# changelog

author: Than Ngo <than@redhat.com> - 139.0.20^chromium139.0.7258.66-1
changelog:
  - Updated to 139.0.7258.66
  - Asahi Lina: Update to cef-139.0.20+g60bd77d
  - * CVE-2025-8576: Use after free in Extensions
  - * CVE-2025-8578: Use after free in Cast
  - * CVE-2025-8579: Inappropriate implementation in Gemini Live in Chrome
  - * CVE-2025-8580: Inappropriate implementation in Filesystems
  - * CVE-2025-8581: Inappropriate implementation in Extensions
  - * CVE-2025-8582: Insufficient validation of untrusted input in DOM
  - * CVE-2025-8583: Inappropriate implementation in Permissions


author: Than Ngo <than@redhat.com> - 139.0.20^chromium139.0.7258.127-1
changelog:
  - Updated to 139.0.7258.127 (rhbz#2381869)
  - * CVE-2025-8879: Heap buffer overflow in libaom
  - * CVE-2025-8880: Race in V8
  - * CVE-2025-8901: Out of bounds write in ANGLE
  - * CVE-2025-8881: Inappropriate implementation in File Picker
  - * CVE-2025-8882: Use after free in Aura


author: Than Ngo <than@redhat.com> - 140.1.15^chromium140.0.7339.80-1
changelog:
  - Update to 140.0.7339.80 (rhbz#2396308)
  - * Update to cef-140.1.15+gfaef09b (rhbz#2380429) (Asahi Lina)
  - * CVE-2025-9864: Use after free in V8
  - * CVE-2025-9865: Inappropriate implementation in Toolbar
  - * CVE-2025-9866: Inappropriate implementation in Extensions
  - * CVE-2025-9867: Inappropriate implementation in Downloads


author: Than Ngo <than@redhat.com> - 140.1.15^chromium140.0.7339.127-1
changelog:
  - Update to 140.0.7339.127
  - * CVE-2025-10200: Use after free in Serviceworker
  - * CVE-2025-10201: Inappropriate implementation in Mojo


author: Than Ngo <than@redhat.com> - 140.1.15^chromium140.0.7339.185-1
changelog:
  - Update to 140.0.7339.185
  - * CVE-2025-10585: Type Confusion in V8
  - * CVE-2025-10500: Use after free in Dawn
  - * CVE-2025-10501: Use after free in WebRTC
  - * CVE-2025-10502: Heap buffer overflow in ANGLE
  - * Fix rendering issue on epel9


author: Than Ngo <than@redhat.com> - 140.1.15^chromium140.0.7339.207-1
changelog:
  - Update to 140.0.7339.207
  - * CVE-2025-10890: Side-channel information leakage in V8
  - * CVE-2025-10891: Integer overflow in V8
  - * CVE-2025-10892: Integer overflow in V8


author: Richard W.M. Jones <rjones@redhat.com> - 0.79.20-3
changelog:
  - Rebuild for Jansson 2.14
    (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/)


author: Packit <hello@packit.dev> - 339-1
changelog:
  - Add cockpit/ws arm64 container
  - Storage: Disk Self-Test error warnings on the overview page
  - Bug fixes and translation updates


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.31.13-1
changelog:
  - Update to release v1.31.13
  - Resolves: rhbz#2333357, rhbz#2398406, rhbz#2398661, rhbz#2399063,
    rhbz#2399337
  - Upstream fix


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.32.9-1
changelog:
  - Update to release 1.32.9
  - Resolves: rhbz#2333357, rhbz#2398407, rhbz#2398662, rhbz#2399064,
    rhbz#2399338
  - Upstream fix


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.33.5-1
changelog:
  - Update to release v1.33.5
  - Resolves: rhbz#2333357, rhbz#2375096, rhbz#2398408, rhbz#2398663,
    rhbz#2399065, rhbz#2399339
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.34.1-1
changelog:
  - Update to release v1.34.1
  - Resolves: rhbz#2333357, rhbz#2398409, rhbz#2398664, rhbz#2399066,
    rhbz#2399340
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.25.0-1
changelog:
  - Update to release v0.25.0
  - Resolves: rhbz#2399354, rhbz#2399081, rhbz#2398678, rhbz#2398424
  - Upstream feature additions and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.26.1-1
changelog:
  - Update to release v0.26.1
  - Resolves: rhbz#2382656
  - Upstream fix
  - Includes temporary nodwarf5 flag for go


