# changelog

author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-17
changelog:
  - release 1.3.1.6-17
  - Resolves: bug 853106 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error (Ticket 443)
  - Resolves: bug 1049525 - Server hangs in cos_cache when adding a user entry (Ticket 47649)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-18
changelog:
  - release 1.3.1.6-18
  - Resolves: bug 838656 - logconv.pl tool removes the access logs contents if "-M" is not correctly used (Ticket 471)
  - Resolves: bug 922538 - improve dbgen rdn generation, output (Ticket 47374)
  - Resolves: bug 970750 - flush.pl is not included in perl5 (Ticket 47374)
  - Resolves: bug 1013898 - Fix various issues with logconv.pl (Ticket 471)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-19
changelog:
  - release 1.3.1.6-19
  - Resolves: bug 1065971 - Enrolling a host into IdM/IPA always takes two attempts (Ticket 47704)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-20
changelog:
  - release 1.3.1.6-20
  - Resolves: bug 1065242 - 389-ds-base, conflict occurs at yum installation if multilib_policy=all. (Ticket 47709)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-21
changelog:
  - release 1.3.1.6-21
  - Resolves: bug 918694 - Fix covscan defect FORWARD_NULL (Ticket 408)
  - Resolves: bug 918717 - Fix covscan defect COMPILER WARNINGS (Ticket 571)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-22
changelog:
  - release 1.3.1.6-22
  - Resolves: bug 1074084 - e_uniqueid fails to set if an entry is a conflict entry (Ticket 47735)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-23
changelog:
  - release 1.3.1.6-22
  - Resolves: bug 1074850 - EMBARGOED CVE-2014-0132 389-ds-base: 389-ds: flaw in parsing authzid can lead to privilege escalation [rhel-7.0] (Ticket 47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-23
changelog:
  - Resolves: bug 1074850 - EMBARGOED CVE-2014-0132 389-ds-base: 389-ds: flaw in parsing authzid can lead to privilege escalation [rhel-7.0] (Ticket 47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind) (Added 0095-Ticket-47739-directory-server-is-insecurely-misinter.patch)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-24
changelog:
  - release 1.3.1.6-24
  - Resolves: bug 1074084 - e_uniqueid fails to set if an entry is a conflict entry (Ticket 47735); regression - sub-type length in attribute type was mistakenly subtracted.


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-26
changelog:
  - release 1.3.1.6-26
  - Resolves: #1123864
    EMBARGOED CVE-2014-3562 389-ds-base: 389-ds: unauthenticated information disclosure [rhel-7.0.z] (BZ 1123477)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-4
changelog:
  - Bump version to 1.3.10.1-4
  - Resolves: Bug 1765106 - ipa-server-install is failing with ipapython.admintool: ERROR failed to create DS instance Command


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-5
changelog:
  - Bump version to 1.3.10.1-5
  - Resolves: Bug 1744623 - DB Deadlock on modrdn appears to corrupt database and entry cache(cont)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-6
changelog:
  - Bump version to 1.3.10.1-6
  - Resolves: Bug 1801694 - ns-slapd is crashing while restarting ipactl
  - Resolves: Bug 1803023 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  - Resolves: Bug 1803052 - Memory leak in ACI using IP subject
  - Resolves: Bug 1801703 - Regression: NSS has interop problems as server when using limited cipher list
  - Resolves: Bug 1809160 - Entry cache contention during base search


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-7
changelog:
  - Bump version to 1.3.10.1-7
  - Resolves: Bug 1803023 - Several memory leaks reported by Valgrind (fix regression)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-8
changelog:
  - Bump version to 1.3.10.1-8
  - Resolves: Bug 1809160 - Entry cache contention during base search (Fix crash - part 2)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-10
changelog:
  - Bump version to 1.3.10.1-10
  - Resolves: Bug 1814603 - 389-base-ds expected file permissions in package don't match final runtime permissions
  - Resolves: Bug 1836171 - intermittent SSL hang with rhds


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-11
changelog:
  - Bump version to 1.3.10.1-11
  - Resolves: Bug 1839173 - ipa ns-slapd 3 threads deadlock, db pages, state_change lock, write vattr lock


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-14
changelog:
  - Bump version to 1.3.10.1-14
  - Resolves: Bug 1814603 - revert patch as it conflicts with 389-admin package


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-2
changelog:
  - Bump version to 1.3.9.1-2
  - Resolves: Bug 1417340 - entry cache is not cleaned up if an operation is aborted
  - Resolves: Bug 1603140 - Export produces a non-importable ldif file
  - Resolves: Bug 1518320 - ns-slapd: crash in entrycache_add_int
  - Resolves: Bug 1680245 - Error in memberof-plugin cause failures in ipa group-mod
  - Resolves: Bug 1589144 - shadowWarning is not generated if passwordWarning is lower than 86400 seconds (1 day)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-3
changelog:
  - Bump version to 1.3.9.1-3
  - Resolves: Bug 1651279 - The dirsrv user is no longer created with uid 389
  - Resolves: Bug 1542469 - Why does the mep_origination entry toggle from tombstone/not_tombstone 
  - Resolves: Bug 1689313 - OPERATIONS ERROR when trying to delete a group with automember members
  - Resolves: Bug 1673472 - the warning about skew time could last forever.
  - Resolves: Bug 1680245 - Error in memberof-plugin cause failures in ipa group-mod
  - Resolves: Bug 1482596 - referint update should discard any changes if mep update fails


