incorrect authorization in Chromoting
    * CVE-2026-79070: Incorrect reference resolution in Cache
    * CVE-2026-79205: Incorrect authorization in Network
    * CVE-2026-78903: Incomplete cleanup in SiteIsolation
    * CVE-2026-78959: Improper handling of case sensitivity in FileSystem
    * CVE-2026-79234: Injection in CSS
    * CVE-2026-78983: Use after free in Views
    * CVE-2026-79083: Improper enforcement of behavioral workflow in Media
    * CVE-2026-78944: Use after free in DevTools
    * CVE-2026-79178: Incorrect authorization in Web Authentication (Passkeys & Security Keys)
    * CVE-2026-79059: Information leak in BFCache
    * CVE-2026-79245: Use after free in UI
    * CVE-2026-78978: Out of bounds read in ANGLE
    * CVE-2026-79103: Incorrect reference resolution in Speech
    * CVE-2026-79154: Missing authorization in DevTools
    * CVE-2026-79230: Improper input validation in ANGLE
    * CVE-2026-79068: Improper resource exposure in StreamsAPI
    * CVE-2026-79269: Uninitialized resource in ANGLE
    * CVE-2026-79085: Missing authorization in Network
    * CVE-2026-79134: Incorrect authorization in GetUserMedia
    * CVE-2026-79064: Use after free in Network
    * CVE-2026-79003: Incorrect authorization in Device
    * CVE-2026-79220: Information leak in Network
    * CVE-2026-78951: Use after free in ServiceWorker
    * CVE-2026-79249: Code injection in Bisection
    * CVE-2026-79091: Use after free in Bluetooth
    * CVE-2026-79265: Incomplete cleanup in GetUserMedia
    * CVE-2026-78913: Use after free in Chromoting
    * CVE-2026-79258: Incorrect authorization in WebXR
    * CVE-2026-79211: Incorrect authorization in USB
    * CVE-2026-79252: Information leak in ServiceWorker
    * CVE-2026-78962: Uninitialized resource in WebXR
    * CVE-2026-78901: Race condition in V8
    * CVE-2026-79097: Use after free in V8
    * CVE-2026-79227: Type confusion in DevTools
    * CVE-2026-79203: Improper input validation in DevTools
    * CVE-2026-79033: Insufficient control flow management in DevTools
    * CVE-2026-79139: Improper input validation in Media
    * CVE-2026-79221: Uninitialized resource in Dawn
    * CVE-2026-79034: Information leak in CORS
    * CVE-2026-79075: Information leak in Geolocation
    * CVE-2026-78960: Information leak in Extensions
    * CVE-2026-78984: Uninitialized resource in GPU
    * CVE-2026-78963: Improper input validation in Media
    * CVE-2026-79004: Out of bounds read in Media
    * CVE-2026-79182: Improper input validation in Media
    * CVE-2026-79185: Information leak in DOM
    * CVE-2026-79073: Improper state validation in Parser
    * CVE-2026-79266: Use after free in DevTools
    * CVE-2026-79025: Improper input validation in Workers
    * CVE-2026-79141: Incorrect authorization in Browser
    * CVE-2026-78974: UI misrepresentation in Linux Toolkit Theming
    * CVE-2026-79055: Information leak in Sharing
    * CVE-2026-79263: Race condition in Extensions
    * CVE-2026-79124: Information leak in Intents
    * CVE-2026-79184: Missing authorization in Preload
    * CVE-2026-79289: Improper control of a resource through its lifetime in Workers
    * CVE-2026-79001: Information leak in Bluetooth
    * CVE-2026-79077: Incorrect authorization in WebProtect
    * CVE-2026-78950: Integer overflow in WebRTC
    * CVE-2026-79196: Race condition in Editing
    * CVE-2026-79000: Improper input validation in DeviceBoundSessionCredentials
    * CVE-2026-78979: Race condition in Core
    * CVE-2026-79181: Observable discrepancy in Glic
    * CVE-2026-79190: Incorrect authorization in Extensions
    * CVE-2026-79206: Out of bounds read in FileSystem
    * CVE-2026-78897: Missing authorization in BrowserTag
    * CVE-2026-79119: Use after free in PDF
    * CVE-2026-79089: Race condition in Transactions Platform
    * CVE-2026-79147: Information leak in Skia
    * CVE-2026-79098: UI misrepresentation in PermissionElement
    * CVE-2026-79022: UI misrepresentation in Transactions Platform
    * CVE-2026-79233: UI misrepresentation in CustomTabs
    * CVE-2026-79261: Incorrect authorization in Controls
    * CVE-2026-78977: Uninitialized resource in GPU
    * CVE-2026-79040: Uninitialized resource in GPU
    * CVE-2026-79273: Incorrect reference resolution in WebView
    * CVE-2026-79243: Improper input validation in ReadingList
    * CVE-2026-79123: Improper input validation in NTP Footer
    * CVE-2026-79005: Incorrect authorization in StorageAccessAPI
    * CVE-2026-79090: Improper privilege management in Actor
    * CVE-2026-78946: Incorrect authorization in Select
    * CVE-2026-78968: Missing authorization in Core
    * CVE-2026-79041: Missing authorization in Browser
    * CVE-2026-79284: UI misrepresentation in Core
    * CVE-2026-78896: Information leak in StorageAccessAPI
    * CVE-2026-79058: Missing authorization in Passwords
    * CVE-2026-79009: UI misrepresentation in UI
    * CVE-2026-79060: Incorrect authorization in StorageAccessAPI
    * CVE-2026-79177: Incorrect authorization in Media
    * CVE-2026-78956: Type confusion in V8
    * CVE-2026-79239: Out of bounds read in Tint
    * CVE-2026-79015: Improper input validation in ServiceWorker
    * CVE-2026-79108: UI misrepresentation in Web Authentication (Passkeys & Security Keys)
    * CVE-2026-79056: Use after free in ServiceWorker
    * CVE-2026-79018: Information leak in FoldableAPIs
    * CVE-2026-78980: Improper input validation in ReaderMode
    * CVE-2026-78947: Incomplete cleanup in Chromium
    * CVE-2026-79244: Use after free in Animation
    * CVE-2026-79112: Out of bounds read in Skia
    * CVE-2026-79246: Information leak in DataTransfer
    * CVE-2026-79223: Integer overflow in Chromium
    * CVE-2026-79045: Type confusion in V8
    * CVE-2026-79197: Use after free in V8
    * CVE-2026-79148: Off-by-one error in DevTools
    * CVE-2026-79125: Information leak in XR
    * CVE-2026-79207: Information leak in Passwords
    * CVE-2026-79017: Race condition in Extensions
    * CVE-2026-79105: Improper input validation in Mobile
    * CVE-2026-79225: Incorrect authorization in Browser
    * CVE-2026-79021: Missing authorization in InterestGroups
    * CVE-2026-79133: Incorrect authorization in Forms
    * CVE-2026-79179: Incorrect authorization in DOM
    * CVE-2026-79152: Incorrect authorization in CustomTabs
    * CVE-2026-78981: Information leak in Mobile
    * CVE-2026-78957: Information leak in Mobile
    * CVE-2026-79126: Incorrect provision of specified functionality in Proxy
    * CVE-2026-78915: Race condition in Enterprise
    * CVE-2026-79253: Improper input validation in Network
    * CVE-2026-79260: Improper input validation in Cookies
    * CVE-2026-79254: Incorrect reference resolution in CustomTabs
    * CVE-2026-78914: Uninitialized resource in Skia
    * CVE-2026-78964: Use after free in Sync


author: Than Ngo <than@redhat.com> - 152.0.7977.75-1
changelog:
  - Update to 152.0.7977.75
    * CVE-2026-84353: Use after free in Shared Tab Groups
    * CVE-2026-84352: Use after free in WebGL
    * CVE-2026-84354: Incorrect authorization in FileSystem
    * CVE-2026-84359: Information leak in Skia
    * CVE-2026-84357: Improper input validation in Omnibox
    * CVE-2026-84324: Use after free in Proxy
    * CVE-2026-84349: Use after free in Browser
    * CVE-2026-84326: Uninitialized resource in V8
    * CVE-2026-84333: Use after free in Dawn
    * CVE-2026-84351: Buffer overflow in GPU
    * CVE-2026-84325: Improper input validation in DataTransfer
    * CVE-2026-84328: Missing authorization in FileSystem
    * CVE-2026-84347: Use after free in WebRTC
    * CVE-2026-84323: Missing authorization in FileSystem
    * CVE-2026-84355: Incorrect authorization in Navigation
    * CVE-2026-84358: Improper privilege management in Downloads
    * CVE-2026-84332: Incorrect authorization in SiteSettings
    * CVE-2026-84330: UI misrepresentation in FullScreen
    * CVE-2026-84334: Incorrect authorization in Chromoting
    * CVE-2026-84348: Information leak in MediaCapture
    * CVE-2026-84335: Incorrect authorization in TabStrip
    * CVE-2026-84327: Incorrect authorization in Autofill
    * CVE-2026-84329: Confused deputy in CredentialProvider
    * CVE-2026-84356: UI misrepresentation in FullScreen
    * CVE-2026-84350: Use after free in TabStrip
    * CVE-2026-84331: Incorrect authorization in Actor


author: Than Ngo <than@redhat.com> - 152.0.7977.82-1
changelog:
  - Update to 152.0.7977.82
    * CVE-2026-85046: Type confusion in V8
    * CVE-2026-85052: Out of bounds read in CrashReporting
    * CVE-2026-85043: Incomplete cleanup in Network
    * CVE-2026-85048: Use after free in Compositing
    * CVE-2026-85045: Race condition in V8
    * CVE-2026-85050: Out of bounds write in WebGL
    * CVE-2026-85053: Improper resource exposure in CacheStorage
    * CVE-2026-85042: Use after free in DevTools
    * CVE-2026-85049: Use after free in Skia
    * CVE-2026-85051: Type confusion in Compositing
    * CVE-2026-85047: Improper input validation in Transactions Platform
    * CVE-2026-85044: Use of released resource in Mobile


author: Paulo Alcantara <paalcant@redhat.com> - 7.6-2
changelog:
  - cifs.upcall: fix regression with kerberos mounts
  - Resolves: rhbz#2497446
  - Resolves: rhbz#2496963
  - Resolves: rhbz#2489808 - CVE-2026-12505


author: Packit <hello@packit.dev> - 362-1
changelog:
  - Bug fixes and translation updates
  - Fix arbitrary code execution via specially crafted logs page link (CVE-2026-4802)


author: Packit <hello@packit.dev> - 366-1
changelog:
  - Networkmanager: Don't activate new network connections by default
  - Networkmanager: Navigate to details page after creation
  - Translations and dependency updates


author: Michal Pospíšil <mpospisi@redhat.com> - 0.12.0-1
changelog:
  - Rebased pcs to the newest major version (see CHANGELOG.md)
    Resolves: rhbz#2341012
  - New subpackage pcs-web-ui - enables standalone web UI when the subpackage is installed on the system (default), uninstall the subpackage to disable the web UI
  - Updated standalone web UI and HA Cluster Management Cockpit application to pcs-web-ui 0.1.22
  - Fixes for compatibility with Ruby 3.4
    Resolves: rhbz#2331005


author: Michal Pospíšil <mpospisi@redhat.com> - 0.12.1-1
changelog:
  - Rebased pcs to the newest major version (see CHANGELOG.md)
    Resolves: rhbz#2371770
  - Updated standalone web UI and HA Cluster Management Cockpit application to pcs-web-ui 0.1.23 (see CHANGELOG_WUI.md)
  - There is now a changelog for the HA Cluster Management Cockpit application and the standalone web UI in both packages
  - The upstream version of pcs-web-ui can now be queried through RPM in both packages - see bundled(pcs-web-ui)
  - Updated bundled Python dependency dacite
  - Compatibility with rubygem-rack >= 3
    Resolves: rhbz#2372462


author: Michal Pospíšil <mpospisi@redhat.com> - 0.12.2-1
changelog:
  - Rebased pcs to the newest major version (see CHANGELOG.md)
  - Updated standalone web UI and HA Cluster Management Cockpit application to pcs-web-ui 0.1.24.2 (see CHANGELOG_WUI.md)
    Resolves: rhbz#2432985, rhbz#2433035
  - Fixed FTBFS with Python 3.15
    Resolves: rhbz#2440684
  - Fixed issues with installing pcs on Fedora 43+, upgrade and uninstall


author: Michal Pospíšil <mpospisi@redhat.com> - 0.12.2-2
changelog:
  - Updated standalone web UI and HA Cluster Management Cockpit application to pcs-web-ui 0.1.24.3 (see CHANGELOG_WUI.md)
    Resolves: rhbz#2454042
  - Fixed a crash when running pcs resource|stonith list
    Resolves: rhbz#2458608
  - Fixed order of resources in sets when listing configuration of constraints
    Resolves: rhbz#2461143


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.0-1
changelog:
  - Update to release v2.3.0
  - Refreshed spec file using go2rpm
  - Build now using gobuild macro for most binaries.
  - 'go build' is used for containerd-shim-runc-v2 to emulate makefile static
    build


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.0-2
changelog:
  - Build shim as static-pie
  - Build shim as static using static-pie to retain pie benefits and static
    build. See https://github.com/containerd/containerd/discussions/13340#dis
    cussioncomment-16883392 for additional information.