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.27.0-1
changelog:
  - Update to release v0.27.0
  - Resolves: rhvz#2388453, rhbz#2384137, rhbz#2384154
  - Upstream new features and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.29.0-1
changelog:
  - Update to release v0.29.0
  - Resolves: rhbz#2397747, rhbz#2398425, rhbz#2398679, rhbz#2399082,
    rhbz#2399355
  - Upstream new features and fixes


author: Dogtag PKI Team <devel@lists.dogtagpki.org> - 11.6.0-0.1.alpha1
changelog:
  * Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 11.5.0-3.2
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild


author: Sandipan Roy <sandipan@redhat.com> - 2.1.0-1
changelog:
  - Update to version 2.1.0
  - Update to 2.1.0 - Closes rhbz#2061180 rhbz#2352162
  - Implement vendoring approach using go2rpm with vendor archive
  - Add all Go dependencies bundled for offline builds in mock/koji
  - Use rpmautospec for automatic release and changelog management
  - Re-enable tests with selective skipping for TestToCSV failure only
  - Update license to include all vendored dependency licenses: Apache-2.0
    AND BSD-2-Clause AND BSD-3-Clause AND MIT
  - Preserve complete historical changelog from package inception


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.12.2-9
changelog:
  - Do not pass OAuth2 client secret for public clients (freeipa#9734)
  - Fix upgrade for two-way trust to Active Directory (freeipa#9471 post-fix)
  - Allow extending certmonger request timeouts to accomodate for slow HSMs (freeipa#9725)


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.12.2-14
changelog:
  - CVE-2025-4404
  - Include encrypted DNS support subpackages
  - various fixes from ipa-4-12 branch upstream


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.16.5-0]
changelog:
  - cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume (Mario Limonciello (AMD))
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes)
  - Linux v6.16.5


author: Augusto Caringi <acaringi@redhat.com> [6.16.6-0]
changelog:
  - Add another bug fix staged for 6.16 (Justin M. Forbes)
  - Turn on PHY_ROCKCHIP_SAMSUNG_DCPHY for Fedora (Justin M. Forbes)
  - Linux v6.16.6


author: Toke Høiland-Jørgensen <toke@redhat.com> 1.4.3-1
changelog:
  - Upstream version bump
  - Move kernel-headers dependency to a build requirement, not a runtime dependency


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 7.0.0-3
changelog:
  - Update the VOMS attribute certificate signing hash algorithm
  - Re-enable the VOMSUtilTest on Fedora 43 (after above fix)
  - Fix unowned directory /etc/arc.conf.d


author: Packit <hello@packit.dev> - 138-1
changelog:
  Changes with 138
  ----------------
    * GH Action: check the SPEC osbuild/images deps minimum version (#4669)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger
    * client/blueprints_test.go: delete condition for composer version < 83 (#4673)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2025-04-16


author: Packit <hello@packit.dev> - 141-1
changelog:
  Changes with 141
  ----------------
    * Add templates to subscription image options (HMS-6050) (#4712)
      * Author: rverdile, Reviewers: Achilleas Koutsou, Tomáš Hozza
    * Replace logrus with log (#4715)
      * Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Simon de Vlieger
    * Test/cross-distro: add version check for cross-building el8 on el9 (#4706)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Brian C. Lane
    * Test/cross-distro: fix one issue and make the test more robust on "ZStream" branches (#4694)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    * cloudapi: Fix missing specs for koji ContainerResolve (#4709)
      * Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    * cloudapi: drop ImageRequest.GetImageOptions() method (#4711)
      * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Sanne Raymaekers
    * go.mod: bump images to v0.144.0 (#4718)
      * Author: Sanne Raymaekers, Reviewers: Florian Schüller, Lukáš Zapletal, Simon de Vlieger
    * go.mod: update osbuild/images to v0.143.0 (#4713)
      * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Sanne Raymaekers
    * internal: drop `internal/fsnode` package (#4714)
      * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2025-05-14


author: Packit <hello@packit.dev> - 142-1
changelog:
  Changes with 142
  ----------------
    * Update snapshots to 20250515 (#4724)
      * Author: SchutzBot, Reviewers: Simon de Vlieger, Tomáš Hozza
    * templates/packer: set wanted-by to cloud-init.target (#4723)
      * Author: Sanne Raymaekers, Reviewers: Gianluca Zuccarelli, Lukáš Zapletal, Ondřej Budai

  — Somewhere on the Internet, 2025-05-28


author: Packit <hello@packit.dev> - 143-1
changelog:
  Changes with 143
  ----------------
    * Add job delete support (#4717)
      * Author: Brian C. Lane, Reviewers: Tomáš Hozza
    * GH Action/create-tag: allow passing the version when run manually (#4668)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger
    * Improve OCI CI scripts (HMS-8591) (#4742)
      * Author: Florian Schüller, Reviewers: Achilleas Koutsou, Brian C. Lane, Lukáš Zapletal
    * Packer: update Fedora and RHEL images used for workers (#4733)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Gianluca Zuccarelli
    * gitlab: enable OCI tests (#4741)
      * Author: Achilleas Koutsou, Reviewers: Florian Schüller, Simon de Vlieger, Tomáš Hozza
    * go.mod: update osbuild/images to v0.148.0 (#4732)
      * Author: Achilleas Koutsou, Reviewers: Tomáš Hozza, Tomáš Koscielniak
    * osbuild-store-dump: use `distrofactory` instead of importing fedora (#4738)
      * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Tomáš Hozza
    * tests/CI: Add runners for RHEL 9.7 and 10.1 (HMS-6278) (#4716)
      * Author: Tomáš Koscielniak, Reviewers: Achilleas Koutsou, Tomáš Hozza