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-4
changelog:
  - Bump version to 1.3.9.1-4
  - Resolves: Bug 1601241 - ns-slapd - Crash when using bak2db.pl to restore a single database.
  - Resolves: Bug 1623935 - upgrade of 389-ds-base could remove replication agreements.
  - Resolves: Bug 1627846 - Contention on virtual attribute lookup (parts 2 & 3)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-5
changelog:
  - Bump version to 1.3.9.1-5
  - Resolves: Bug 1630513 - Customer requesting -y option for ds-replcheck 
  - Resolves: Bug 1668457 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections
  - Resolves: Bug 1695014 - Clarify the ability to change the NOFILE limit
  - Resolves: Bug 1615155 - extended search fails to match entries
  - Resolves: Bug 1652984 - Subtree password policy overrides a user-defined password policy


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-6
changelog:
  - Bump version to 1.3.9.1-6
  - Resolves: Bug 1705125 - ipa-replica-install with 389-ds-base-1.3.9.1-5.el7
  - Resolves: Bug 1643772 - ds-replcheck should validate suffix exists and it's replicated
  - Resolves: Bug 1647133 - Log warn instead of ERR when aci target does not exist.
  - Resolves: Bug 1639192 - Request to add passwordSendExpiringTime in password policy objectclass


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-7
changelog:
  - Bump version to 1.3.9.1-7
  - Resolves: Bug 1704314 - [abrt] [faf] 389-ds-base: objset_find(): /usr/sbin/ns-slapd killed by 11 
  - Resolves: Bug 1629055 - ds-replcheck unreliable, showing false positives
  - Resolves: Bug 1710848 - ACI's with IPv4 and IPv6 bind rules do not work for IPv6 clients


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-8
changelog:
  - Bump version to 1.3.9.1-8
  - Resolves: Bug 1702740 - ns-slapd craches on IPA Servers throughout the customer's topology
  - Resolves: Bug 1715091 - ds-replcheck does not always print a Result summary
  - Resolves: Bug 1713361 - Update defaults.inf
  - Resolves: Bug 1708215 - maxlogsperdir accepting negative values
  - Resolves: Bug 1701092 - segfault when using pam passthru and addn plugins together


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-9
changelog:
  - Bump version to 1.3.9.1-9
  - Resolves: Bug 1713361 - Update defaults.inf (fix missing first commit)
  - Resolves: Bug 1716267 - dse.ldif strip-off string after 1023 character


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-10
changelog:
  - Bump version to 1.3.9.1-10
  - Resolves: Bug 1668457 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-1
changelog:
  - Bump version to 1.3.10.1-1
  - Resolves: Bug 1639342 - Replace error by warning in the state machine defined in repl5_inc_run
  - Resolves: Bug 1691931 - memory leak in automember plugin
  - Resolves: Bug 1662461 - Log the actual base DN when the search fails with "invalid attribute request"
  - Resolves: Bug 1732053 - etime can contain invalid nanosecond value
  - Resolves: Bug 1546739 - consistency in the replication error codes while setting nsds5replicaid=65535


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-2
changelog:
  - Bump version to 1.3.10.1-2
  - Resolves: Bug 1748199 - EMBARGOED CVE-2019-14824 389-ds-base: 389-ds and IDM: allows authenticated unprivileged user to retrieve content of userPassword field for any user 
  - Resolves: Bug 1610234 - nsslapd-defaultnamingcontext does not change when the assigned suffix got deleted
  - Resolves: Bug 1723545 - Directory Server 10 not RFC 4511 compliant
  - Resolves: Bug 1724914 - LDAP server returning controltype in different sequence
  - Resolves: Bug 1739182 - CleanAllRUV task limit not enforced
  - Resolves: Bug 1744623 - DB Deadlock on modrdn appears to corrupt database and entry cache
  - Resolves: Bug 1685059 - After running cl-dump dbdir/cldb/*ldif.done are not deleted


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-3
changelog:
  - Bump version to 1.3.10.1-3
  - Resolves: Bug 1756182 - ns-slapd crash on concurrent SASL BINDs, connection_call_io_layer_callbacks must hold hold c_mutex
  - Resolves: Bug 1749236 - etime displayed has an order of magnitude 10 times smaller than it should be
  - Resolves: Bug 1758109 - AddressSanitizer: heap-use-after-free in import_free_job
  - Resolves: Bug 1676948 - After audit log file is rotated, DS version string is logged after each update
  - Resolves: Bug 1749595 - Extremely slow LDIF import with ldif2db


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-1
changelog:
  - Bump version to  1.3.10.2-1
  - Resolves: Bug 1515319 - nsDS5ReplicaId cant be set to the old value it had before
  - Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions
  - Resolves: Bug 1762901 - cenotaph errors on modrdn operations
  - Resolves: Bug 1772616 - Typo in the replication debug message "error 0 for oparation 561" 
  - Resolves: Bug 1781276 - Regression: NSS has interop problems as server when using limited cipher list
  - Resolves: Bug 1787921 - Crash on startup: Bus error in __env_faultmem.isra.1.part.2
  - Resolves: Bug 1759142 - No error returned when adding an entry matching filters for a non existing automember group
  - Resolves: Bug 1763365 - ns-slapd is crashing while restarting ipactl
  - Resolves: Bug 1769418 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  - Resolves: Bug 1775165 - ldclt core dumped when run with -e genldif option
  - Resolves: Bug 1796558 - Memory leak in ACI using IP subject
  - Resolves: Bug 1769296 - cl-dump exit code is 0 even if command fails with invalid arguments