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.1-1
changelog:
  - Update to release v2.3.1
  - Resolves: rhbz#2464270
  - Upstream feature enhancements and fixes
  - Resolves CVE-2026-34986: rhbz#2455637, rhbz#2455646
  - Resolves CVE-2026-35469: rhbz#2467593


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.2-1
changelog:
  - Update to release v2.3.2
  - Resolves: rhbz#2464270
  - Resolves CVE-2026-34986: rhbz#2455637, rhbz#2455646
  - Resolves CVE-2026-35469: rhbz#2467593
  - Resolves CVE-2026-50195
  - Resolves CVE-2026-53488
  - Resolves CVE-2026-53492
  - Resolves CVE-2026-53489
  - Resolves CVE-2026-47262
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.4-1
changelog:
  - Update to release v2.3.4
  - Resolves: rhbz#2514862
  - Upstream fixes and enhancements and breaking change


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.5-1
changelog:
  - Update to release v2.3.5
  - Resolves: rhbz#2528927
  - Resolves CVE-2026-53495
  - Resolves  GHSA-rp3h-jf77-q9p4
  - Upstream fixs and enhancements
  - Drops rpminspect.yaml
  - Add rpmlint.toml


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-5
changelog:
  - totemsrp: Return error if sanity check fails
    (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity
    (fixes CVE-2026-35092)


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-8
changelog:
  - totemsrp: Fix int overflow in commit_token_sanity
    (fixes CVE-2026-81666)
  - totempg: Replace assert with check in deliver_fn
    (fixes CVE-2026-81665)


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.34.11-1
changelog:
  - Update to release v1.34.11
  - Resolves: rhbz#2510870
  - Resolves CVE-2026-34986: rhbz#2455652
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.34.13-1
changelog:
  - Update to release v1.34.13
  - Resolves: rhbz#2527294
  - Upstream fixes
  - Likely the last v1.34 release


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.35.3-1
changelog:
  - Update to release v1.35.3
  - Resolves: rhbz#2466629
  - Fix CVE-2026-35469
  - Upstream fixes and new feature


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.0-6
changelog:
  - Document elf exception
  - The elf inspection in rpminspect apparently does not implement the
    'ignore' feature. CRI-O does have TEXTREL which elf marks as bad. The
    --skip-textrel option for annocheck works.


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.0-8
changelog:
  - Add internal/version.buildCommit to GO_LDFLAGS
  - Add the upstream 'internal/version.buildCommit' flag to GO_LDFLAGS using
    %{release} as the value


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.3-1
changelog:
  - Update to release v1.36.3
  - Resolves: rhbz#2510870
  - Resolves  CVE-2026-15809: rhbz#2500983
  - Upstream fixes


author: Packit <hello@packit.dev> - 5.4.4.0-1
changelog:
  - Update to version 5.4.4.0
  - Correct libdnf5-cli license to "GPL-2.0-or-later AND LGPL-2.1-or-later"
  - spec: Fix bcond ordering so plugin_systemd_inhibit is enabled
  - libdnf5: Fix dangling reference bug in is_vendor_change_allowed
  - spec: Mark all /etc configuration files as noreplacible
  - spec: Build-require perl(lib) for tests


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.30.0-1
changelog:
  - Update to release v0.30.0
  - Resolves CVE-2026-39984: rhbz#2458929
  - Upstream new features and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.31.0-1
changelog:
  - Update to release v0.31.0
  - Resolve CVE-2026-39829: rhbz#2489939, rhbz#2490056
  - Upstream new features and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.31.2-1
changelog:
  - Update to release v0.31.2
  - Upstream security fixes (including ones in v0.31.1)
  - GHSA-hw3h-2gp9-cxpv
  - GHSA-qx3x-mv6r-52p6
  - GHSA-32pv-7hq5-qhwq
  - GHSA-g2h8-426c-7976
  - GHSA-388v-wmr2-g2v2
  - GHSA-7236-3392-c5c6
  - GHSA-72x6-4j93-7w86
  - Additional fixes`


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.32.0-1
changelog:
  - Update to release v0.32.0
  - Upstream new features and fixes
  - Resolves CVE-2026-47262 - rhbz#2496456
  - Resolves CVE-2026-53492 - rhbz#2496552


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.33.0-2
changelog:
  - Update to new spec file
  - Regenerate spec file using go2rpm
  - Use gocheck2. Current v0.33.0 release will sometimes fail during check
    phase with an https related test. No obvious pattern related to
    architecture. gocheck2 will allow for test to be skipped if needed


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.34.0-1
changelog:
  - Update to release v0.34.0
  - Resolves: rhbz#2467576
  - Resolves CVE-2026-39984: rhbz#2458930
  - Upstream new features and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.35.0-1
changelog:
  - Update to release v0.35.0
  - Resolves: rhbz#2487819
  - Resolves CVE-2026-39828: rhbz#2489918, rhbz#2490102
  - Upstream enhancements, new features, and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.36.0-1
changelog:
  - Update to release v0.36.0
  - Resolves: rhbz#2506339
  - Upstream new features and fixes
  - Resolves CVE-2026-53492 - rhbz#2496553
  - Resolves CVE-2026-47262 - rhbz#2496436


author: Bradley G Smith <bradley.g.smith@gmail.com> - 5.1.3-1
changelog:
  - Update to release v5.1.3
  - Resolves rhbz#2458697
  - Resolves CVE-2026-33747: rhbz#2452188, rhbz#2452199
  - Resolves CVE-2026-33748: rhbz#2453089
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 5.2.0-1
changelog:
  - Update to release v5.2.0
  - Resolves: rhbz#2491751
  - Important upstream note: This version introduces a new reconciliation
    algorithm between the observed state and the expected state. If you
    experience any issues with a Compose workload that was previously
    working, please open an issue with upsteam.
  - Additional upstream enhancements and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 5.3.0-1
changelog:
  - Update to release v5.3.0
  - Resolves: rhbz#2496535
  - Resolves CVE-2026-53492: rhbz#2496550
  - Resolves CVE-2026-47262: rhbz#2496433
  - Upstream note: This release introduces native support for init
    containers.
  - Additional upstream fixes and new features


author: Pavel Valena <pvalena@redhat.com> - 111-2
changelog:
  - fix(base): escape die() message in emergency hook script
  - fix(base): replace eval with safe variable indirection in splitsep and export_n
  - spec: json support for dracut-install (needed for detecting dlopen dependencies)


author: Hans de Goede <johannes.goede@oss.qualcomm.com> - 111-2
changelog:
  - fix(devicetree-firmware): include soc specific firmwares in install_generic()
  - fix(devicetree-firmware): include Qualcomm X2 laptop model specific firmwares


author: Aaron Merey <amerey@redhat.com> - 0.195-1
changelog:
  - Upgrade to upstream elfutils 0.195
  - Drop upstreamed patches
    elfutils-0.194-aarch64-Recognize-SHT_AARCH64_ATTRIBUTES.patch
    elfutils-0.194-alloc-jobs.patch
    elfutils-0.194-fix-const.patch
    elfutils-0.194-sh_addr-non-zero.patch
  - Add gelf.3 to %files
  - Enable eu-stacktrace on aarch64
  - Rename elfutils-default-yama-scope subpackage to yama-ptrace-enable,
    drop Requires on elfutils-libs, add Recommends on elfutils main
    package for FESCo Change #3569 (rhbz#2448388)


author: Aaron Merey <amerey@redhat.com> - 0.196-1
changelog:
  - Upgrade to upstream elfutils 0.196 (rhbz#2516216)
  - Obsolete all versions of elfutils-default-yama-scope so that the
    package from an older Fedora is removed on upgrade (rhbz#2515161)
  - Add eu-stackprof, a new tool for collecting systemwide stacktrace
    profiles, on x86/ARM
  - Remove the experimental eu-stacktrace tool along with the
    sysprof-capture-devel build dependency
  - Add libpfm-devel build dependency for eu-stackprof


author: Ruslan Bekenev <furyinbox@gmail.com> - 1.27.0-1
changelog:
  - Update to 1.27.0
  - Use SPDX License Expression for License
  - Requires: emacs-filesystem for directory ownership


author: Mike FABIAN <mfabian@redhat.com> - 2.30.3-1
changelog:
  - Update to 2.30.3
  - Add `Mod1+Left` to the default for `commit_and_forward_key` for the
    `tb:*` engines (Resolves: https://github.com/mike-fabian/ibus-typing-
    booster/issues/879#issuecomment-3844807216)
  - Translation update from Weblate (kab 71.4%, ro 100%)


author: Mike FABIAN <mfabian@redhat.com> - 2.30.4-1
changelog:
  - Update to 2.30.4
  - emoji-picker: key handling improvments: Show selected emoji clearly, Fix
    Control+f and Escape issue, Navigation with arrow keys in the flowboxes
    (See: See: https://github.com/mike-fabian/ibus-typing-
    booster/issues/883#issuecomment-3901653686)
  - emoji-picker: Don’t show popover when autoselecting first search result
    (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/883)
  - Translation update from Weblate (kab 73.8%)


author: Mike FABIAN <mfabian@redhat.com> - 2.30.6-1
changelog:
  - Update to 2.30.6
  - Split itb_util.py into itb_util_core.py and itb_util_gui.py and use only
    itb_util_core for `ibus-typing-booster --xml` (Resolves:
    https://github.com/mike-fabian/ibus-typing-booster/issues/888)
  - Don’t check for gnome and gnome version in a loop over all input methods!
    Check only once! (Resolves: https://github.com/mike-fabian/ibus-typing-
    booster/issues/889)
  - Translation update from Weblate (cs 100%, es 100%, ru 100%, zh_CN
    100%)


author: Mike FABIAN <mfabian@redhat.com> - 2.30.9-1
changelog:
  - Update to 2.30.9
  - More fine grained control of whether digits can be used in the preedit
    (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/905)
  - Translation update from Weblate (new: ca 100%, el 29.6%, es 100%)


author: Mike FABIAN <mfabian@redhat.com> - 2.30.10-1
changelog:
  - Update to 2.30.10
  - Run doctests requiring `regex` only when `regex` is available (Resolves:
    https://github.com/mike-fabian/ibus-typing-booster/issues/909)
  - Translation update from Weblate (fa 4.7%, lt 8.5%, or 34.1%, si 1%)
  - Add `BuildRequires: gobject-introspection`, see: https://github.com/mike-
    fabian/ibus-typing-booster/issues/909#issuecomment-4679627321


author: Mike FABIAN <mfabian@redhat.com> - 2.30.11-1
changelog:
  - Update to 2.30.11
  - Make values for spellchecking suggestions not depend on whether hunspell
    suggests the input word as its own correction (Resolves:
    https://github.com/mike-fabian/ibus-typing-booster/issues/918)
  - Translation update from Weblate (ko 100%)


author: Mike FABIAN <mfabian@redhat.com> - 2.31.0-1
changelog:
  - Update to 2.31.0
  - Require Python 3.9+
  - Modernize code for Python 3.9
  - Fix problem when typing `BackSpace` at the left side of the preedit
    (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/923)


author: Peter Lemenkov <lemenkov@gmail.com> - 27.3.4.16-1
changelog:
  - Ver. 27.3.4.16

  8 Mon Jul 27 2026 Peter Lemenkov <lemenkov@gmail.com> - 27.3.4.15-1
  - Ver. 27.3.4.15


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 5.0.10-1
changelog:
  - Update to version 5.0.10 release (resolves rhbz#2516129)
    Remove python version patch (resolved upstream)


