# changelog

author: Paul Howarth <paul@city-fan.org> - 1.6.12-1
changelog:
  - Update to 1.6.12
    - Populate metro and area code when performing lookups in IPv6 City
      databases; previously this was only done when using IPv4 City
      databases


author: Paul Howarth <paul@city-fan.org> - 2018.06-1
changelog:
  - IPv6 databases are still seeing updates in June 2018
  - IPv4 databases are unchanged from previous release


author: Peter Robinson <pbrobinson@fedoraproject.org> - 1.3.45-1
changelog:
  - Update to 1.3.45
  - Enable JPEG XL and HEIF support
  - Drop EOL releases and ancient obsoletes
  - Minor spec modifications


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-43.1
changelog:
  - ALTPHP-1896: Update to 7.1.1-43
  - ALTPHP-1920: Update libwebp to 1.5.0
  - ALTPHP-1932: Fix perfomance issues


author: Robert-André Mauchin <zebob.m@gmail.com> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Close: rhbz#1954337
  - Security fix for CVE-2021-30473
  - Fix: rhbz#1961375
  - Fix: rhbz#1961376
  - Security fix for CVE-2021-30475
  - Fix: rhbz#1968017
  - Fix: rhbz#1968018


author: Ali Rustamov <arustamov@cloudlinux.com> - 1.0.0-5
changelog:
  - postinst: derive apt architecture from `dpkg --print-architecture`
    instead of `uname -m`, which emitted the non-Debian token "aarch64"
    (Debian/apt use "arm64"); the generated alt-common-els.list is now
    correct on arm64


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.0.0-6
changelog:
  - Ship alt-common-els-rollout.repo with the els-alt-1..6 gradual-rollout slots
    (enabled) and their -bypass counterparts (disabled), so the ALT slot
    rollout reaches clients gradually instead of only at graduation to stable
  - postinst: write /etc/apt/sources.list.d/alt-common-els-rollout.list with the
    els-alt-1..6 gradual-rollout slots on rollout.alt.tuxcare.com (active) and
    their slot-N-bypass counterparts (commented out); the rollout host has no
    channel segment and takes no credentials, so no /etc/apt/auth.conf.d entry
    is added. postrm removes the file. (ELS-2641)
  - %post now pins $releasever in alt-common-els.repo too, not just the rollout
    file: the Amazon Linux 2 branch only covered the stable repo on AL2, so a
    plain el7 host reporting 7Server or 7.9 still asked for el/7Server/ (ELS-2334)


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.11.0-2
changelog:
  - don't add link to ldap in *.pc file if ldap.pc doesn't exist
  - don't add link to mit-krb5-gssapi in *.pc file if mit-krb5-gssapi.pc.pc doesn't exist


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.19.0-2
changelog:
  - ALTPHP-2119: patch to allow building alt-curlssl11 with OpenSSL 1.1
    (curl 8.19.0 dropped OpenSSL < 3.0 support upstream)
  - Fix OPENSSL_VERSION_STRING -> OPENSSL_VERSION for OpenSSL 1.1 compat
  - Fix doc file references: FAQ -> FAQ.md, TODO -> TODO.md, KNOWN_BUGS -> KNOWN_BUGS.md
  - Disable flaky tests 763, 1501, 1583


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 8.19.0-3
changelog:
  - ALTPHP-2106: pin alt-nghttp2 runtime requirement to the version we built
    against, to avoid undefined-symbol errors when an older alt-nghttp2 is
    installed alongside a freshly built alt-curlssl11


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.19.0-4
changelog:
  - Restore short "OpenSSL/1.1.1w" SSL version string (drop the duplicated
    "OpenSSL " prefix and trailing release date introduced when working
    around OPENSSL_VERSION_STRING for alt-openssl11)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.1.28-1
changelog:
  - Update to 2.1.28 to match system cyrus-sasl on EL10 (fixes
    "ldap_int_sasl_init: SASL library version mismatch: expected 2.1.28,
    got 2.1.27" when system libldap loads alt libsasl2 via php RPATH)
  - Drop cyrus-sasl-pr559-RC4-openssl.patch (merged upstream in 2.1.28)
  - Add rpath to own libdir so sbin tools find the bundled libsasl2
    without the system cyrus-sasl-lib package installed
  - Drop cyrus-sasl-2.1.23-man.patch (testsaslauthd.8 man page is shipped
    upstream in 2.1.28; applying the patch would duplicate its content)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 57.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow): not applied
    for v57 yet (see TODO.md)
  - Drop SOURCE100/101 dep filters, use alt_default_filter
  - Drop downstream ".cloudlinux.1" release suffix; align Release with
    other ICU lines