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-1
changelog:
  - Bump version to  1.3.10.2-1
  - Resolves: Bug 1724761 - Entry cache contention during base search
  - Resolves: Bug 1515319 - nsDS5ReplicaId cant be set to the old value it had before
  - Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions
  - Resolves: Bug 1762901 - cenotaph errors on modrdn operations
  - Resolves: Bug 1772616 - Typo in the replication debug message "error 0 for oparation 561" 
  - Resolves: Bug 1781276 - Regression: NSS has interop problems as server when using limited cipher list
  - Resolves: Bug 1787921 - Crash on startup: Bus error in __env_faultmem.isra.1.part.2
  - Resolves: Bug 1759142 - No error returned when adding an entry matching filters for a non existing automember group
  - Resolves: Bug 1763365 - ns-slapd is crashing while restarting ipactl
  - Resolves: Bug 1769418 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  - Resolves: Bug 1775165 - ldclt core dumped when run with -e genldif option
  - Resolves: Bug 1796558 - Memory leak in ACI using IP subject
  - Resolves: Bug 1769296 - cl-dump exit code is 0 even if command fails with invalid arguments


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-2
changelog:
  - Bump version to  1.3.10.2-2
  - Resolves: Bug 1820433 - Invalid defaults.inf, missing key db_home_dir
  - Resolves: Bug 1801327 - intermittent SSL hang with rhds
  - Resolves: Bug 1807537 - wildcards in rootdn-allow-ip attribute are not accepted
  - Resolves: Bug 1827284 - Memory leak in indirect COS


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-3
changelog:
  - Bump version to 1.3.10.2-3
  - Resolves: Bug 1824930 - ipa ns-slapd 3 threads deadlock, db pages, state_change lock, write vattr lock
  - Resolves: Bug 1837477 - ns-slapd hangs during CleanAllRUV tests


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-5
changelog:
  - Bump version to 1.3.10.2-5
  - Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-6
changelog:
  - Bump version to 1.3.10.2-6
  - Resolves: Bug 1839085 - IPA: Winsync not honoring parameters winSyncDirectoryFilter and winSyncWindowsFilter


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-7
changelog:
  - Bump version to 1.3.10.2-7
  - Resolves: Bug 1870624 - RHDS - allow more than 1 empty AttributeDescription for ldapsearch, without the risk of denial of service
  - Resolves: Bug 1876028 - errors log with incorrectly formatted message parent_update_on_childchange on PARENTUPDATE_DEL
  - Resolves: Bug 1860008 - On ADD replication URP issue internal searches with filter containing unescaped chars


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-8
changelog:
  - Bump version to 1.3.10.2-8
  - Resolves: Bug 1904145 - group rdn with leading space char and add fails error 21 invalid syntax and delete fails error 32
  - Resolves: Bug 1902042 - Entries conflict not resolved by replication


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-10
changelog:
  - Bump version to 1.3.10.2-10
  - Resolves: Bug 1909342 - DS crash in deref plugin while dereferencing an entry that exists but that is not returned by internal search
  - Resolves: Bug 1921856 - “write” permission of ACI changes ns-slapd’s behavior on search operation 
  - Resolves: Bug 1881968 - Replication Lag under high load


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-11
changelog:
  - Bump version to 1.3.10.2-11
  - Resolves: Bug 1953673 - Add new access log keywords for time spent in work queue and actual operation time
  - Resolves: Bug 1931182 - information disclosure during the binding of a DN


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-13
changelog:
  - Bump version to 1.3.10.2-13
  - Resolves: Bug 2005399 - Internal unindexed searches in syncrepl
  - Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
  - Resolves: Bug 2005434 - ACIs are being evaluated against the Replication Manager account in a replication context.
  - Resolves: Bug 2005435 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-14
changelog:
  - Bump version to 1.3.10.2-14
  - Resolves: Bug 2018257 - hang because of incorrect accounting of readers in vattr rwlock
  - Resolves: Bug 2010976 - IPA server (389ds) is very slow in execution of some searches (`&(memberOf=...)(objectClass=ipaHost)` in particular)


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-15
changelog:
  - Bump version to 1.3.10.2-15
  - Resolves: Bug 2049812 - Fix csn generator to limit time skew drift
  - Resolves: Bug 2048530 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in persistent search


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-16
changelog:
  - Bump version to 1.3.10.2-16
  - Resolves: Bug 2077395 - CVE-2022-0918 389-ds:1.4/389-ds-base: sending crafted message could result in DoS
  - Resolves: Bug 2014768 - Log the Auto Member invalid regex rules in the LDAP errors log
  - Resolves: Bug 2018153 - RFE - Provide an option to abort an Auto Member rebuild task
  - Resolves: Bug 2093294 - CVE-2022-0996 389-ds:1.4/389-ds-base: expired password was still allowed to access the database


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10-2-17
changelog:
  - Bump version to 1.3.10.2-17
  - Resolves: Bug 2113056 - Import may break replication because changelog starting csn may not be created
  - Resolves: Bug 2131083 - SIGSEGV in sync_repl


author: Simon Pichugin <spichugi@redhat.com> - 1.3.11.1-1
changelog:
  - Bump version to 1.3.11.1-1
  - Resolves: Bug 2170224 - Backport Rust password storage PBKDF2 schemes
  - Resolves: Bug 2170221 - Boolean attributes should be case insensitive
  - Resolves: Bug 2170218 - Slow memberof fixup task for large static groups, high CPU use