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 5.0.13-1
changelog:
  - Update to version 5.0.13 (resolves rhbz#2521279)
    remove patch for PEP 639 compliance (fixed upstream in commit 9a35bf07)
    Add (post release) upstream commit 89ce57d to fix pytest failures
    Update pytest invokation as suggested by upstream


author: psklenar@redhat.com <psklenar@redhat.com> - 2.7.1-2
changelog:
  - fedora CI plans move to gitlab for centos-stream test space
    https://issues.redhat.com/browse/RHELMISC-13073


author: Miroslav Suchý <msuchy@redhat.com> 1.67-1
changelog:
  - add autossh man page ultra permissive dedication
  - add LGPL-2.1-only WITH Digia-Qt-LGPL-exception-1.1
  - add jove license
  - add man2html license
  - add DocBook-DTD license
  - add BSD-2-Clause-pkgconf-disclaimer
  - correct expression of PHP-3.0
  - Add SpacemiT esos.elf license as allowed-firmware
  - Add 7zip public domain headers
  - add Game-Programming-Gems license
  - add LGPL-2.1-or-later WITH polyparse-exception
  - add GPL-3.0-or-later WITH GPL-3.0-linking-source-exception
  - enhance BSD-3-Clause-Clear usage text
  - document known exception for kernel for BSD-3-Clause-Clear
  - add LicenseRef-Hauppauge-firmware-eula as not allowed
  - add LicenseRef-Hauppauge as not allowed


author: Miroslav Suchý <msuchy@redhat.com> 1.68-1
changelog:
  - add CC-SA-1.0 as allowed-content
  - allow golang-x-perf to use CC-BY-4.0 for code as an exception
  - add GPL-3.0-or-later WITH Libtool-exception
  - UltraPermissive: Add a text found in libisds
  - add LicenseRef-Geotrans as not-allowed
  - Add public-domain dedication for jemalloc/rust-tikv-jemalloc-sys
  - add Aspell-RU
  - add ngrep
  - add Unlicense-libwhirlpool
  - add Unlicense-libtelnet
  - add CDLA-Permissive-2.0
  - add BSD-3-Clause WITH AdditionRef-Dart
  - add UltraPermissive dedication of autossh


author: Miroslav Suchý <msuchy@redhat.com> 1.70-1
changelog:
  - add GPL-2.0-only WITH Universal-FOSS-exception-1.0
  - add libpng licenses
  - add UltraPermissive dedication of tolua++
  - add note and link that APSL-1.x can be used as APSL-2.0
  - add LicenseRef-Remix-icon as not-allowed
  - describe how to use LicenseRef-IUPAC-InChI-Trust
  - Add public-domain dedication for dcm2niix
  - add LicenseRef-Aalok-Everfree as not-allowed
  - add public domain dedication of libtommath
  - add public domain dedication of heimdal


author: Miroslav Suchý <msuchy@redhat.com> 1.71-1
changelog:
  - add GPL-2.0-or-later WITH LicenseRef-Fedora-Temporary-kvirc-openssl-exception
  - add GPL-3.0-or-later WITH LicenseRef-Fedora-Temporary-cryptsetup-OpenSSL-
    exception
  - add LGPL-2.1-or-later WITH LicenseRef-Fedora-Temporary-Simple-Library-
    exception
  - add AGPL-3.0-or-later WITH LicenseRef-Fedora-Temporary-PS-or-PDF-font-
    exception-20170817
  - add LGPL-2.0-only WITH LicenseRef-Fedora-Temporary-Classpath-exception-
    variation
  - add LicenseRef-Fedora-Temporary-IJG
  - add LicenseRef-Fedora-Temporary-BSD-1-Clause-alglib
  - add LicenseRef-Fedora-Temporary-OSSP
  - add LicenseRef-Fedora-Temporary-AZL
  - add LicenseRef-Fedora-Temporary-Python-trace
  - add Advanced-Cryptics-Dictionary license
  - add BSD-Mark-Modifications license
  - Remove deprecated parts from JSON
  - grammar: sort ID alphabetically
  - grammar: do not allow bad license with OR operator
  - add WTFNMFPL license
  - add LicenseRef-HPND-TAES as not-allowed
  - add LGPL-2.0-only WITH Universal-FOSS-exception-1.0
  - OPUBL-1.0: Move packages_with_exceptions into [license]
  - Add public-domain dedication for tinyxml2
  - add WordNet license
  - Extend ISO-8879 exception to dotnet10.0


author: Miroslav Suchý <msuchy@redhat.com> 1.73-1
changelog:
  - add dedications from linux-firmware from qcom/NOTICE.txt
  - add LGPL-2.0-only WITH Classpath-exception-2.0-short
  - add OSSP license
  - add GPL-3.0-or-later WITH GCC-exception-2.0
  - add hyphen-bulgarian license
  - add GPL-2.0-or-later WITH kvirc-openssl-exception
  - add LICENCE.siano from linux-firmware to firmware.txt
  - add HPND-SMC
  - removed LicenseRef-Fedora-Temporary-IJG
  - add LicenseRef-Fedora-Wadalab
  - rename LicenseRef-Fedora-Temporary-* to AdditionRef-Fedora-Temporary-*


author: Miroslav Suchý <msuchy@redhat.com> 1.74-1
changelog:
  - remove LicenseRef-Romio as it equals to SPDX ID mpich2
  - add public domain dedication from gstreamer1-plugins-bad-free
  - add public domain dedication from openmpi
  - add LICENSE.QualcommAtheros_ar3k from linux-firmware to firmware.txt
  - add text to LicenseRef-* licenses
  - add public domain dedication from rb_libtorrent
  - add LicenseRef-BSD-TPM as not-allowed
  - add LicenseRef-Hippocratic-3.0 as not-allowed
  - add LICENSE.i915 from linux-firmware to firmware.txt
  - add LICENCE.IntcSST2 from linux-firmware to firmware.txt
  - add LicenseRef-ECMA-spec license
  - add NPL-1.1 license
  - rename LGPL-2.1-or-later_WITH_AdditionRef-Fedora-Temporary-Simple-Library-
    exception to final LGPL-2.1-or-later_WITH_Simple-Library-Usage-exception
  - rename LicenseRef-Fedora-Temporary-BSD-1-Clause-alglib to ALGLIB-
    Documentation
  - rename AGPL-3.0-or-later_WITH_AdditionRef-Fedora-Temporary-PS-or-PDF-font-
    exception-20170817 to AGPL-3.0-or-later_WITH_PS-or-PDF-font-
    exception-20170817
  - add firmware license from linux-firmware - LICENSE.amdnpu
  - add firmware license from linux-firmware - LICENCE.Marvell
  - add firmware license from linux-firmware - LICENCE.OLPC
  - add firmware license from linux-firmware - LICENCE.ti-connectivity
  - add firmware license from linux-firmware - LICENCE.xc4000
  - add firmware license from linux-firmware - LICENCE.adsp_sst
  - add LICENCE.mediatek from linux-firmware to firmware.txt


author: Miroslav Suchý <msuchy@redhat.com> 1.75-1
changelog:
  - add MIT WITH fmt-exception
  - add LicenseRef-Remix-icon-license-1.0 as not-allowed
  - add LPD-document as allowed-content
  - add public domain dedication from tcputils
  - add GPL-2.0-only WITH eCos-exception-2.0 as allowed
  - rename temporary AdditionRef-WebM-patent-license to Google-Patent-WebM
  - Add public-domain dedication for python-rnc2rng
  - add public domain dedication from enchant
  - Add rocq-doc as known exception to OPUBL-1.0
  - add GPL-3.0-or-later WITH CGAL-linking-exception
  - replace temporary ID with sqlitestudio-OpenSSL-exception
  - add gstreamer1-doc as known exception to OPUBL-1.0
  - add public domain dedication from fcitx5-mozc
  - add public domain dedication from bsd-games


author: Miroslav Suchý <msuchy@redhat.com> 1.76-1
changelog:
  - Add dotnet11.0 to the LicenseRef-ISO-8879 list
  - add atc-game
  - Rename ODbl-1.0 -> ODbL-1.0
  - add LGPL-2.1-or-later WITH Spelling-Provider-LGPL-exception
  - add LicenseRef-Eirene as not allowed
  - add GPL-2.0-or-later_WITH_CLISP-exception-2.0
  - add Informatica
  - update links to new location at forge.fedoraproject.org
  - Add intel_vpu
  - Update to add LICENCE.atheros_firmware
  - add GPL-3.0-or-later WITH Autoconf-exception-3.0 as allowed


author: Vincent Mihalkovic <vmihalko@redhat.com> - 5.48-3
changelog:
  - Allow external decompressors to execute under Landlock
  - Migrate Python bindings to pyproject macros
    Resolves: rhbz#2513643
    Resolves: rhbz#2427330
    Resolves: rhbz#2378541


author: Martin Stransky <stransky@redhat.com> - 154.0-4
changelog:
  - Backported fix for HDR crash when HLG transform is missing
    (and it's always missing!).
  - Backported HDR fix for GL framebuffer (D318191).


author: Artur Frenszek-Iwicki <fedora@svgames.pl> - 3.2.2-16
changelog:
  - Convert License tag to SPDX
  - Add a patch to make generated code fallback to localhost if no DNS servers are specified
  - Add a patch to fix symbols being wrongly marked as unused


author: Ondrej Holy <oholy@redhat.com> - 2:3.27.1-1
changelog:
  - Update to 3.27.1 (CVE-2026-55191, CVE-2026-55192, CVE-2026-55193,
    CVE-2026-55194, CVE-2026-55648, CVE-2026-55827)
    Resolves: rhbz#2488900


author: Ondrej Holy <oholy@redhat.com> - 2.11.7-16
changelog:
  - Backport several CVE fixes (CVE-2026-22852, CVE-2026-22854, CVE-2026-22855,
    CVE-2026-22856, CVE-2026-22858, CVE-2026-22859, CVE-2026-23530,
    CVE-2026-23531, CVE-2026-23532, CVE-2026-23533, CVE-2026-23534,
    CVE-2026-23732, CVE-2026-23883, CVE-2026-23884, CVE-2026-23948,
    CVE-2026-24491, CVE-2026-24675, CVE-2026-24676, CVE-2026-24679,
    CVE-2026-24681, CVE-2026-24683, CVE-2026-24684, CVE-2026-25952,
    CVE-2026-26955, CVE-2026-26965, CVE-2026-26986, CVE-2026-27951,
    CVE-2026-29775, CVE-2026-31806, CVE-2026-31883, CVE-2026-31884,
    CVE-2026-31885, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985,
    CVE-2026-45700, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299 and
    CVE-2026-68580)
    Resolves: rhbz#2430919, rhbz#2430908, rhbz#2430898, rhbz#2430914, rhbz#2430903
    Resolves: rhbz#2430924, rhbz#2430933, rhbz#2429808, rhbz#2429823, rhbz#2429794
    Resolves: rhbz#2443146, rhbz#2442975, rhbz#2429799, rhbz#2429814, rhbz#2429821
    Resolves: rhbz#2438309, rhbz#2438321, rhbz#2438308, rhbz#2438328, rhbz#2438324
    Resolves: rhbz#2438302, rhbz#2438310, rhbz#2438300, rhbz#2447394, rhbz#2453243
    Resolves: rhbz#2453240, rhbz#2442837, rhbz#2442810, rhbz#2447426, rhbz#2447422
    Resolves: rhbz#2447413, rhbz#2447416, rhbz#2453247, rhbz#2442857, rhbz#2491683
    Resolves: rhbz#2510295, rhbz#2510643, rhbz#2503646, rhbz#2510448


author: Dan Streetman <ddstreet@ieee.org> - 43-0.2
changelog:
  - Change dbus-daemon.service to dbus-broker.service in preset files (rhbz#2373032)
  - I see you, Tom. I see you.


author: Nicolas Mailhot <nim@fedoraproject.org> - 1.26.4-3
changelog:
  - remove handling of gopath dirs from the golang package as they are no
    longer necessary and will conflict with https://pagure.io/go-rpm-macros/


author: Leo Sandoval <lsandova@redhat.com> - 2.12-69
changelog:
  - mm: try allocating regions above defined limit as last resource
  - Revert 'verifiers: Allocate EFI pages instead of grub_malloc for verified buffer'
  - Resolves: #2263643
  - Related: #2427945
  - Related: #2422881
  - Related: #2453022
  - Related: #2451630
  - Related: #2450672


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.35~alpha2-4
changelog:
  - Fix typo in ibus-compose
  - Merge ibus-2444009-wayland-xkb-lv-tilde.patch
  - Fix CapsLock between focus changes in Wayland


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.35~beta1-1
changelog:
  - Resolves: #2512529 GTK 4.23.3 apps cause SIGSEGV with ibus-gtk4
  - Implement forward-key-event in Wayland input-method V2
  - Fix some issues in ibus-keypress


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-1
changelog:
  - Bump to 1.5.18
  - Fix Backspace in prediction
  - Update translations
  - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI
  - Delete gnome-themes-extra from Fedora CI