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 65.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Run %check as two top-level make calls (source/test + xcheck-local)
    to dodge ICU's broken nested-make jobserver pattern; tests now run
    strictly without "||:"


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 71.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Release bumped to align with other ICU lines


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.11.1-4
changelog:
  - ALTPHP-2484: Fix CVE-2026-55200 (transport.c OOB write), CVE-2026-55199
    (EXT_INFO handler DoS), CVE-2025-15661 (sftp_symlink OOB read)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.0.2u-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free)
  - Guard -Wno-error=incompatible-pointer-types/-implicit-function-declaration
    to gcc >= 6 (rhel >= 8) so the build no longer fails on CL7 gcc 4.8.5


author: Areg Gasparyan <agasparyan@cloudlinux.com> - 1:1.1.1w-3
changelog:
  - CVE-2025-68160: fix heap buffer overflow in BIO_f_linebuffer when next BIO
    performs short writes
  - CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes
    unauthenticated/unencrypted by advancing pointers after stream processing
  - CVE-2025-69419: fix out-of-bounds write in OPENSSL_uni2utf8 and do_buf
    by checking return code of UTF8_putc/bmp_to_utf8
  - CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
    for signing certificate attributes
  - CVE-2025-69421: fix NULL pointer dereference in PKCS12_item_decrypt_d2i
    by adding NULL check for oct parameter
  - CVE-2026-22795: fix ASN1_TYPE validation in PKCS12 parsing (p12_kiss.c)
    and s_client.c before accessing union members
  - CVE-2026-22796: fix ASN1_TYPE type confusion in PKCS7_digest_from_attributes
    by validating type before accessing as OCTET_STRING


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.2
changelog:
  - CVE-2023-5678: fix excessive time in DH check/generation with large Q
    parameter by adding bounds checks in DH_check_pub_key and DH_generate_key
  - CVE-2024-0727: fix PKCS12 decoding NULL pointer dereference by adding NULL
    checks where ContentInfo data can be NULL


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.3
changelog:
  - CVE-2026-28387: fix use-after-free in DANE client code by using X509_free()
    instead of OPENSSL_free() to properly release reference-counted X509 objects
  - CVE-2026-28388: fix NULL pointer dereference when processing a delta CRL
    that has a Delta CRL Indicator but lacks a CRL Number extension
  - CVE-2026-28389: fix NULL pointer dereference in CMS KeyAgreeRecipientInfo
    processing when KeyEncryptionAlgorithmIdentifier omits the optional
    parameter field, by using safe X509_ALGOR_get0() extraction
  - CVE-2026-28390: fix NULL pointer dereference in CMS KeyTransportRecipientInfo
    processing when RSA-OAEP SourceFunc parameters are missing, by using safe
    X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.4
changelog:
  - CVE-2026-45447: fix use-after-free in PKCS7_verify triggered by a crafted
    PKCS#7 / S-MIME message with an empty digestAlgorithms ASN.1 SET, which made
    OpenSSL free a caller-owned BIO; free the BIO chain explicitly and stop at
    the caller-supplied indata BIO


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.1.1w-3.5
changelog:
  - HollowByte: grow the handshake init_buf incrementally as data is received
    instead of pre-allocating the full peer-declared message size, so a peer
    that claims a large message but never sends it can no longer strand memory
    (ELS-2635). Backport of OpenSSL 3.0 commit c5785a5e35 (PR #30794); handled
    by OpenSSL as a "bug or hardening" fix with no CVE assigned


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-54
changelog:
  - ALTPHP-1582: add support cl-MariaDB1011
  - ALTPHP-1626: return mysqli.so for alt-php >= 82
  - ALTPHP-1637: rebuild with system python from BaseOS repo


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-63
changelog:
  - do not create symlinks to mysqli on plesk
  - hardcode x86_64-linux-gnu to lib path in alt-php-mysql-reconfigure
    script


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-64
changelog:
  - for plesk panel create symlinks:
      mysqli.so -> nd_mysqli.so
      pdo_mysql.so -> nd_pdo_mysql.so
  - for plesk panel do not create any symlinks for ini configs