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-4
changelog:
  - release 1.3.3.1-4
  - Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing  (DS 47750)
  - Resolves: bug 1145846 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server (DS 47908)
  - Resolves: bug 1117979 - harden the list of ciphers available by default (phase 2) (DS 47838)
                          - provide enabled ciphers as search result (DS 47880)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-6
changelog:
  - release 1.3.3.1-6
  - Resolves: bug 1151287 - dynamically added macro aci is not evaluated on the fly (DS 47922)
  - Resolves: bug 1080186 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten (DS 47897)
  - Resolves: bug 1150694 - Encoding of SearchResultEntry is missing tag (DS 47920)
  - Resolves: bug 1150695 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails. (DS 47919)
  - Resolves: bug 1139882 - Fix remaining compiler warnings (DS 47892)
  - Resolves: bug 1150206 - result of dna_dn_is_shared_config is incorrectly used (DS 47918)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-8
changelog:
  - release 1.3.3.1-8
  - Resolves: bug 1156607 - Crash in entry_add_present_values_wsi_multi_valued (DS 47937)
  - Resolves: bug 1153737 - Disable SSL v3, by default (DS 47928, DS 47945, DS 47948)
  - Resolves: bug 1158804 - Malformed cookie for LDAP Sync makes DS crash (DS 47939)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-9
changelog:
  - release 1.3.3.1-9
  - Resolves: bug 1153737 - Disable SSL v3, by default. (DS 47928)
  - Resolves: bug 1163461 - Should not check aci syntax when deleting an aci (DS 47953)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-10
changelog:
  - release 1.3.3.1-10
  - Resolves: bug 1172731 - CVE-2014-8112 password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off 
  - Resolves: bug 1166265 - DS hangs during online total update (DS 47942)
  - Resolves: bug 1168151 - CVE-2014-8105 information disclosure through 'cn=changelog' subtree
  - Resolves: bug 1044170 - Allow memberOf suffixes to be configurable (DS 47526)
  - Resolves: bug 1171356 - Bind DN tracking unable to write to internalModifiersName without special permissions (DS 47950)
  - Resolves: bug 1153737 - logconv.pl -- support parsing/showing/reporting different protocol versions (DS 47949)
  - Resolves: bug 1171355 - start dirsrv after chrony on RHEL7 and Fedora (DS 47947)
  - Resolves: bug 1170707 - cos_cache_build_definition_list does not stop during server shutdown (DS 47967)
  - Resolves: bug 1170708 - COS memory leak when rebuilding the cache (DS - Ticket 47969)
  - Resolves: bug 1170709 - Account lockout attributes incorrectly updated after failed SASL Bind (DS 47970)
  - Resolves: bug 1166260 - cookie_change_info returns random negative number if there was no change in a tree (DS 47960)
  - Resolves: bug 1012991 - Error log levels not displayed correctly (DS 47636)
  - Resolves: bug 1108881 - rsearch filter error on any search filter (DS 47722)
  - Resolves: bug 994690  - Allow dynamically adding/enabling/disabling/removing plugins without requiring a server restart (DS 47451)
  - Resolves: bug 1162997 - Running a plugin task can crash the server (DS 47451)
  - Resolves: bug 1166252 - RHEL7.1 ns-slapd segfault when ipa-replica-install restarts (DS 47451)
  - Resolves: bug 1172597 - Crash if setting invalid plugin config area for MemberOf Plugin (DS 47525)
  - Resolves: bug 1139882 - coverity defects found in 1.3.3.x (DS 47965)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-11
changelog:
  - release 1.3.3.1-11
  - Resolves: bug 1080186 - During delete operation do not refresh cache entry if it is a tombstone (DS 47750)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-12
changelog:
  - release 1.3.3.1-12
  - Resolves: bug 1182477 - Windows Sync accidentally cleared raw_entry (DS 47989)
  - Resolves: bug 1180325 - upgrade script fails if /etc and /var are on different file systems (DS 47991 )
  - Resolves: bug 1183655 - Schema learning mechanism, in replication, unable to extend an existing definition (DS 47988)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-14
changelog:
  - release 1.3.3.1-14
  - Resolves: bug 1189154 - DNS errors after IPA upgrade due to broken ReplSync (DS 48030)
              Fixes spec file to make sure all the server instances are stopped before upgrade
  - Resolves: bug 1186548 - ns-slapd crash in shutdown phase (DS 48005)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-16
changelog:
  - release 1.3.3.1-16
  - Resolves: bug 1212894 - CVE-2015-1854 389ds-base: access control bypass with modrdn