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-4
changelog:
  - Fix some issues with thumb shift mode
  - return False for thumb-shift release keys
  - Add super key support for thumb shift mode


author: Mike FABIAN <mfabian@redhat.com> - 1.17.17-1
changelog:
  - Release 1.17.17
  - Update Unihan_Variants.txt and regenerate engine/chinese_variants.py for
    Unicode 17.0.0 release
  - Translation update from Weblate (ca 100%, cz 97.3%, el 28.7%, fa
    15.0%, hu 22.8%, ja 49.6%, ka 69.3%, kab 37.2%, pt_PT 75.8%, ro
    100%, si 11.1%, zh_HK 20.9%)


author: Mike FABIAN <mfabian@redhat.com> - 1.17.18-1
changelog:
  - Release 1.17.18
  - Enhance TabEngine key handling cancelling logic when suggestion mode is
    active. (Resolves: https://github.com/mike-fabian/ibus-table/pull/215)
  - Translation update from Weblate (cz 100%, el 39.8%, ka 100%, pt_PT
    100%, zh_TW 100%)


author: Mike FABIAN <mfabian@redhat.com> - 1.18.0-1
changelog:
  - Update to 1.18.0
  - Require Python 3.9+ from now on
  - [Optimization] Drop the ESCAPE clause when unneeded and add a tabkeys
    index (Resolves: https://github.com/mike-fabian/ibus-table/pull/235)
  - Stop rewriting the phrases cache every 30s while idle (Resolves:
    https://github.com/mike-fabian/ibus-table/pull/234)
  - Fill the lookup table completely instead of one page at a time (Resolves:
    https://github.com/mike-fabian/ibus-table/pull/232)
  - Translation update from Weblate (de 100%, es 100%, el 40.5%, hu
    50.9%, ja 54.9%, ka 69.9%, kab 41.1%, ko 100%, ru 100%, si 15.0%,
    zh_HK 21.5%)


author: Packit <hello@packit.dev> - 73.0.0-1
changelog:
  Changes with 73.0.0
  ----------------
    - Update dependencies 2026-06-21 (#2451)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - Update osbuild dependency commit ID (#2450)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - disk: check all partitions for boot partition requirement (#2459)
      - Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - github: drop the reverse dependency check with image-builder-cli (#2454)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - imgtestlib: handle missing sources key in tests (#2447)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - osbuild: ddi mount (#2457)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal
    - rhel-10: reintroduce minimal-raw-xz (#2465)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal

  — Somewhere on the Internet, 2026-06-29


author: Packit <hello@packit.dev> - 74.0.0-1
changelog:
  Changes with 74.0.0
  ----------------
    - Test depsolvednf with dnf5 [HMS-10324] (#2475)
      - Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza
    - Update dependencies 2026-06-28 (#2472)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update dependencies 2026-07-05 (#2490)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - depsolvednf: don't require solver.json in test (#2479)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Brian C. Lane
    - distro/eln: use dnf5 and update package lists (#2482)
      - Author: Yaakov Selkowitz, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - gen-manifest: optimize checksum calculation (#2382)
      - Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Tomáš Hozza
    - generic/bootc: allow disk.yaml to provide root filesystem type (#2405)
      - Author: Joel Capitao, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - github: remove osbuild-composer reverse dependency test (#2477)
      - Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza
    - image-builder/build: add json format option (#2484)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - manifest: add firstboot support (HMS-9187) (#1913)
      - Author: Lukáš Zapletal, Reviewers: Brian C. Lane, Simon de Vlieger
    - many: plumb sdboot options (#2456)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - many: use `image-builder upload` in tests (HMS-10856) (#2476)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - partition_table: Make AlignUp clearer (#2419)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - pkg/rhsm: match subscription baseurls with wildcards (RHEL-36789) (#2460)
      - Author: Lucas Garfield, Reviewers: Achilleas Koutsou, Brian C. Lane, Lukáš Zapletal
    - progress: lock around sub progress (#2487)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - workflows: Add a link to the osbuild-composer API unit test results (#2469)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - workflows: Update old images urls to image-builder (#2468)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-07-08


author: Packit <hello@packit.dev> - 75.0.0-1
changelog:
  Changes with 75.0.0
  ----------------
    - Add hidden pkgsearch subcommand for querying available packages (HMS-11011) (#2515)
      - Author: Gianluca Zuccarelli, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - Always use seed argument directly (#2516)
      - Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - Enable basic bootc-image-builder tests [HMS-10851] (#2467)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Tomáš Koscielniak
    - Enable image-builder container builds [HMS-10851] (#2497)
      - Author: Achilleas Koutsou, Reviewers: Florian Schüller, Simon de Vlieger
    - Fedora ISO Modernization (HMS-9965) (#2533)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Sanne Raymaekers
    - Improve error message for pkgsearch with no packages (#2526)
      - Author: Gianluca Zuccarelli, Reviewers: Brian C. Lane, Lucas Garfield
    - README: update deprecated information in docs (#2498)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Run more bootc-image-builder tests in gitlab [HMS-10854] (#2520)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Tomáš Hozza
    - Update dependencies 2026-07-12 (#2513)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update osbuild dependency commit ID (#2512)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - Update snapshots to 20260705 (#2488)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - bootc: support grub2 serial console customization (#2403)
      - Author: Jean-Baptiste Trystram, Reviewers: Brian C. Lane, Joel Capitao, Tomáš Hozza
    - build(deps): bump actions/checkout from 6 to 7 (#2452)
      - Author: dependabot, Reviewers: Anna Vítová, Simon de Vlieger
    - ci: enable allow-unsafe-pr-checkout in checkout/7 (#2523)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - cmd/image-builder: mock simple integration tests (HMS-10857) (#2473)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - disk: systemd-repart compatibility (#2510)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - fedora: drop slirp4netns from the IoT image (#2478)
      - Author: Peter Robinson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - image-builder: add hidden `--with-upload-result` option (#2521)
      - Author: Sanne Raymaekers, Reviewers: Brian C. Lane, Tomáš Hozza
    - pkg/disk: add XFS agcount option in `disk.yaml` (#2496)
      - Author: Jean-Baptiste Trystram, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - progress: add file progress (HMS-10977) (#2493)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Anna Vítová, Simon de Vlieger
    - test: fix build info cache path creation to use correct runner_distro (#2495)
      - Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - test: fix vm.py import error [HMS-11012] (#2522)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test: go 1.27 compatibility (#2504)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - test: mock cache dir (#2519)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová

  — Somewhere on the Internet, 2026-07-21


author: Packit <hello@packit.dev> - 76.0.0-1
changelog:
  Changes with 76.0.0
  ----------------
    - Restore anaconda-iso/iso type to bootc-image-builder (#2527)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update osbuild dependency commit ID (#2531)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - anaconda: enable shell shenanigans for anaconda (#2544)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - build(deps): bump actions/setup-go from 6 to 7 (#2532)
      - Author: dependabot, Reviewers: Achilleas Koutsou, Anna Vítová
    - eln: set runner to eln11 (#2535)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - image-builder: distro detection for `build` and `manifest` (#2542)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Ondřej Budai

  — Somewhere on the Internet, 2026-07-22


author: Packit <hello@packit.dev> - 77.0.0-1
changelog:
  Changes with 77.0.0
  ----------------
    - Generate bootc-image-builder test jobs dynamically and enable all tests [HMS-11073] (#2539)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Simon de Vlieger
    - Refactor CLI setup (#2503)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Update osbuild dependency commit ID (#2555)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - anaconda: rectify comment (#2548)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová, Lukáš Zapletal
    - bib: Replace logrus usage with olog (#2543)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - bib_legacy: Use functions from bootc (#2540)
      - Author: Brian C. Lane, Reviewers: Anna Vítová, Lukáš Zapletal, Simon de Vlieger
    - build(deps): bump actions/setup-python from 6 to 7 (#2556)
      - Author: dependabot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - eln: enable `aarch64` for `gce` (HMS-11095) (#2558)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - github: enable building the bootc-image-builder container [HMS-11005] (#2549)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - gitlab: remove setup-show option for pytest (#2551)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Brian C. Lane
    - manifest/raw_bootc: support subscription registration on first boot (HMS-10897) (#2528)
      - Author: Lucas Garfield, Reviewers: Brian C. Lane, Simon de Vlieger
    - pkg/koji/upload: session credentials to headers (#2550)
      - Author: Anna Vítová, Reviewers: Florian Schüller, Sanne Raymaekers

  — Somewhere on the Internet, 2026-07-28


author: Packit <hello@packit.dev> - 78.0.0-1
changelog:
  Changes with 78.0.0
  ----------------
    - Simplify early manifest generation code and enable custom seeds for bootc-based images (#2565)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Update RHEL 9, 10 OCI image defs to add Oracle as cloud init datasource (#2559)
      - Author: src-up, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update osbuild dependency commit ID (#2576)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260719 (#2530)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - ci: tag containers (#2575)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - cmd/image-builder: drop `images` from version (#2573)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - container: add SetAuthFilePath method to Resolver (#2580)
      - Author: Ondřej Budai, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - disk: align footer to grain by default (#2562)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - disk: take the ESP size from the image type's partition table (RHEL-214147) (#2552)
      - Author: Lucas Garfield, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - distro/generic: pass subscription options to pxe-tar-xz images (HMS-11108) (#2564)
      - Author: Lucas Garfield, Reviewers: Achilleas Koutsou, Brian C. Lane
    - fedora: create 46 (#2546)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Florian Schüller
    - imgtestlib: configure setuptools package discovery (#2563)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test/imgtestlib: revert boot.py to old behaviour (#2579)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test: remove iot-bootable-container image type (#2569)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-08-10


author: Packit <hello@packit.dev> - 79.0.0-1
changelog:
  Changes with 79.0.0
  ----------------
    - Fix the container resolver tests (#2602)
      - Author: Achilleas Koutsou, Reviewers: Florian Schüller, Sanne Raymaekers
    - Run privileged unit tests on gitlab (#2603)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Start container with repos support for legacy ISO only [HMS-11156] (#2582)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Update osbuild dependency commit ID (#2600)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260816 (#2599)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - anaconda_installer: platform build packages (#2589)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Sanne Raymaekers
    - distrodefs: Add aliases to Fedora for GCP (HMS-11182) (#2583)
      - Author: Tomáš Koscielniak, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - fedora: drop explicit `anaconda-widgets` (#2597)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Katerina Koukiou, Lukáš Zapletal
    - image-builder: reuse progress bars for upload (#2592)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Lukáš Zapletal, Simon de Vlieger
    - manifest: accept human-readable image sizes (#2571)
      - Author: tomatotomata, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - osbuild/rpm: implement generic env   (#2586)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - ova: set os type and virtual hardware version (HMS-3248) (#2480)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - packit: enable riscv64 (#2595)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - pkg/disk.yaml: add an option to not grow root (#2524)
      - Author: Jean-Baptiste Trystram, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test: add GPG keys to Fedora 44 test repos (#2585)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Simon de Vlieger
    - test: mock host arch for package search (#2594)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal

  — Somewhere on the Internet, 2026-08-20


author: Packit <hello@packit.dev> - 82.0.0-1
changelog:
  Changes with 82.0.0
  ----------------
    - Enable bootc-image-builder ISO tests on aarch64 [HMS-11073] (#2637)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Lucas Garfield
    - Implement rootless container introspection (#2617)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Anna Vítová, Simon de Vlieger
    - Rewrite container handling internals to drop graphdriver and gpgme dependencies [RHEL-56367] (#2607)
      - Author: Achilleas Koutsou, Reviewers: Lucas Garfield, Simon de Vlieger
    - Update osbuild dependency commit ID (#2631)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260830 (#2630)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - client: Respect CONTAINERS_GRAPHROOT and CONTAINERS_RUNROOT (#2645)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - cmd/image-builder: only run findDistro once (#2651)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - cmd/image-builder: upload messages progress bar (#2654)
      - Author: Simon de Vlieger, Reviewers: Florian Schüller, Sanne Raymaekers
    - el9/10: parity bits (#2659)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - gce: ensure disk images are GiB-aligned (#2655)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - osbuild: compare Go against JSON (#2529)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - osinfo: never fall back if new prefix exists (#2649)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - osinfo: warn on old-prefix usage (#2648)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Gianluca Zuccarelli, Sanne Raymaekers
    - pkg/crypt: add support for yescrypt hashed passwords (#2650)
      - Author: Loris Fauster, Reviewers: Lucas Garfield, Simon de Vlieger
    - pkg/rhsm: use Katello CA as default on Satellite hosts (#2613)
      - Author: Lukáš Zapletal, Reviewers: Lucas Garfield, Simon de Vlieger
    - rm SECURITY.md: fall back to org-wide policy (#2633)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Simon de Vlieger
    - rootless: Don't disallow --in-vm in rootless non-container (#2626)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-09-04


author: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-9
changelog:
  - Reapply the change to keep symlinks managed by alternatives under /usr/bin,
    this time with a scriptlet create symlinks if /usr/sbin is unmerged.


author: Kevin Fenzi <kevin@scrye.com> - 1.8.12-1
changelog:
  - Update to 1.8.12. Fixes rhbz#2440980
  - Add patch to revert refuse to run under file capabilities and fix docker.


author: David Howells <dhowells@redhat.com> 0.7-1
changelog:
  - aklog-kafs: Update the cmdline options to be closer to standard aklog.
  - aklog-kafs: Reduce verbosity.
  - aklog-kafs: Allow the destination keyring to be specified.
  - aklog-kafs: Do better default keyring handling.
  - aklog-kafs: Improve error messages.
  - kafs-preload: Add a debug cmdline option and reduce some verbosity.
  - kafs-check-config: Use the kernel's rootcell if no cell specified.
  - Convert most manpages to POD form and supply a generation script.
  - kafs-check-config: Fix a missing inclusion of unistd.h.
  - lib: Fix a modification of a read-only string.
  - Move to using autoconf when building.
  - Generate manpages during the build.
  - kafs-preload: Honour the show_cell setting on each cell.
  - Add SPDX licence tags.
  - Remove the street address from the LICENCE file.