  — Somewhere on the Internet, 2025-06-11


author: Packit <hello@packit.dev> - 145-1
changelog:
  Changes with 145
  ----------------
    * Test/repositories/el8*: use rhui-4 instead of rhui-3 (#4665)
      * Author: Tomáš Hozza, Reviewers: Gianluca Zuccarelli, Michael Vogt
    * Update snapshots to 20250626 (#4763)
      * Author: SchutzBot, Reviewers: Brian C. Lane, Tomáš Hozza
    * ci: introduce gobump gha (#4758)
      * Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    * cloudapi/v2: add patch_url to customizations (#4756)
      * Author: rverdile, Reviewers: Brian C. Lane, Tomáš Hozza
    * common: fix unclosed logrus logging pipes (#4728)
      * Author: Lukáš Zapletal, Reviewers: Brian C. Lane, Simon de Vlieger, Tomáš Hozza
    * fix: update gobump GHA (#4761)
      * Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Sanne Raymaekers

  — Somewhere on the Internet, 2025-07-09


author: Packit <hello@packit.dev> - 146-1
changelog:
  Changes with 146
  ----------------
    *  go.mod: bump go version to 1.23.9 & update dependencies (#4760)
      * Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Tomáš Hozza
    * Preparation to consolidate Koji upload code to `osbuild/images` (HMS-8803) (#4770)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Gianluca Zuccarelli
    * Use Koji upload implementation from `osbuild/images` (HMS-8803) (#4772)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    * cloudapi: Use error 400 for cloudapi delete errors (#4750)
      * Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    * deps: bump images to 0.164 (#4781)
      * Author: Simon de Vlieger, Reviewers: Ondřej Budai, Tomáš Hozza
    * go.mod: update osbuild/images to v0.156.0 (#4773)
      * Author: Achilleas Koutsou, Reviewers: Ondřej Budai, Sanne Raymaekers
    * test/ubi-wsl.sh: add backward compatibility for composer < v146 (#4784)
      * Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Tomáš Koscielniak
    * tests/CI: Add RHEL 9.6 and 10.0 GA (HMS-8726) (#4767)
      * Author: Tomáš Koscielniak, Reviewers: Florian Schüller, Sanne Raymaekers

  — Somewhere on the Internet, 2025-07-23


author: Packit <hello@packit.dev> - 147-1
changelog:
  Changes with 147
  ----------------
    * GH: remove the PR template (#4787)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Michael Vogt, Simon de Vlieger
    * Update snapshots to 20250730 (#4800)
      * Author: SchutzBot, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    * chore: bump dependencies via gobump (#4803)
      * Author: SchutzBot, Reviewers: Simon de Vlieger, Tomáš Hozza
    * cloudapi: new image type: azure-sapapps-rhui [HMS-8738] (#4790)
      * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Tomáš Hozza
    * cloudapi: use distrofactory to get rhel-9.3 (#4789)
      * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Tomáš Hozza
    * deps: update sentry dependency (#4771)
      * Author: Lukáš Zapletal, Reviewers: Simon de Vlieger, Tomáš Hozza
    * go.mod: update osbuild/images to v0.168.0 (#4799)
      * Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Simon de Vlieger
    * jobqueue: handle escaped null bytes in postgres (HMS-8885) (#4779)
      * Author: Sanne Raymaekers, Reviewers: Lukáš Zapletal, Simon de Vlieger
    * many: fix various linter warnings (#4792)
      * Author: Lukáš Zapletal, Reviewers: Michael Vogt, Simon de Vlieger
    * many: switch to osbuild/images/pkg/upload for azure (HMS-8940) (#4798)
      * Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon de Vlieger, Tomáš Hozza
    * schutzbot/update_github_status.sh: fix GA pipeline status reporting (#4786)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    * templates/packer: avoid errors in worker-executor startup (#4788)
      * Author: Florian Schüller, Reviewers: Sanne Raymaekers, Tomáš Hozza
    * test/repositories: use CDN repos for 9.5, 9.6 and 10.0 (#4783)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Tomáš Koscielniak
    * workflows: use correct token for gobump (#4795)
      * Author: Lukáš Zapletal, Reviewers: Sanne Raymaekers, Simon de Vlieger