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-17
changelog:
  - release 1.3.3.1-17
  - Resolves: bug 1230038 - idm/ipa 389-ds-base entry cache converges to 500 KB in dblayer_is_cachesize_sane (DS 48190)
  - Resolves: bug 1230037 - async simple paged results issue (DS 48146, DS 48192)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-18
changelog:
  - release 1.3.3.1-18
  - Resolves: bug 1232100 - CVE-2015-3230 389-ds-base: nsSSL3Ciphers preference not enforced server side (DS 48194)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-20
changelog:
  - release 1.3.3.1-20
  - Resolves: bug 1243718 - Winsync fails when AD users have multiple spaces (two)inside the value of the rdn attribute (DS 48223)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-21
changelog:
  - release 1.3.3.1-21
  - Resolves: bug 1258318 - Deadlock with retrochangelog, memberof plugin (DS 47931)
  - Resolves: bug 1259466 - Enhance ACIs to have more control over MODRDN operations (DS 47553)
  - Resolves: bug 1259999 - Some filters in RHDS10 are not working fine. (DS 48265)
  - Resolves: bug 1260000 - handling of "No original_tombstone for changenumber" errors (DS 47912)
  - Resolves: bug 1260001 - cleanallruv should completely clean changelog (DS 48208)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-22
changelog:
  - release 1.3.3.1-22
  - Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-23
changelog:
  - release 1.3.3.1-23
  - Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-26
changelog:
  - release 1.3.1.6-26
  - Resolves: bug 1085011 - Directory Server crash reported from reliab15 execution (Ticket 346)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-1
changelog:
  - release 1.3.3.1-1
  - Resolves: bug 746646 - RFE: easy way to configure which users and groups to sync with winsync
  - Resolves: bug 881372 - nsDS5BeginReplicaRefresh attribute accepts any value and it doesn't throw any error when server restarts.
  - Resolves: bug 920597 - Possible to add invalid ACI value
  - Resolves: bug 921162 - Possible to add nonexistent target to ACI
  - Resolves: bug 923799 - if nsslapd-cachememsize set to the number larger than the RAM available, should result in proper error message.
  - Resolves: bug 924937 - Attribute "dsOnlyMemberUid" not allowed when syncing nested posix groups from AD with posixWinsync
  - Resolves: bug 951754 - Self entry access ACI not working properly
  - Resolves: bug 952517 - Dirsrv instance failed to start with Segmentation fault (core dump) after modifying 7-bit check plugin
  - Resolves: bug 952682 - nsslapd-db-transaction-batch-val turns to -1
  - Resolves: bug 966443 - Plugin library path validation
  - Resolves: bug 975176 - Non-directory manager can change the individual userPassword's storage scheme
  - Resolves: bug 979465 - IPA replica's - "SASL encrypted packet length exceeds maximum allowed limit"
  - Resolves: bug 982597 - Some attributes in cn=config should not be multivalued
  - Resolves: bug 987009 - 389-ds-base - shebang with /usr/bin/env
  - Resolves: bug 994690 - RFE: Allow dynamically adding/enabling/disabling/removing plugins without requiring a server restart
  - Resolves: bug 1012991 - errorlog-level 16384 is listed as 0 in cn=config
  - Resolves: bug 1013736 - Enabling/Disabling DNA plug-in throws "ldap_modify: Server Unwilling to Perform (53)" error
  - Resolves: bug 1014380 - setup-ds.pl doesn't lookup the "root" group correctly
  - Resolves: bug 1020459 - rsa_null_sha should not be enabled by default
  - Resolves: bug 1024541 - start dirsrv after ntpd
  - Resolves: bug 1029959 - Managed Entries betxnpreoperation - transaction not aborted upon failure to create managed entry
  - Resolves: bug 1031216 - add dbmon.sh
  - Resolves: bug 1044133 - Indexed search with filter containing '&' and "!" with attribute subtypes gives wrong result
  - Resolves: bug 1044134 - should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default
  - Resolves: bug 1044135 - make connection buffer size adjustable
  - Resolves: bug 1044137 - posix winsync should support ADD user/group entries from DS to AD
  - Resolves: bug 1044138 - mep_pre_op: Unable to fetch origin entry
  - Resolves: bug 1044139 - [RFE] Support RFC 4527 Read Entry Controls
  - Resolves: bug 1044140 - Allow search to look up 'in memory RUV'
  - Resolves: bug 1044141 - MMR stress test with dna enabled causes a deadlock
  - Resolves: bug 1044142 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist
  - Resolves: bug 1044143 - modrdn + NSMMReplicationPlugin - Consumer failed to replay change
  - Resolves: bug 1044144 - resurrected entry is not correctly indexed
  - Resolves: bug 1044146 - Add a warning message when a connection hits the max number of threads
  - Resolves: bug 1044147 - 7-bit check plugin does not work for userpassword attribute
  - Resolves: bug 1044148 - The backend name provided to bak2db is not validated
  - Resolves: bug 1044149 - Winsync should support range retrieval
  - Resolves: bug 1044150 - 7-bit checking is not necessary for userPassword
  - Resolves: bug 1044151 - With SeLinux, ports can be labelled per range. setup-ds.pl or setup-ds-admin.pl fail to detect already ranged labelled ports
  - Resolves: bug 1044152 - ChainOnUpdate: "cn=directory manager" can modify userRoot on consumer without changes being chained or replicated. Directory integrity compromised.
  - Resolves: bug 1044153 - mods optimizer
  - Resolves: bug 1044154 - multi master replication allows schema violation
  - Resolves: bug 1044156 - DS crashes with some 7-bit check plugin configurations
  - Resolves: bug 1044157 - Some updates of "passwordgraceusertime" are useless when updating "userpassword"
  - Resolves: bug 1044159 - [RFE] Support 'Content Synchronization Operation' (SyncRepl) - RFC 4533
  - Resolves: bug 1044160 - remove-ds.pl should remove /var/lock/dirsrv
  - Resolves: bug 1044162 - enhance retro changelog
  - Resolves: bug 1044163 - updates to ruv entry are written to retro changelog
  - Resolves: bug 1044164 - Password administrators should be able to violate password policy
  - Resolves: bug 1044168 - Schema replication between DS versions may overwrite newer base schema
  - Resolves: bug 1044169 - ACIs do not allow attribute subtypes in targetattr keyword
  - Resolves: bug 1044170 - Allow memberOf suffixes to be configurable
  - Resolves: bug 1044171 - Allow referential integrity suffixes to be configurable
  - Resolves: bug 1044172 - Plugin library path validation prevents intentional loading of out-of-tree modules
  - Resolves: bug 1044173 - make referential integrity configuration more flexible
  - Resolves: bug 1044177 - allow configuring changelog trim interval
  - Resolves: bug 1044179 - objectclass may, must lists skip rest of objectclass once first is found in sup
  - Resolves: bug 1044180 - memberOf on a user is converted to lowercase
  - Resolves: bug 1044181 - report unindexed internal searches
  - Resolves: bug 1044183 - With 1.3.04 and subtree-renaming OFF, when a user is deleted after restarting the server, the same entry can't be added
  - Resolves: bug 1044185 - dbscan on entryrdn should show all matching values
  - Resolves: bug 1044187 - logconv.pl - RFE - add on option for a minimum etime for unindexed search stats
  - Resolves: bug 1044188 - Recognize compressed log files
  - Resolves: bug 1044191 - support TLSv1.1 and TLSv1.2, if supported by NSS
  - Resolves: bug 1044193 - default nsslapd-sasl-max-buffer-size should be 2MB
  - Resolves: bug 1044194 - Complex filter in a search request doen't work as expected.
  - Resolves: bug 1044196 - Automember plug-in should treat MODRDN operations as ADD operations
  - Resolves: bug 1044198 - Replication of the schema may overwrite consumer 'attributetypes' even if consumer definition is a superset
  - Resolves: bug 1044202 - db2bak.pl issue when specifying non-default directory
  - Resolves: bug 1044203 - Allow referint plugin to use an alternate config area
  - Resolves: bug 1044205 - Allow memberOf to use an alternate config area
  - Resolves: bug 1044210 - idl switch does not work
  - Resolves: bug 1044211 - make old-idl tunable
  - Resolves: bug 1044212 - IDL-style can become mismatched during partial restoration
  - Resolves: bug 1044213 - backend performance - introduce optimization levels
  - Resolves: bug 1044215 - using transaction batchval violates durability
  - Resolves: bug 1044216 - examine replication code to reduce amount of stored state information
  - Resolves: bug 1048980 - 7-bit check plugin not checking MODRDN operation
  - Resolves: bug 1049030 - Windows Sync group issues
  - Resolves: bug 1052751 - Page control does not work if effective rights control is specified
  - Resolves: bug 1052754 - Allow nsDS5ReplicaBindDN to be a group DN
  - Resolves: bug 1057803 - logconv errors when search has invalid bind dn
  - Resolves: bug 1060032 - [RFE] Update lastLoginTime also in Account Policy plugin if account lockout is based on passwordExpirationTime.
  - Resolves: bug 1061060 - betxn: retro changelog broken after cancelled transaction
  - Resolves: bug 1061572 - improve dbgen rdn generation, output and man page.
  - Resolves: bug 1063990 - single valued attribute replicated ADD does not work
  - Resolves: bug 1064006 - Size returned by slapi_entry_size is not accurate
  - Resolves: bug 1064986 - Replication retry time attributes cannot be added
  - Resolves: bug 1067090 - Missing warning for invalid replica backoff configuration
  - Resolves: bug 1072032 - Updating nsds5ReplicaHost attribute in a replication agreement fails with error 53
  - Resolves: bug 1074306 - Under heavy stress, failure of turning a tombstone into glue makes the server hung
  - Resolves: bug 1074447 - Part of DNA shared configuration is deleted after server restart
  - Resolves: bug 1076729 - Continuous add/delete of an entry in MMR setup causes entryrdn-index conflict
  - Resolves: bug 1077884 - ldap/servers/slapd/back-ldbm/dblayer.c: possible minor problem with sscanf
  - Resolves: bug 1077897 - Memory leak with proxy auth control
  - Resolves: bug 1079099 - Simultaneous adding a user and binding as the user could fail in the password policy check
  - Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing
  - Resolves: bug 1082967 - attribute uniqueness plugin fails when set as a chaining component
  - Resolves: bug 1085011 - Directory Server crash reported from reliab15 execution
  - Resolves: bug 1086890 - empty modify returns LDAP_INVALID_DN_SYNTAX
  - Resolves: bug 1086902 - mem leak in do_bind when there is an error
  - Resolves: bug 1086904 - mem leak in do_search - rawbase not freed upon certain errors
  - Resolves: bug 1086908 - Performing deletes during tombstone purging results in operation errors
  - Resolves: bug 1090178 - #481 breaks possibility to reassemble memberuid list
  - Resolves: bug 1092099 - A replicated MOD fails (Unwilling to perform) if it targets a tombstone
  - Resolves: bug 1092342 - nsslapd-ndn-cache-max-size accepts any invalid value.
  - Resolves: bug 1092648 - Negative value of nsSaslMapPriority is not reset to lowest priority
  - Resolves: bug 1097004 - Problem with deletion while replicated
  - Resolves: bug 1098654 - db2bak.pl error with changelogdb
  - Resolves: bug 1099654 - Normalization from old DN format to New DN format doesnt handel condition properly when there is space in a suffix after the seperator operator.
  - Resolves: bug 1108405 - find a way to remove replication plugin errors messages "changelog iteration code returned a dummy entry with csn %s, skipping ..."
  - Resolves: bug 1108407 - managed entry plugin fails to update managed entry pointer on modrdn operation
  - Resolves: bug 1108865 - memory leak in ldapsearch filter objectclass=*
  - Resolves: bug 1108870 - ACI warnings in error log
  - Resolves: bug 1108872 - Logconv.pl with an empty access log gives lots of errors
  - Resolves: bug 1108874 - logconv.pl memory continually grows
  - Resolves: bug 1108881 - rsearch filter error on any search filter
  - Resolves: bug 1108895 - [RFE - RHDS9] CLI report to monitor replication
  - Resolves: bug 1108902 - rhds91 389-ds-base-1.2.11.15-31.el6_5.x86_64 crash in db4 __dbc_get_pp env = 0x0 ?
  - Resolves: bug 1108909 - single valued attribute replicated ADD does not work
  - Resolves: bug 1109334 - 389 Server crashes if uniqueMember is invalid syntax and memberOf plugin is enabled.
  - Resolves: bug 1109336 - Parent numsubordinate count can be incorrectly updated if an error occurs
  - Resolves: bug 1109339 - Nested tombstones become orphaned after purge
  - Resolves: bug 1109354 - Tombstone purging can crash the server if the backend is stopped/disabled
  - Resolves: bug 1109357 - Coverity issue in 1.3.3
  - Resolves: bug 1109364 - valgrind - value mem leaks, uninit mem usage
  - Resolves: bug 1109375 - provide default syntax plugin
  - Resolves: bug 1109378 - Environment variables are not passed when DS is started via service
  - Resolves: bug 1111364 - Updating winsync one-way sync does not affect the behaviour dynamically
  - Resolves: bug 1112824 - Broken dereference control with the FreeIPA 4.0 ACIs
  - Resolves: bug 1113605 - server restart wipes out index config if there is a default index
  - Resolves: bug 1115177 - attrcrypt_generate_key calls slapd_pk11_TokenKeyGenWithFlags with improper macro
  - Resolves: bug 1117021 - Server deadlock if online import started while server is under load
  - Resolves: bug 1117975 - paged results control is not working in some cases when we have a subsuffix.
  - Resolves: bug 1117979 - harden the list of ciphers available by default
  - Resolves: bug 1117981 - Fix various typos in manpages & code
  - Resolves: bug 1117982 - Fix hyphens used as minus signed and other manpage mistakes
  - Resolves: bug 1118002 - server crashes deleting a replication agreement
  - Resolves: bug 1118006 - RFE - forcing passwordmustchange attribute by non-cn=directory manager
  - Resolves: bug 1118007 - [RFE] Make it possible for privileges to be provided to an admin user to import an LDIF file containing hashed passwords
  - Resolves: bug 1118014 - Enhance ACIs to have more control over MODRDN operations
  - Resolves: bug 1118021 - Return all attributes in rootdse without explicit request
  - Resolves: bug 1118025 - Slow ldapmodify operation time for large quantities of multi-valued attribute values
  - Resolves: bug 1118032 - Schema Replication Issue
  - Resolves: bug 1118034 - 389 DS Server crashes and dies while handles paged searches from clients
  - Resolves: bug 1118043 - Failed deletion of aci: no such attribute
  - Resolves: bug 1118048 - If be_txn plugin fails in ldbm_back_add, adding entry is double freed.
  - Resolves: bug 1118051 - Add switch to disable pre-hashed password checking
  - Resolves: bug 1118054 - Make ldbm_back_seq independently support transactions
  - Resolves: bug 1118055 - Add operations rejected by betxn plugins remain in cache
  - Resolves: bug 1118057 - online import crashes server if using verbose error logging
  - Resolves: bug 1118059 - add fixup-memberuid.pl script
  - Resolves: bug 1118060 - winsync plugin modify is broken
  - Resolves: bug 1118066 - memberof scope: allow to exclude subtrees
  - Resolves: bug 1118069 - 389-ds production segfault: __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:144
  - Resolves: bug 1118074_DELETE_FN - plugin returned error" messages
  - Resolves: bug 1118076 - ds logs many "Operation error fetching Null DN" messages
  - Resolves: bug 1118077 - Improve import logging and abort handling
  - Resolves: bug 1118079 - Multi master replication initialization incomplete after restore of one master
  - Resolves: bug 1118080 - Don't add unhashed password mod if we don't have an unhashed value
  - Resolves: bug 1118081 - Investigate betxn plugins to ensure they return the correct error code
  - Resolves: bug 1118082 - The error result text message should be obtained just prior to sending result
  - Resolves: bug 1123865 - CVE-2014-3562 389-ds-base: 389-ds: unauthenticated information disclosure [rhel-7.1]