author: David Howells <dhowells@redhat.com> 0.8-1
changelog:
  - Updated cellservdb.
  - spec: Change to new format licence tag.
  - spec: Buildrequire make.
  - spec: Remove dep on filesystem-afs rpm.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 6.7.0-2
changelog:
  - Patch kamelion-qmk-helper for qmk-via-api 0.8
  - Account for licenses of statically-linked Rust dependencies


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [7.2.0-0.rc7.d58772d8520c.54]
changelog:
  - Clean up unnecessary pending entries (Justin M. Forbes)
  - Turn on CONFIG_CRYPTO_MLDSA for Fedora (Justin M. Forbes)
  - Linux v7.2.0-0.rc7.d58772d8520c


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [7.2.0-60]
changelog:
  - dracut-virt.conf: change systemd-pcrphase to systemd-pcrextend (Vitaly Kuznetsov)
  - redhat/kernel.spec.template: Switch UKI addons to using UKI cert (Vitaly Kuznetsov)
  - Linux v7.2.0


author: Justin M. Forbes <jforbes@fedoraproject.org> [7.2.1-0]
changelog:
  - Initial setup for stable Fedora release (Justin M. Forbes)
  - Reset Makefile.rhelver for the 7.3 cycle (Justin M. Forbes)
  - Merge configs into common for 7.2 (Justin M. Forbes)
  - redhat/configs: automotive: enable RTC_DRV_PL031 (Eric Chanudet)
  - redhat: name the dtb and UKI arch lists (Jan Stancek)
  - redhat: use one spelling for the nobuildarches files guard (Jan Stancek)
  - redhat: drop stale ppc64 from the kabidw-base arch list (Jan Stancek)
  - redhat: document the kabichk force-off as a seasonal toggle (Jan Stancek)
  - redhat: use one spelling for the include and gemini conditionals (Jan Stancek)
  - redhat: remove unused elf_image_install_path and duplicate defines (Jan Stancek)
  - redhat: drop the dead kernel-tools __requires_exclude python filter (Jan Stancek)
  - redhat: drop the Fedora 41 cross-build gdb-index workaround (Jan Stancek)
  - redhat: drop stale build switches from dist-perf and dist-rpm-baseonly (Jan Stancek)
  - redhat: give kernel-automotive its own summary (Jan Stancek)
  - redhat: drop leftover kernel_kvm_post calls for rt-64k (Jan Stancek)
  - redhat: restore missing summary of the kernel-debug variant (Jan Stancek)
  - redhat: fix parse error in baseonly sanity check message (Jan Stancek)
  - Linux v7.2.1


author: Justin M. Forbes <jforbes@fedoraproject.org> [7.2.3-0]
changelog:
  - Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 (Junjie Cao)
  - ACPI: scan: Do not combine resources that overlap completely (Rafael J. Wysocki)
  - ACPI: scan: Avoid registering platform devices with resource overlaps (Rafael J. Wysocki)
  - page_pool: keep frag_offset aligned for odd-sized requests (Florian Schauer) [2521546 2521847]
  - media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() (Laurent Pinchart)
  - media: i2c: cvs: Add NVL ACPI ID (Arun T)
  - media: i2c: cvs: Add IPU8 PCI device ID (Arun T)
  - random: Drop the extrng module reference when import_ubuf() fails (Junjie Cao) [2524262]
  - Add mechanism to back out the af_alg_restrict sysctl (Justin M. Forbes)
  - crypto: af_alg - Stop after finding name in allowlist (Eric Biggers)
  - crypto: af_alg - Replace 'bool privileged' with flags (Eric Biggers)
  - crypto: af_alg - Make cbc(paes) privileged-only (Eric Biggers)
  - crypto: af_alg - clean up kernel-doc warnings (Randy Dunlap)
  - crypto: af_alg - Allow additional ciphers for cryptsetup (Eric Biggers)
  - crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 (Eric Biggers)
  - Linux v7.2.3


author: Steve Cossette <farchord@gmail.com> - 6.27.0-1
changelog:
  - Initial release (Rename/version scheme change from kmime)
  - Removed doc subpackage (It's been empty for a while)
  - Cleaned up dependancies


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.37.0-1
changelog:
  - Add initial Kubernetes 1.37.0 release
  - Initial release for Fedora
  - Urgent (must read) upgrade notes at: https://github.com/kubernetes/kubern
    etes/blob/master/CHANGELOG/CHANGELOG-1.37.md#urgent-upgrade-notes
  - New features, enhancements, and fixes


author: Artur Frenszek-Iwicki <fedora@svgames.pl> - 4.8-3
changelog:
  - Build the IDE for all widgetsets, not just GTK2
  - Suffix qt5pas/qt6pas versions with Lazarus version instead of abusing the Release number


author: Remi Collet <remi@remirepo.net> - 1.1.4-8
changelog:
  - fix test suite with memcached 1.6.40
    reported as https://github.com/awesomized/libmemcached/issues/161
    using fix from https://github.com/awesomized/libmemcached/pull/162


author: Remi Collet <remi@remirepo.net> - 1.1.4-12
changelog:
  - fix FTBFS #2504281
  - add patch for Sphinx 9 from
    https://github.com/awesomized/libmemcached/pull/159
  - re-license spec file to CECILL-2.1


author: Milan Crha <mcrha@redhat.com> - 3.6.6-6
changelog:
  - Add patch for CVE-2026-1539 (Also remove Proxy-Authorization header on
    cross origin redirect)
  - Resolves: rhbz#2433867


author: Andreas Schneider <asn@redhat.com> - 0.26.10-1
changelog:
  - Update to version 0.26.10
  - https://github.com/tree-sitter/tree-sitter/releases/tag/v0.26.10
  - resolves: rhbz#2479963


author: Miro Hrončok <mhroncok@redhat.com> - 5.4.8-4
changelog:
  - Move the license file to lua-libs, so it is always present if any combination of subpackages is installed
  - Fixes: rhbz#2418960


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 0.5.3^20220831git2d4ba970-10
changelog:
  - F42+: Add old style pre scriptlet for LXDM user creation so as to make it work
    when upgrading from F41


author: Frédéric Bérat <fberat@redhat.com> - 1.7.0-2
changelog:
  - Apply upstream patches for repository and error handling
  - Refactor CentOS Stream repo definitions to use metalink
  - Add CentOS Stream repositories to EPEL config
  - Improve error handling for unknown distributions
  - Enhance DNF query distribution context


author: Frédéric Bérat <fberat@redhat.com> - 1.8.0-1
changelog:
  - Update to version 1.8.0
  - Remove upstreamed patches
  - Update source checksum
  - Add v1.8.0 tarball to .gitignore


author: Frédéric Bérat <fberat@redhat.com> - 1.8.0-2
changelog:
  - Apply patch to improve package committish resolution logic
  - Centralize and correct package committish determination
  - Correct EPEL chroot string format to 'epel{release}'
  - Pass `is_revdep` to `get_last_build` for reverse dependencies
  - Refine `@last_build` handling for last build found status
  - Consistently apply `releasever` to `revdep_branch` formatting
  - Update CI regression tests for branch resolution logic


author: Frédéric Bérat <fberat@redhat.com> - 1.8.0-4
changelog:
  - Update ELN compose configuration - Update base URLs for ELN composes -
    Remove references to ResilientStorage variant


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.10-11
changelog:
  - Remove redundand restorecon call, redirect safe to ignore output
    to /dev/null, mark module directory to avoid rpm verification


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.10-15
changelog:
  - Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling
    Resolves: #2513829


author: Aleksei Bavshin <alebastr@fedoraproject.org> - 0.2.19-1
changelog:
  - Update to 0.2.19
  - Build with Qt6
  - Convert License tag to SPDX
  - Use xwfb-run for tests instead of xvfb-run


author: Frantisek Krenzelok <fkrenzel@redhat.com> - 3.125.0-2
changelog:
  - fix the nspr version to full expansion
  - affected: https://bugzilla.redhat.com/show_bug.cgi?id=2488324


author: Rostislav Krasny <rostiprodev@gmail.com> - 3.125.0-2
changelog:
  - Reseed the freebl DRBG after fork() so forked children do not replay the
    parent's random stream (Firefox fork server duplicate UUIDs / crypto output)


author: Simon Pichugin <spichugi@redhat.com> - 2.6.10-4
changelog:
  - Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728)
  - Convert STI tests to FMF (rhbz#2382998)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:4.0.0~beta1-5
changelog:
  - Mark release as beta1 according to upstream naming.
  - Update requirements for better backward compatibility


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:4.0.1-3
changelog:
  - We use FIPS provider from a separate package and can drop
    FIPS-specific patches and stop building OpenSSL native FIPS provider


author: Pavol Žáčik <pzacik@redhat.com> - 1:4.0.1-5
changelog:
  - Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary
    (Backport from https://github.com/openssl/openssl/commit/4360d53)


author: Packit <hello@packit.dev> - 183-1
changelog:
  Changes with 183
  ----------------
    - .gitlab-ci.yml: add 9.8-ga and 10.2-ga (#2457)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon Steinbeiß
    - Optimize osbuild-depsolve-dnf memory and runtime performance (HMS-10526) (#2456)
      - Author: Tomáš Hozza, Reviewers: Brian C. Lane, Lukáš Zapletal
    - Update images dependency ref to latest (#2461)
      - Author: SchutzBot, Reviewers: Simon de Vlieger, Tomáš Hozza
    - mounts/ddi: mounting of DDIs (#2459)
      - Author: Simon de Vlieger, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - runners: `eln11` (HMS-10652, HMS-10652) (#2453)
      - Author: Simon de Vlieger, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - test: update container IDs for manifest-list-test (#2455)
      - Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza

  — Somewhere on the Internet, 2026-05-27


author: Packit <hello@packit.dev> - 185-1
changelog:
  Changes with 185
  ----------------
    - Update snapshots to 20260531 (#2466)
      - Author: SchutzBot, Reviewers: Anna Vítová, Lukáš Zapletal, Simon de Vlieger
    - ci: fix `test_qemu` (#2483)
      - Author: Simon de Vlieger, Reviewers: Simon Steinbeiß, Tomáš Hozza
    - org.osbuild.ovf: support setting virtual hardware version (HMS-3248) (#2468)
      - Author: Sanne Raymaekers, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - runners: Add Oracle Linux 9 runner symlinked to CentOS9 (#2476)
      - Author: Laurence Rochfort, Reviewers: Brian C. Lane, Simon de Vlieger
    - sources/librepo: accept SHA1 (#2477)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Lukáš Zapletal

  — Somewhere on the Internet, 2026-06-17


author: Packit <hello@packit.dev> - 187-1
changelog:
  Changes with 187
  ----------------
    - Update images dependency ref to latest (#2497)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - Update osbuild-ci container images (#2493)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - Update snapshots to 20260705 (#2496)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - containers-storage: Handle missing `storage.conf` values (#2501)
      - Author: Joel Capitao, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - stages/bootc.install-to-fs: remount /dev/shm in addition to /dev/shm (#2494)
      - Author: Alexander Larsson, Reviewers: Simon de Vlieger, Tomáš Hozza
    - stages/org.osbuild.bfb: BFB boot grub shims (#2471)
      - Author: Eli Elgaev, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - stages: add org.osbuild.grub2.d (#2473)
      - Author: Jean-Baptiste Trystram, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - utils: add utils.makeefi library (#2499)
      - Author: Dusty Mabe, Reviewers: Achilleas Koutsou, Renata Ravanelli, Simon de Vlieger

  — Somewhere on the Internet, 2026-07-10


author: Packit <hello@packit.dev> - 189-1
changelog:
  Changes with 189
  ----------------
    - Added new stage org.osbuild.idmap to enable shifting UIDs/GIDs (#2495)
      - Author: Michael Engel, Reviewers: Brian C. Lane, Simon de Vlieger
    - Update images dependency ref to latest (#2517)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update osbuild-ci container images (#2508)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - Update snapshots to 20260712 (#2505)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - Update snapshots to 20260719 (#2511)
      - Author: SchutzBot, Reviewers: Anna Vítová, Lukáš Zapletal
    - Update snapshots to 20260726 (#2516)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - add Oracle as datasource to cloud init (#2519)
      - Author: src-up, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - ci: enable allow-unsafe-pr-checkout (#2515)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Brian C. Lane, Simon de Vlieger
    - stage/rpm: include additional header digests (#2478)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - test: adapt to image-builder cache new layout (HMS-10855) (#2514)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Brian C. Lane