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-65
changelog:
  - ALTPHP-2180: Fixed processing mysql.so (for PHP 5x) in Plesk environment
  - ALTPHP-2180: Call alt-php-mysql-reconfigure in Plesk environment wthout installed bindings


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1-70
changelog:
  - ALTPHP-2242: Add --driver native|binding switch to reconfigure: toggles the
    active mysql driver (native nd_mysqli/nd_pdo_mysql vs client-lib bindings)
    per alt-php version. Bindings stay managed for all versions.
  - ALTPHP-2242: Fix MariaDB 11.x binding-name mapping (11.8 -> mariadb118, not
    mariadb1108) so switching to --driver binding works on Debian 13 / MariaDB
    11.x systems.


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1-3.2
changelog:
  - LVEMAN-1748: Move linksafe group creation to %pre
  - LU-2436: Remove cllib dependency from cloudlinux-linksafe


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.3.0-1
changelog:
  - Update to 3.3.0 (close RHBZ#1684966)
  - Drop obsolete ldconfig_scriptlets macro
  - Drop and Obsolete the static library (-static subpackage)
  - Properly mark the LICENSE file
  - Update License to SPDX


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.1.0-0
changelog:
  - Update package scripts for repo.alt.tuxcare.com
  - Clean install scripts for fresh installations from repo.alt.tuxcare.com


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.1.0-4
changelog:
  - Pin $releasever to the EL major version in the repo file to avoid HTTP 404
    on point-release hosts where $releasever resolves to e.g. 7.9


author: Robert-André Mauchin <zebob.m@gmail.com> - 1.2.0-2
changelog:
  - Fix s390x tests and RISCV build
  - Introduces a patch that fix tests on BigEndian
  - Introduces a patch that disable RVV runtime dispatch for RISCV builds


author: Dominik Mierzejewski <dominik@greysector.net> - 1.16.2-2
changelog:
  - Enable uncompressed codec (rhbz#2237849)
  - Run tests conditionally (requires making all symbols visible)
  - Disable HEVC tests when building without HEVC codec


author: Dominik Mierzejewski <dominik@greysector.net> - 1.17.5-2
changelog:
  - Update to 1.17.5 (rhbz#2244583)
  - Backport fixes for: CVE-2023-49460 (rhbz#2253575, rhbz#2253576)
                        CVE-2023-49462 (rhbz#2253567, rhbz#2253568)
                        CVE-2023-49463 (rhbz#2253565, rhbz#2253566)
                        CVE-2023-49464 (rhbz#2253562, rhbz#2253563)
  - Simplify conditionals for rav1e and svt-av1 encoders
  - Enable JPEG2000 and dav1d decoders/encoders


author: Paul Howarth <paul@city-fan.org> - 1.11.1-1
changelog:
  - Update to 1.11.1 (rhbz#2319104)
    - This is an enhancement and bugfix release - see RELEASE_NOTES for details
    - Note also that various algorithms are now deprecated and not built by
      default, which affects this package


author: Paul Howarth <paul@city-fan.org> - 1.11.1-6
changelog:
  - Fix CVE-2026-7598: integer overflow via large username or password arguments
    (https://github.com/libssh2/libssh2/pull/1858)


author: Tom Callaway <spot@fedoraproject.org> - 1.7.0-0.1.rc2
changelog:
  - update to 1.7.0-rc2
  - disable tests on s390x (reported upstream: https://github.com/libunwind/libunwind/issues/464)


author: Benjamin Gilbert <bgilbert@backtick.net> - 4.0.0-1
changelog:
  - New release
  - Add developer documentation to -devel subpackage
  - Use correct SPDX license identifier
  - Update project URL to HTTPS


author: Fedora Release Engineering <releng@fedoraproject.org> - 16.02-28
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
  - Fix the build by moving desktop files from kde4/services/ServiceMenus/ to kservices5


author: Ondrej Pohorelsky <opohorel@redhat.com> - 3.7.14-1
changelog:
  - 3.7.14 bump
  - Adds upstream patch to prevent double free
  - Require python3-setuptools unconditionaly
  - Resolves: rhbz#2170818, rhbz#2166136


author: Björn Esser <besser82@fedoraproject.org> - 2.3.0-5
changelog:
  - Add tools package
  - Add explicit perl BRs
  - Add example program to doc package
  - Drop google site-verification file from doc package
  - Require main package in doc package to avoid file conflicts