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-2
changelog:
  - release 1.3.3.1-2
  - Resolves: bug 1079099 - Simultaneous adding a user and binding as the user could fail in the password policy check (DS 47748)
  - Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing (DS 47834)
  - Resolves: bug 1139882 - coverity defects found in 1.3.3.1 (DS 47890)
  - Resolves: bug 1112702 - Broken dereference control with the FreeIPA 4.0 ACIs (DS 47885 - deref plugin should not return references with noc access rights)
  - Resolves: bug 1117979 - harden the list of ciphers available by default (DS 47838, DS 47895)
  - Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing (DS 47889 - DS crashed during ipa-server-install on test_ava_filter)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-9
changelog:
  - release 1.3.4.0-9
  - Resolves: bug 1240876 - verify_db.pl doesn't verify DB specified by -a option. (DS 48215)
  - Resolves: bug 1245235 - winsync lastlogon attribute not syncing between IPA & Windows 2008. (DS 48232)
  - Resolves: bug 1245519 - Deadlock with retrochangelog, memberof plugin (DS 47931)
  - Resolves: bug 1246389 - wrong password check if passwordInHistory is decreased. (DS 48228)
  - Resolves: bug 1247811 - logconv autobind handling regression caused by 47446 (DS 48231)
  - Resolves: bug 1250177 - Investigate betxn plugins to ensure they return the correct error code (DS 47810)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-11
changelog:
  - release 1.3.4.0-11
  - Resolves: bug 1249784 - ipa-dnskeysyncd unhandled exception on named-pkcs11 start (DS 48249)
  - Resolves: bug 1252082 - removing chaining database links trigger valgrind read error (DS 47686)
  - Resolves: bug 1252207 - bashisms in 389-ds-base admin scripts (DS 47511)
  - Resolves: bug 1252533 - Man pages and help for remove-ds.pl doesn't display "-a" option (DS 48245)
  - Resolves: bug 1252781 - Slapd crashes reported from latest builds (DS 48250)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-12
changelog:
  - release 1.3.4.0-12
  - Resolves: bug 1252133 - replica upgrade failed in starting dirsrv service (DS 48243)
  - Resolves: bug 1254344 - Server crashes in ACL_LasFindFlush during shutdown if ACIs contain IP addresss restrictions (DS 48233)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-14
changelog:
  - release 1.3.4.0-14
  - Resolves: bug 1246389 - wrong password check if passwordInHistory is decreased. (DS 48228)
  - Resolves: bug 1255851 - Shell CLI fails with usage errors if an argument containing white spaces is given (DS 48254)
  - Resolves: bug 1256938 - Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax (DS 47757)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-15
changelog:
  - release 1.3.4.0-15
  - Resolves: bug 1258996 - Complex filter in a search request doen't work as expected. (regression) (DS 48265)
  - Resolves: bug 1179370 - COS cache doesn't properly mark vattr cache as invalid when there are multiple suffixes (DS 47981)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-16
changelog:
  - release 1.3.4.0-16
  - Resolves: bug 1243970 - In MMR, double free coould occur under some special condition (DS 48276, DS 48226)
  - Resolves: bug 1259949 - Fractional replication evaluates several times the same CSN (DS 48266)
  - Resolves: bug 1241723 - cleanallruv - fix regression with server shutdown (DS 48217)
  - Resolves: bug 1264224 - segfault in ns-slapd due to accessing Slapi_DN freed in pre bind plug-in (DS 48188)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-17
changelog:
  - release 1.3.4.0-17
  - Resolves: bug 1259949 - A backport error (coverity -- unused variable 'init_retry')