  — Somewhere on the Internet, 2026-07-29


author: Packit <hello@packit.dev> - 190-1
changelog:
  Changes with 190
  ----------------
    - Update images dependency ref to latest (#2523)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update images dependency ref to latest (#2529)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update osbuild-ci container images (#2521)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - Update snapshots to 20260802 (#2522)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260809 (#2528)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - stage/rpm: general env options (#2524)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - stage/rpm: query only supported metadata tags (HMS-11174) (#2526)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-08-11


author: Packit <hello@packit.dev> - 191-1
changelog:
  Changes with 191
  ----------------
    - Add SECURITY.md file (#2536)
      - Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - Add a manifest for buiding a Fedora riscv64 container in an x86_64 buildroot (#2539)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Schutzfile: update Fedora 43 repo snapshots (#2535)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Support rootless osbuild runs without container (#2546)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update images dependency ref to latest (#2543)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - Update osbuild-ci container images (#2540)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260816 (#2541)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - main: Make rootless work when using the /usr/bin/osbuild wrapper (#2547)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - rhsm: prefer Katello CA on Satellite-registered hosts (SAT-37848) (#2537)
      - Author: Lukáš Zapletal, Reviewers: Brian C. Lane, Simon de Vlieger
    - spec: update osbuild-initrd dependency to 0.2 (#2545)
      - Author: Achilleas Koutsou, Reviewers: Alexander Larsson, Simon de Vlieger
    - stages/dd: create `dd` stage (#2533)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal
    - test: fix missing mock_run (#2534)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová

  — Somewhere on the Internet, 2026-08-23


author: Packit <hello@packit.dev> - 193-1
changelog:
  Changes with 193
  ----------------
    - Update images dependency ref to latest (#2555)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update osbuild-ci container images (#2556)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update osbuild-ci container images (#2558)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260830 (#2553)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - qemu: Uncompress kernels not supported by qemu (#2551)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - rm SECURITY.md: fall back to org-wide policy (#2554)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Simon de Vlieger
    - rootless: Use the correct container storage (#2550)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Anna Vítová, Simon de Vlieger
    - stages/tree-delta: produce delta trees (#2527)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová, Florian Schüller

  — Somewhere on the Internet, 2026-09-06


author: Neal Gompa <ngompa@fedoraproject.org> - 2.1.0-2
changelog:
  - Fix setting to background in LXQt sessions
  - Clean up spec formatting and changelog
  - Drop broken rpmautospec setup


author: Filipe Rosset <filiperosset@fedoraproject.org> - 5.4.3-1
changelog:
  - update to 5.4.3 fixes rhbz#2492868
  - a bunch of other bugs were fixed and will be backported to all supported
    Fedora / EPEL versions


author: Paul Howarth <paul@city-fan.org> - 2.150011-1
changelog:
  - Update to 2.150011 (rhbz#2432163)
    - Improved example of testing a minimum prerequisite version of a module
    - Remove some code meant to handle running on pre-v5.8 perl, even though v5.8
      was already a requirement
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 2.150012-1
changelog:
  - Update to 2.150012 (rhbz#2432714)
    - Distribution metadata update
  - Add workaround for test issues with CPAN::Meta::Requirements ≥ 2.144
    https://github.com/Perl-Toolchain-Gang/CPAN-Meta/issues/145


author: Paul Howarth <paul@city-fan.org> - 2.150013-1
changelog:
  - Update to 2.150013 (rhbz#2441425)
    - Fix an incompatibility with newer CPAN::Meta::Requirements (GH#145, GH#147)
  - Drop obsoletion of perl-Parse-CPAN-Meta introduced in 2016


author: Paul Howarth <paul@city-fan.org> - 2.150015-1
changelog:
  - Update to 2.150015 (rhbz#2526487)
    - Bump prereq for CPAN::Meta::Requirements to fix a test (GH#154)
    - No longer normalizing alpha versions in provides hash (GH#139)


author: Paul Howarth <paul@city-fan.org> - 4.40-1
changelog:
  - Update to 4.40
    - Fix overflow with overlong numbers, fuzzing only (CVE-2025-40929)
    - Detect more malformed numbers, with two decimal points
    - Pin Github actions to latest @v via pinact run -u


author: Paul Howarth <paul@city-fan.org> - 4.41-1
changelog:
  - Update to 4.41
    - Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
    - Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)
    - Fix incr_parse single-quote string delimiter (GH#245)
    - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
      truncated input (GH#244)


author: Paul Howarth <paul@city-fan.org> - 4.42-1
changelog:
  - Update to 4.42
    - Ensure encode with a type spec hashref does not change the hashref argument
      (GH#240)
    - Fix -e docs: "written" → "read" (GH#239)
    - Fix Boolean eq overload matching undef (GH#207); Cpanel::JSON::XS::Boolean
      overloaded eq would match undef as equal to false because undef stringifies
      to "" - added defined() guard
    - Fix error messages showing overloaded stringification for blessed objects
      (GH#191); error messages now use ClassName=TYPE(addr) format, bypassing any
      "" overload
    - Fix type_all_string overriding allow_blessed/convert_blessed (GH#175); with
      type_all_string + allow_blessed, blessed objects are now encoded as null
      (not stringified as HASH address)
    - Fix infinite recursion when encode is called from a "" overload (GH#128);
      the recursion guard temporarily clears convert_blessed and allow_stringify
      flags on the JSON object before calling the overload, preventing re-entrant
      encode loops
    - Fix $obj->new creating a broken object (GH#93); when new() is called on an
      existing object (e.g. $json->new->new), the class name is now extracted
      from the object's stash rather than using the stringified reference
    - Change allow_nonref default to true (GH#241, matching JSON::PP and
      JSON::XS 4.0+ and the insecure RFC 7159); encode and decode now accept
      non-reference values by default; decode_json() with an explicit 0/1 second
      argument still works; allow_nonref(0) to disable scalars-only for secure
      JSON
    - Fix minor t/12_blessed.t typo
    - Fix GH#112: encode large whole-number NV values without .0 on 32-bit Perl
      (values exceeding UV_MAX that Perl stores as float)
    - Fix GH#197: prefer IOK over pNOK when encoding values where IV is accurate
      but NV is imprecise (SvNOK not set)


author: Paul Howarth <paul@city-fan.org> - 4.43-1
changelog:
  - Update to 4.43
    - Fix canonical sort: Compare by UTF-16 code units per RFC 8785 (GH#248)
    - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8
      decoding instead of checking SvUTF8 flag, since older Perls may store valid
      UTF-8 hash keys without the flag set
    - Fix quadmath encode dropping ".0" for large floats (GH #246)
      - The .0 guard condition that suppressed appending for NV values > UV_MAX
        was incorrect on high-precision FP (quadmath, 128-bit long double on
        arm64) where %g uses fixed-point notation for values like 1.01e30
      - Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g
        naturally uses %e for large values


author: Paul Howarth <paul@city-fan.org> - 4.44-1
changelog:
  - Update to 4.44
    - Fix canonical sort infinite loop (GH#252): malformed UTF-8 keys (e.g.
      Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's
      (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer: now
      checked as 0 or > remaining length


author: Paul Howarth <paul@city-fan.org> - 2:1.66-1
changelog:
  - Update to 1.66 (rhbz#2346459)
    - Require Specio 0.50
      - That release has a bug fix for validation of integer values
      - Without the fix, DateTime could accept non-integer values for things like
        nanoseconds (GH#145)


author: Paul Howarth <paul@city-fan.org> - 2:1.67-1
changelog:
  - Update to 1.67 (rhbz#2526041)
    - Documented that the 'truncate' method can throw a fatal error if the
      truncation produces a datetime that doesn't exist in the local time zone,
      which can happen when truncating to a day (or more) in a time zone with a
      DST transition at midnight (GH#155)
    - Documented that 'rfc3339' does not include nanoseconds (GH#150)
    - Fixed docs for 'strftime' to remove the bit that said it returned the same
      values as the POSIX 'strftime'; this hasn't been the case for a long time
      (GH#148)


author: Paul Howarth <paul@city-fan.org> - 1.6500-1
changelog:
  - Update to 1.65
    - Added EXCHANGE feature to Sinvestor.pm and some fixes (GH#481)
    - Added EXCHANGE feature to OnVista.pm (GH#480)
    - Added EXCHANGE feature to Consorsbank.pm and some fixes (GH#479)
    - Enabled usage count in Quote.pm
    - Removed DWS.pm
    - Improved check that dividend yield is a number in YahooJSON.pm by adding
      regex anchors
    - Added ssl_opts to user agent in Union.pm to account for bad certificate
      chain (GH#482)
    - Added ETFs search, more labels and EXCHANGE feature to Comdirect.pm (GH#478)
    - GoogleWeb: Add support for Hong Kong Exchange (GH#476)
    - YahooJSON: Adjust other currency fields when data is returned in GBp, ZAc,
      or ILA
    - Added labels wkn, ìsin, close, ask, bid, p_change, time to OnVista.pm
    - Modified OnVista.pm to enable search by ISIN and WKN and search for ETFs
    - Added methodinfo hash to Tradegate.pm (GH#465)
    - Added labels isin, open, ask, bid, time to Tradegate.pm (GH#465)
    - Fixed Tradegate.pm - Search for ETFs (GH#465)
    - Removed MorningstarAU (GH#405)
    - Fixed malformed character in YahooWeb.pm (GH#468)
    - Changed useragent in YahooJSON.pm (GH#467)
    - Added methodinfo hash to AEX.pm (GH#466)
    - Added labels exchange, close, time to AEX.pm (GH#466)
    - Fixed XETRA.pm (GH#460)
    - Added methodinfo hash to Fool.pm
    - Fixed MorningstarJP.pm (GH#443, GH#451)
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1.6600-1
changelog:
  - Update to 1.66
    - Modified CurrencyRates/CurrencyFreaks.pm to return from and to values
      instead of calculated rate
    - Removed Bloomberg.pm, Tiaacref.pm, Troweprice.pm
    - AlphaVantage: Return 'symbol not found' when no price data is returned
    - ASX: Changed error message when symbol isn't found (GH#497)
    - Added a new module to fetch the fund NAV from CMBChina (GH#494)
    - Added Cookie Jar to Comdirect user agent (GH#491)
    - Removed HU.pm, Oslobors.pm, and SEB.pm (GH#490)


author: Paul Howarth <paul@city-fan.org> - 1.6700-1
changelog:
  - Update to 1.67
    - Fixed ASEGR.pm; web site redesigned, URL used for data was no longer
      working (GH#509)
    - Fixed TesouroDireto.pm using Tesouro Transparente as data source (GH#527)
    - Added a new module to fetch data from SwissFundData (GH#515)
    - Handle no trade date in BorsaItaliana.pm (GH#528)
    - Added methodinfo() to MarketWatch.pm and BorsaItaliana.pm
    - Fixed MorningstarCH.pm
    - Fixed MorningstarUK.pm
  - Package new CONTRIBUTING.md file


author: Paul Howarth <paul@city-fan.org> - 1.6800-1
changelog:
  - Update to 1.68
    - Changes to AlphaVantage.pm and CurrencyRates/AlphaVantage.pm to throttle
      queries (GH#546)
    - YahooJSON.pm: Add additional fields/labels (GH#544)
    - New module USBonds.pm
    - MarketWatch.pm: Added headers to fix 401 code (GH#542)
    - Modified AEX.pm to return no data available if currency indicator is '%'
      (bonds return percentage of par/facevalue) (GH#539)
    - Fixed YahooWeb.pm (GH#533, GH#538)
    - Removed CMBChina.pm - no longer working (GH#534)
    - Rewrote Union.pm for URL that returns JSON (GH#516)
    - Modified parsing in BVB.pm (GH#513)


author: Paul Howarth <paul@city-fan.org> - 1.6900-1
changelog:
  - Update to 1.69
    - Sinvestor.pm: Trim whitespace before parsing date and price
    - XETRA.pm: Trim whitespace from date-time before extracting the actual date
      value (GH#557)
    - Modified Stooq.pm to send cookies
      - Stooq requires European visitors to their website to accept cookies
      - Cookies are set using JavaScript
      - Current version of module hard codes these cookies gleaned from a browser
        session
      - Added CurrencyRates/TwelveData.pm


author: Paul Howarth <paul@city-fan.org> - 1.7000-1
changelog:
  - Update to 1.70
    - New module Finnhub.pm: Fetches quotes from https://finnhub.io using a free
      personal-use API key
    - GoogleWeb.pm: Adapt to the redesigned Google Finance site
    - Tradegate.pm: Remove explicit "our $VERSION" assignment that collided with
      the dzil-injected version, producing a duplicate declaration and an
      "our variable $VERSION redeclared" warning; use a bare # VERSION
      marker like the other modules
    - Tradegate.pm: Trim whitespace before parsing date and time
    - Added CurrencyRates/Frankfurter
    - Removed AEX.pm: Euronext.com added JavaScript based anti-webscraping
    - Added CurrencyRates/UniRate.pm


author: Paul Howarth <paul@city-fan.org> - 1.7100-1
changelog:
  - Update to 1.71
    - NZX.pm: Fixed JSON mapping (GH#586)
    - IndiaMutual.pm: Update AMFI NAV file parsing to 8-column format with Plan
      and Option fields (GH#584)
    - Removed MorningstarCH.pm (GH#582)
    - Removed MorningstarUK.pm (GH#579)
    - IndiaMutual.pm: Add support for SIF quotes from AMFI (GH#580)
    - FTfunds.pm: Added useragent, cloned from BVB.pm (GH#577)