  — Somewhere on the Internet, 2025-08-06


author: Packit <hello@packit.dev> - 150-1
changelog:
  Changes with 150
  ----------------
    - Test/regression-old-worker-new-composer: make the test case more robust (#4839)
      - Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Sanne Raymaekers
    - Update snapshots to 20250825 (#4840)
      - Author: SchutzBot, Reviewers: Sanne Raymaekers, Tomáš Hozza
    - test/cases/rhel-upgrade: increase virt-install memory (#4843)
      - Author: Sanne Raymaekers, Reviewers: Michael Vogt, Simon de Vlieger

  — Somewhere on the Internet, 2025-09-03


author: Packit <hello@packit.dev> - 151-1
changelog:
  Changes with 151
  ----------------
    - Bump distro aliased for RHEL 9 and 10 (HMS-9174) (#4854)
      - Author: Tomáš Hozza, Reviewers: Gianluca Zuccarelli, Lukáš Zapletal, Sanne Raymaekers
    - Dockerfile-ubi-packer: do not use quay.io/app-sre/packer image (HMS-9246) (#4848)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - Many: refactor 'osbuild-depsolve-dnf' mocking in tests to support refactoring in `osbuild/images` (HMS-9355) (#4862)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Packer: install 'rsync' in the ubi-packer container (HMS-9287) (#4850)
      - Author: Tomáš Hozza, Reviewers: Michael Vogt, Sanne Raymaekers
    - build(deps): bump actions/github-script from 7 to 8 (#4852)
      - Author: dependabot[bot], Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - gha: split gobump and images (#4859)
      - Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - go.mod: update osbuild/images to 0.190.0 (`dnfjson` -> `depsolvednf` rename) (HMS-9365) (#4865)
      - Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - go.mod: update osbuild/images to v0.188.0 (#4849)
      - Author: Achilleas Koutsou, Reviewers: Nobody
    - templates/packer: handle vector error (#4866)
      - Author: Sanne Raymaekers, Reviewers: Gianluca Zuccarelli, Tomáš Hozza
    - test: run older CIV tag on nightlies (#4861)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - worker & executor: use vector to forward logs from executor to worker (HMS-9304) (#4858)
      - Author: Sanne Raymaekers, Reviewers: Lukáš Zapletal, Tomáš Hozza

  — Somewhere on the Internet, 2025-09-17


author: Packit <hello@packit.dev> - 152-1
changelog:
  Changes with 152
  ----------------
    - Remove internal/runner/ (#4874)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Gianluca Zuccarelli, Lukáš Zapletal, Michael Vogt
    - Weldr API endpoints & store: don't use `rpmmd` package structs for serialization (HMS-9376) (#4868)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Brian C. Lane, Sanne Raymaekers, Simon de Vlieger
    - chore: bump dependencies via gobump (#4872)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Sanne Raymaekers
    - cloudapi/v2: recover from panics in serializeManifest (HMS-9379) (#4869)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Florian Schüller
    - go.mod: update osbuild/images to v0.198.0 (HMS-9444) (#4877)
      - Author: Achilleas Koutsou, Reviewers: Lukáš Zapletal, Sanne Raymaekers, Tomáš Hozza
    - go.mod: update to v0.197.0 (#4873)
      - Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - templates/packer/worker: remove unbound variable (#4871)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Gianluca Zuccarelli, Tomáš Hozza
    - worker/executor: drop cloudwatch logging from executor (HMS-9304) (#4870)
      - Author: Sanne Raymaekers, Reviewers: Lukáš Zapletal, Tomáš Hozza

  — Somewhere on the Internet, 2025-10-01


author: Jerry James <loganjerry@gmail.com> - 0.9-37.20231204.a6987c8
changelog:
  - Rebuild for polymake 4.15
  - Add patch to fix polymake shell usage
  - Add patches to fix compiler warnings
  - Use the pyproject declarative buildsystem


author: Dominik Mierzejewski <dominik@greysector.net> - 0.23.0-1
changelog:
  - update to 0.23.0 (resolves rhbz#2298052)
  - switch to modern python packaging guidelines
    and automatic BuildRequires generation


author: Terje Rosten <terjeros@gmail.com> - 1.43.5-3
changelog:
  - Add helpers subpackage
  - Add wek deps: conditional recommends on recoll-krunner if
    kf6-krunner is present and corresponding backwards conditional supplements


author: Terje Rosten <terjeros@gmail.com> - 1.43.5-6
changelog:
  - Add forward and backwards weak deps in -gssp subpackage to gnome-shell
  - Remove wrong req. on -kio
  - Let -kio subpackage Supplement kf6-kio-core


author: Remi Collet <remi@fedoraproject.org> - 8.0.6-1
changelog:
  - update to 8.0.6
    fixes CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 and CVE-2025-46819
  - update documentation to 8.0.5