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-18
changelog:
  - release 1.3.4.0-18
  - Resolves: bug 1259949 - Fractional replication evaluates several times the same CSN (DS 48266, DS 48284)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-19
changelog:
  - release 1.3.4.0-19
  - Resolves: bug 1228823 - async simple paged results issue (DS 48299, DS 48192)
  - Resolves: bug 1266944 - ns-slapd crash during ipa-replica-manage del (DS 48298)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-20
changelog:
  - release 1.3.4.0-20
  - Resolves: bug 1278729 - Share nsslapd-threadnumber in the case nunc-stans is enabled (DS 48339)
  - Resolves: bug 1278730 - SimplePagedResults -- abandon could happen between the abandon check and sending results (DS 48338)
  - Resolves: bug 1279572 - Cannot upgrade a consumer to supplier in a multimaster environment (DS 48325)
  - Resolves: bug 1279573 - nunc-stans: Attempt to release connection that is not acquired (DS 48311)
  - Resolves: bug 1280210 - deadlock in mep delete post op (DS 47976)
  - Resolves: bug 1281522 - acl - regression - trailing ', (comma)' in macro matched value is not removed (DS 48344)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-21
changelog:
  - release 1.3.4.0-21
  - Resolves: bug 1278730 - SimplePagedResults -- abandon could happen between the abandon check and sending results -- Fixing a regression introduced in 1.3.4.0-20 (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-22
changelog:
  - release 1.3.4.0-22
  - Resolves: bug 1290725 - SimplePagedResults -- in the search error case, simple paged results slot was not released. (DS 48375)
  - Resolves: bug 1290726 - The 'eq' index does not get updated properly when deleting and re-adding attributes in the same modify operation (DS 48370)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-23
changelog:
  - release 1.3.4.0-23
  - Resolves: bug 1295684 - many attrlist_replace errors in connection with cleanallruv (DS 48283)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-24
changelog:
  - release 1.3.4.0-24
  - Resolves: bug 1298105 - 389-ds hanging after a few minutes of operation (DS 48406)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-25
changelog:
  - release 1.3.4.0-25
  - Resolves: bug 1299757 - CVE-2016-0741 389-ds-base: Worker threads do not detect abnormally closed connections causing DoS