author: Paul Howarth <paul@city-fan.org> - 5.517-1
changelog:
  - Update to 5.517
    - Handle MIME parameters of the form param= better (i.e. a parameter with no
      value at all); it's treated the same as param="" rather than aborting the
      parse
    - Diagnose additional types of malformed MIME as ambiguous; specifically, an
      empty boundary parameter like boundary= or boundary="" is treated as
      ambiguous


author: Paul Howarth <paul@city-fan.org> - 5.518-1
changelog:
  - Update to 5.518
    - Add tests for encoded "boundary=XXX" parameters and set the ambiguous-parse
      flag if any are found
    - MIME::tools chooses to decode encoded boundary parameters, whilst MUA
      behaviors differ; Claws-Mail decodes them while Thunderbird does not
    - Don't ignore invalid whitespace after "boundary=XXX" parameter
    - Ignore comments between tokens; a header parameter can be written
      foo(comment)=bar and it's the same as foo=bar


author: Xavier Bachelot <xacier@bachelot.org> - 0.30-1
changelog:
  - Update to 0.30 (RHBZ#2335403)
    - fix CVE-2025-22376 (RHBZ#2335499,2335500,2335501)
  - Specify all dependencies


author: Paul Howarth <paul@city-fan.org> - 3:1.302219-1
changelog:
  - Update to 1.302219
    - Fix downstream test not to install Test2::Suite
    - Fix documentation mistakes


author: Paul Howarth <paul@city-fan.org> - 3:1.302220-1
changelog:
  - Update to 1.302220
    - Add [PruneCruft] to dist.ini so build artifacts (blib/, pm_to_blib,
      MYMETA.*) no longer leak into release tarballs
    - Remove Net::BitTorrent from broken list
    - Amend tests to adapt to more accurate line number reporting in core
      (GH#1080)


author: Paul Howarth <paul@city-fan.org> - 3:1.302222-1
changelog:
  - Update to 1.302222
    - Add missing Changes entry
    - Fix test that fails on some Windows versions due to path separators


author: Paul Howarth <paul@city-fan.org> - 3:1.302224-1
changelog:
  - Update to 1.302224
    - Fix a typo in an earlier Changes entry (GH#1083)
    - Update the author address to exodist7@gmail.com; mail to the old cpan.org
      address is no longer delivered
    - Ship AI_AND_LLM_POLICY.md, the contributor policy for AI and LLM generated
      code, covering human review, bot accounts in tickets and pull requests, and
      noting AI use
    - Stop shipping perltidyrc and repository-only markdown files
    - Ship the xt/ author and release tests so they run during release testing
    - Ship three test files that an unanchored MANIFEST.SKIP pattern had silently
      excluded from the distribution
    - Fix POD typos in Test2::API, Test2::Handle, Test2::V1,
      Test2::API::InterceptResult::Event, and Test2::Manual::Testing::Introduction
    - Quote the file name in the #line directive Test2::Handle generates, so tests
      pass when the build directory path contains spaces (GH#1088)
    - Fix further POD typos in Test2::V1 (GH#1054)
    - Derive the tested perl versions from the perl-versions action so CI keeps up
      to date (GH#1085)
    - Reject end() in an array, bag, or hash builder that uses all_items,
      all_keys, or all_values but specifies no items or fields; such a check can
      only match an empty structure (GH#1086)
    - Enforce end() in a bag that also uses all_items; extra items were ignored -
      this includes the implicit end() inside is(), so such bags now warn or fail
      where they silently passed (GH#1086)
    - Document that Test2::Plugin::BailOnFail and Test2::Plugin::DieOnFail cannot
      act on a failure inside a forked subtest until the owning process merges it
      (GH#1081)
    - Use Test2::V0 instead of the deprecated Test2::Bundle::Extended in the
      Test2::Tools::AsyncSubtest and Test2::Tools::Spec examples (GH#1079)
    - Fail a Test::More subtest whose code dies, reporting the exception inside
      it, instead of reporting the subtest as passing; the exception still
      propagates (GH#1075)
    - Return the number of assertions made from done_testing() in
      Test2::Tools::Basic and Test2::Tools::Tiny, so a test file ending in it is
      true to do() (GH#1073)
    - Allow the subtest tests to pass with Perl core's more accurate line-number
      reporting (GH#1090)


author: Paul Howarth <paul@city-fan.org> - 3:1.302225-1
changelog:
  - Update to 1.302225
    - Name the failing check when an IPC abort escapes a capture block in
      t/Test2/modules/IPC/Driver/Files.t; the bare "die 255" reported only its
      own line, and the message went to a captured STDERR that was then
      discarded, so smoke failures carried no diagnostic at all (GH#1091)


author: Paul Howarth <paul@city-fan.org> - 5.34-2
changelog:
  - Obsolete/Provide perl-URI-ws (rhbz#2411728, rhbz#2411834)
    URI::ws incorporated into URI dist at version 5.34


author: Paul Howarth <paul@city-fan.org> - 20260109-1
changelog:
  - Update to 20260109 (see CHANGES.md for details) (rhbz#2428067)
  - Change Pod::Html dependency to Pod::Simple::XHTML, which is now the preferred
    back-end option for HTML generation


author: Remi Collet <remi@remirepo.net> - 2.11.0-1
changelog:
  - update to 2.11.0
  - re-license spec file to CECILL-2.1
  - raise dependency on php-mock/php-mock-integration 3.0


author: Remi Collet <remi@remirepo.net> - 2.4.0-1
changelog:
  - update to 2.4.0
  - raise dependency on libmongoc 2.4.0 and libmongocrypt 1.20.0
  - run upstream test suite without server


author: Remi Collet <remi@remirepo.net> - 14.1.10-1
changelog:
  - update to 14.1.10
  - raise dependency on sebastian/environment 9.3.2
  - raise dependency on sebastian/lines-of-code 5.0.1


author: Remi Collet <remi@remirepo.net> - 14.3.0-2
changelog:
  - update to 14.3.0
  - raise dependency on sebastian/lines-of-code 5.0.2
  - avoid rpm command call using RPM_NIKIC_PHP_PARSER_VERSION from autoloader


author: Remi Collet <remi@remirepo.net> - 6.0.0-1
changelog:
  - update to 6.0.0
  - raise dependency on PHP 8.3
  - rename to php-phpunit-php-file-iterator6
  - move to /usr/share/php/SebastianBergmann/FileIterator6


author: Remi Collet <remi@remirepo.net> - 7.0.0-1
changelog:
  - update to 7.0.0
  - raise dependency on PHP 8.4
  - rename to php-phpunit-php-file-iterator7
  - move to /usr/share/php/SebastianBergmann/FileIterator7


author: Remi Collet <remi@remirepo.net> - 7.0.0-1
changelog:
  - update to 7.0.0
  - raise dependency on PHP 8.3
  - rename to php-sebastian-diff7
  - move to /usr/share/php/SebastianBergmann/Diff7


author: Remi Collet <remi@remirepo.net> - 8.0.0-1
changelog:
  - update to 8.0.0
  - raise dependency on PHP 8.4
  - rename to php-sebastian-diff8
  - move to /usr/share/php/SebastianBergmann/Diff8


author: Remi Collet <remi@remirepo.net> - 12.5.26-1
changelog:
  - update to 12.5.26
  - raise dependency on sebastian/cli-parser 4.2.1
  - raise dependency on sebastian/comparator 7.1.8
  - raise dependency on sebastian/environment 8.1.1
  - raise dependency on sebastian/exporter 7.0.3
  - raise dependency on sebastian/type 6.0.4


author: Remi Collet <remi@remirepo.net> - 12.5.29-1
changelog:
  - update to 12.5.29
  - raise dependency on phpunit/php-code-coverage 12.5.7
  - raise dependency on sebastian/global-state 8.0.2


author: Remi Collet <remi@remirepo.net> - 12.5.34-1
changelog:
  - update to 12.5.34
  - raise dependency on myclabs/deep-copy 1.14.0
  - raise dependency on phpunit/php-file-iterator 6.0.2
  - raise dependency on sebastian/diff 7.0.1


author: Remi Collet <remi@remirepo.net> - 13.2.4-2
changelog:
  - add upstream patch for sebastian/exporter 8.1.1 FTBFS #2504411
  - raise dependency on sebastian/exporter 8.1.1


author: Remi Collet <remi@remirepo.net> - 13.3.0-1
changelog:
  - update to 13.3.0
  - raise dependency on phpunit/php-code-coverage 14.3
  - raise dependency on sebastian/cli-parser 5.0.1
  - raise dependency on sebastian/comparator 8.4
  - raise dependency on sebastian/exporter 8.2.1
  - raise dependency on sebastian/recursion-context 8.0.1


author: Remi Collet <remi@remirepo.net> - 13.3.1-1
changelog:
  - update to 13.3.1
  - raise dependency on myclabs/deep-copy 1.14.0
  - raise dependency on phpunit/php-file-iterator 7.0.1
  - raise dependency on sebastian/object-enumerator 8.1.0
  - raise dependency on sebastian/type 7.0.2


author: Remi Collet <remi@remirepo.net> - 13.3.2-1
changelog:
  - update to 13.3.2
  - raise dependency on phpunit/php-code-coverage 14.3.1
  - raise dependency on phpunit/php-file-iterator 7.0.2


author: Lubomír Sedlář <lsedlar@redhat.com> - 4.13.0-1
changelog:
  - phase/kiwi, phase/image-builder: xorrisofs (cmdr)
  - phase/kiwi, phase/image-builder: iso fields (cmdr)
  - imagebuilder,kiwibuild: fix failable wildcard arch expansion (lsedlar)
  - Improve Koji task ID discovery and logging (awilliam)
  - phases/buildinstall: remove unused non-lorax paths (awilliam)
  - Correct ostree_installer phase name in log messages (awilliam)
  - phase/imagebuilder: failable arches fix (cmdr)
  - Move image sanity checks from test phase to image-generating phases (lsedlar)
  - Update phase diagram (lsedlar)
  - Remove OSBS and ImageContainer phases (awilliam)
  - Drop size check for ISOs (lsedlar)
  - Support list of URLs for rpm_repo_mapping (hlin)
  - docs: modernize Sphinx conf.py (hlin)
  - kiwi: also include subvariant in failure logging (awilliam)
  - kiwi: include image profile in global logs and watch-task filenames
    (awilliam)


author: Lubomír Sedlář <lsedlar@redhat.com> - 4.14.0-1
changelog:
  - Add support for building boot.iso via image-builder and kiwibuild (supakeen)
  - phase/imagebuilder: vhd-compressed mapping (cmdr)


author: Fabian Affolter <mail@fabian-affolter.ch> - 1.0.6-1
changelog:
  - Update to latest upstream release (closes rhbz#2338907)
  - Fix CVE-2025-24359 (closes rhbz#2341976)


author: Miro Hrončok <mhroncok@redhat.com> - 3.15.0~b2-5
changelog:
  - Restore compatibility with setuptools nspkg.pth files in site module
  - Fixes: rhbz#2486045
  - Fixes: rhbz#2486059
  - Fixes: rhbz#2487621
  - Fixes: rhbz#2488369


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.1.48-1
changelog:
  - Update to 3.1.48; closes RHBZ#2460480, fixes GHSA-rpm5-65cw-6hj4,
    fixes GHSA-x2qx-6953-8485, and fixes GHSA-7545-fcxq-7j24


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.1.55-1
changelog:
  - Update to 3.1.55: Fixes GHSA-2f96-g7mh-g2hx, GHSA-v396-v7q4-x2qj,
    GHSA-956x-8gvw-wg5v, GHSA-rwj8-pgh3-r573, GHSA-3rp5-jjmw-4wv2,
    GHSA-r9mr-m37c-5fr3, GHSA-fjr4-x663-mwxc, GHSA-6p8h-3wgx-97gf, and
    GHSA-94p4-4cq8-9g67


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.1.59-1
changelog:
  - Update to 3.1.59 (close RHBZ#2499503)
  - Fixes GHSA-5xxx-qhh7-9287, GHSA-3wxw-xv34-2frg, GHSA-8mcc-hrx5-hvxc,
    GHSA-284h-m62q-gf8w, GHSA-7833-fr7j-v32q, GHSA-hh9p-6wh2-4mfc,
    GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-wvpp-8hx9-p66j,
    GHSA-jm78-9fvv-mhgr, GHSA-hmq2-w58f-27jc, GHSA-3f7w-8rr8-f37f,
    GHSA-539m-9xh6-q6rr, and GHSA-p538-c434-8v24


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.1.60-1
changelog:
  - Update to 3.1.60; close RHBZ#2523750
  - Fixes GHSA-g5vv-9gxw-82hx, GHSA-whh4-5q6c-9v3x, and GHSA-239g-whfq-7xj9


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.0.0-1
changelog:
  - Update to 2.0.0 (close RHBZ#2527402)
  - An agent-detector command-line tool is added; this is backwards-
    compatible with 1.x releases.


author: Steve Traylen <steve.traylen@cern.ch> - 4.13.2-1
changelog:
  - Update to 4.13.2
  - New --with bootstrap flag for stestr dep
  - Use pyproject macros file list
  - Remove redundant pyproject-rpms-macro BR
  - Remove redundant seds from setup


author: Jos de Kloe <josdekloe@gmail.com> 2.45.0-1
changelog:
  - move to upstream release 2.45.0
   (skipped version 2.44.0 due to bug https://github.com/ecmwf/eccodes-python/issues/145)


author: Peter Bieringer <pb@bieringer.de>
changelog:
  - Add missing requirement InfCloud-fontware to InfCloud
  - Extend SELinux policy for access to /run/systemd/userdb/io.systemd.DynamicUser on start


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.02-1
changelog:
  - Update to 6.40.02
  - Rename the jupyroot and distrdf packages to reflect that they are
    now submodules of the main python package
  - New subpackages: root-graf3d-glad, root-net-curl,
    root-tmva-sofie-parser-python, root-tree-ml, root-histv7util
  - Dropped patches: 2
  - New patches: 7


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.02-5
changelog:
  - Use the system civetweb library since it now supports web sockets
  - Drop the davix module for Fedora 45+ (davix will soon be retired)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.04-1
changelog:
  - Update to 6.40.04
  - The root-roofit-jsoninterface package was merged with root-roofit-hs3
  - Fix calculation of kerning distances in generated PDF files
  - Dropped patches: 1
  - New patches: 2


author: Fedora Release Engineering <releng@fedoraproject.org> - 0.0.24-4
changelog:
  - Unretirement request:
    https://forge.fedoraproject.org/releng/tickets/issues/13278 Revert
    "Orphaned for 6+ weeks"


author: Dmitry Belyavskiy <beldmit@gmail.com> - 6.11.1-4
changelog:
  - Backport of upstream OpenSSL4 commit
    https://github.com/qt/qtbase/commit/e806630e694d89f567cffa9c982d1f471089ecd8


author: Jan Grulich <jgrulich@redhat.com> - 6.11.1-2
changelog:
  - Upstream backport:
    - QQmlTableInstanceModel: refactor QModelIndex calculation out
      of QQuickTableView


author: John Kacur <jkacur@redhat.com> - 3.11-1
changelog:
  - Upgrade to rteval-3.11
  - rteval: cyclictest: Improve handling of truncated histogram output
  - rteval: timerlat: Improve handling of truncated histogram output


author: Benjamin A. Beasley <code@musicinmybrain.net> - 4.0.1-1
changelog:
  - Update to 4.0.1 (close RHBZ#2272915)
  - Reduce the debuginfo level as a workaround for very slow test
    compilation.


author: Michel Lind <salimma@fedoraproject.org> - 0.10.0-1
changelog:
  - Update to version 0.10.0; Fixes RHBZ#2303607
  - No longer uses proc-macro-error; Fixes RHBZ#2329702


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.1.1-5
changelog:
  - Use upstreamed patch for avoiding icu crate in non-doc tests
  - Fix rust2rpm.toml compatibility with rust2rpm 28


author: Matthew Burket <mburket@redhat.com> - 0.1.78-1
changelog:
  - Update to latest upstream release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.78


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.13.0-4
changelog:
  - Rebuilt with rust-tar 0.4.45 for CVE-2026-33056
  - Restore binary package License expression, lost in a previous update


author: Zdenek Pytela <zpytela@redhat.com> - 45.8-1
changelog:
  - Include key_socket in socket_class_set
  - Remove 14 permissive domains
  - ci: Run cockpit-machines tests in PRs
  - Remove the lockdown class from the policy


author: Zdenek Pytela <zpytela@redhat.com> - 45.9-1
changelog:
  - Allow init_t nnp domain transition to postgresql_t
  - Move bootupd systemd interface to 2 optional blocks
  - Allow net_admin to the nfsd_t domain
  - Allow kernel write to unconfined and sysadm users' keys
  - Allow staff user ioctl cockpit-session stream sockets
  - Allow the staff user mount on tmpfs directories
  - Allow staff user the dac_override capability in the user namespace
  - Allow aide get attributes of all filesystems
  - Make insights_client_t accessible from the system cronjob
  - Support systemtap on a UEFI+SecureBoot system
  - Allow systemd-coredump signull spc container
  - Allow dhcpcd hook scripts read generic files in /proc


author: Zdenek Pytela <zpytela@redhat.com> - 45.10-1
changelog:
  - Changes adapting to bind packages with suffixes
  - Dontaudit unconfined_t map its private directories
  - Support cronie create crontab backups
  - Allow nfsidmapd read virt lib files
  - Allow sysadm_t run and read/write networkmanager bpf programs
  - Allow dhcpc_hook_t connect to init_t over a unix stream socket
  - Allow unconfined_t mounton its lnk_files
  - Allow wireguard read cgroup files
  - Label /usr/local/share/man with man_t
  - Allow pcscd get attributes of a pty filesystem
  - Allow geoclue read cgroup files


author: Zdenek Pytela <zpytela@redhat.com> - 45.11-1
changelog:
  - Allow ctdbd manage access to Samba PID directories
  - Allow rhsmcertd read selinux config and default file contexts
  - Allow staff_t and user_t execute udev without a domain transition
  - Allow mpd dbus chat with avahi
  - Allow init_t nnp domain transition to mpd_t
  - Update tuned-ppd policy
  - Update policy for virsh_ssh_t to help with live migration
  - Update sysadm policy for encrypted volumes usage
  - Allow bootupd read all passwd sources
  - Allow local login and sshd-session signull cockpit-session
  - Allow sysadm_t read/write kvm devices
  - Allow sysadm user run fail2ban-client
  - Add 2 interfaces helping to handle cloud-what cache files
  - Allow all domains to use inherited sshd-session pipes
  - Dontaudit tlp_t dac_override (bsc#1272935)
  - Use NetworkManager_t instead of networkmanager_t


author: Zdenek Pytela <zpytela@redhat.com> - 45.12-1
changelog:
  - Update qatlib policy
  - Allow rhsmcertd read the file_contexts files
  - rhsmcertd: allow bootc/ostree transient package persistence detection
  - Allow virtproxyd connect to systemd-homed over a unix stream socket
  - Allow system_mail_t read procmail home content
  - Label malware-detection-config.yml with insights_client_etc_rw_t
  - Add bcachefs as a SELinux capable filesystem
  - Allow unconfined_service_t nnp_transition to container_runtime_t
  - Add the files_write_system_conf_files() interface
  - Allow haveged (entropyd_t)  create and use its private tmpfs files


author: Zdenek Pytela <zpytela@redhat.com> - 45.13-1
changelog:
  - Allow namespace_init_t execute generic programs in bin directories
  - Update the ssh_server_template() template
  - Add rules for sshd vsock socket read/write
  - Allow dhcpc hook query the chronyd service
  - Allow insights-client read gconf home files
  - Allow login_userdomain mount, remount, unmount all mount points
  - Allow login_userdomain mount on all mount points
  - Revert "Allow userdomain get attributes of files on an nsfs filesystem"
  - Allow accountsd create and use its private tmpfs files
  - Add the anaconda_read_state_install() interface


author: Zdenek Pytela <zpytela@redhat.com> - 45.14-1
changelog:
  - Label malware-detection-config.yml with insights_client_etc_rw_t
  - Add the files_write_system_conf_files() interface
  - Allow bluez dbus api pass sockets over dbus
  - Support sandboxing features for sysadm_t
  - Update dhcpc-hook policy
  - Allow dhcpc hook query the chronyd service
  - Support gnome-remote-desktop's smartcard redirection support
  - Allow gnome-remote-desktop read sssd public files
  - Allow gnome-remote-desktop connect to unreserved ports
  - Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  - Label /run/audit with auditd_var_run_t
  - Allow auditd manage its private run dirs
  - Allow virtqemud relabelfrom its private fifo files
  - Update the ssh_server_template() template
  - Add rules for sshd vsock socket read/write
  - Allow sshd-auth/sshd-session get attributes of their sshd parent
  - Allow qatlib manage hugetlbfs directories
  - Allow sanlock the sys_admin capability
  - Allow lsmd-plugin use libStorageMgmt to provision storage
  - Allow insights-client read gconf home files
  - rhsmcertd: allow bootc/ostree transient package persistence detection
  - Allow rhsmcertd read the file_contexts files
  - Allow rhsmcertd read selinux config and default file contexts
  - Use NetworkManager_t instead of networkmanager_t


author: Zdenek Pytela <zpytela@redhat.com> - 45.15-1
changelog:
  - Fix NFS mount with xprtsec=tls / xprtsec=mtls (bsc#1275783)
  - Allow ssh_agent_type manage ssh_home_t files and sock_files
  - Allow sshd-session manage ssh_home_t socke files
  - Allow sshd-session X11 forwarding
  - Allow lsmd-plugin read udev pid files
  - Allow virtstoraged domain transition on iscsiadm execution
  - Revert "Allow virtqemud domain transition on iscsiadm execution"
  - Allow rhsmcertd search gconf home data dirs
  - Allow rhsmcertd read gconf home files
  - Revert "Allow rhsmcertd read gconf home files"


author: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com> - 261.2-1
changelog:
  - Version 261.2
  - a bugfix release with correctness and security-relevant fixes too. 276
    patches, so too much to describe here.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com> - 262~rc1-1
changelog:
  - Version 262~rc1
  - See https://raw.githubusercontent.com/systemd/systemd/v262-rc1/NEWS. Too
    many changes to list or discuss here.


author: Jakub Kadlčík <frostyx@email.cz>
changelog:
  - Defer submodule detection to git
  - Many improvements to tests and they now run during package build
  - New config option `buildconfig.test_version_suffix`


author: Jakub Kadlcik <frostyx@email.cz> 0.6.28-1
changelog:
  - Add dependency on packaging (frostyx@email.cz)
  - Avoid using setuptools for version checking (pavel@raiskup.cz)
  - Fix version checking with setuptools 82 (frostyx@email.cz)
  - index.md: Update EPEL link (osalbahr@gmail.com)
  - Don't run tests for python3.7 (frostyx@email.cz)
  - depend on git-core instead of git (msuchy@redhat.com)


author: Tom Callaway <spot@fedoraproject.org> - 2.1.0-1
changelog:
  - update to 2.1.0
  - update the bundled copy of libpng to 1.6.53
  - update the bundled copy of libtiff to 4.7.1
  - build for tcl/tk 9


author: Tom Callaway <spot@fedoraproject.org> - 2.1.1-1
changelog:
  - update to 2.1.1
  - bump libtiff to 4.7.2 (the tkimg libtiff library glue still versions at 4.7.1, because I didn't want to break compat when/if upstream makes a similar change)


author: Remi Collet <remi@remirepo.net> - 9.1.1-1
changelog:
  - Valkey 9.1.1 - Released Tue 21 July 2026
  - Upgrade urgency SECURITY: This release includes security fixes
    CVE-2026-56684 CVE-2026-63639
  - own /etc/logrotate.d as its owner is an optional dependency
  - refresh the documentation
  - drop OpenSSL 4 patch merged upstream


author: Remi Collet <remi@remirepo.net> - 9.1.2-1
changelog:
  - Valkey 9.1.2 - Released Mon 31 August 2026
  - Upgrade urgency SECURITY: This release includes security fixes


author: Martin Gansser <martinkg@fedoraproject.org> - 0.9.0-0.1.beta1
changelog:
  - Update to 0.9.0-0.1.beta1
  - Add python3dist(setuptools-gettext)
  - Fixed icon installation
  - Fixed desktop validation
  - Fixed setuptools discovery warnings


author: Michel Lind <salimma@centosproject.org> - 0.4-1
changelog:
  - Update to version 0.4
  - Apply temporary blazesym workaround to swallow /proc/kcore EPERM when
    querying KASLR


author: Michel Lind <salimma@centosproject.org> - 0.5-1
changelog:
  - Update to version 0.5
  - Apply build flags consistently
  - Update licenses to account for bundled dependencies


author: Michel Lind <salimma@centosproject.org> - 0.5-2
changelog:
  - fix to show SHA commit in help text
  - also ensure `make install` uses the right build flags
  - include all bundled projects' licenses


author: Michel Lind <salimma@fedoraproject.org> - 0.5-3
changelog:
  - Drop rust_arches; no longer needed. But limit builds to the architectures
    strobelight-libs supports


author: Michel Lind <salimma@fedoraproject.org> - 0.8.0-1
changelog:
  - Update to 0.8.0 upstream release
  - Resolves: rhbz#2443508
  - Re-enable debuginfo generation
  - Enable Packit
  - Verified the SPDX license conversion