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-27
changelog:
  - release 1.3.4.0-27
  - Resolves: bug 1309963 - keep alive entries can break replication (DS 48445)
  - Resolves: bug 1309964 - Crash in slapi_get_object_extension (DS 48536)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-28
changelog:
  - release 1.3.4.0-28
  - Resolves: bug 1315181 - change severity of some messages related to "keep alive" entries (DS 48420)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-29
changelog:
  - release 1.3.4.0-29
  - Resolves: bug 1316552 - License tag does not match actual license of code (DS 48757)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-30
changelog:
  - release 1.3.4.0-30
  - Resolves: bug 1321891 - DES to AES password conversion fails if a backend is empty (DS 48777)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-31
changelog:
  - release 1.3.4.0-31
  - Resolves: bug 1335423 - heap corruption at schema replication. (DS 48492)
  - Resolves: bug 1335107 - Paged results search returns the blank list of entries (DS 48808)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-32
changelog:
  - release 1.3.4.0-32
  - Resolves: bug 1344293 - At startup DES to AES password conversion causes timeout in start script (DS 48862)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-33
changelog:
  - release 1.3.4.0-33
  - Resolves: bug 1351323 - Improve MMR replication convergence (DS 48636)
  - Resolves: bug 1351447 - Supplier can skip a failing update, although it should retry. (DS 47788)
  - Resolves: bug 1350707 - Replication changelog can incorrectly skip over updates (DS 48766)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-1
changelog:
  - Release 1.3.5.10-1
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48905)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-2
changelog:
  - Release 1.3.5.10-2
  - Resolves: bug 1353714 - If a cipher is disabled do not attempt to look it up (DS 48743)
  - Resolves: bug 1353592 - Setup-ds.pl --update fails - regression (DS 48755)
  - Resolves: bug 1353544 - db2bak.pl task enters infinitive loop when bak fs is almost full (DS 48914)
  - Resolves: bug 1354374 - Upgrade to 389-ds-base >= 1.3.5.5 doesn't install 389-ds-base-snmp (DS 48918)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-4
changelog:
  - Release 1.3.5.10-4
  - Resolves: bug 1209128 - [RFE] Add a utility to get the status of Directory Server instances (DS 48144)
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat
  - Resolves: bug 1354660 - flow control in replication also blocks receiving results (DS 48767)
  - Resolves: bug 1356261 - Fixup tombstone task needs to set proper flag when updating (DS 48924)
  - Resolves: bug 1355760 - ns-slapd crashes during the deletion of backend (DS 48922)
  - Resolves: bug 1353629 - DS shuts down automatically if dnaThreshold is set to 0 in a MMR setup (DS 48916)
  - Resolves: bug 1355879 - nunc-stans: ns-slapd crashes during startup with SIGILL on AMD Opteron 280 (DS 48925)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-5
changelog:
  - Release 1.3.5.10-5
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-6
changelog:
  - Release 1.3.5.10-6
  - Resolves: bug 1326077 - Page result search should return empty cookie if there is no returned entry (DS 48928)
  - Resolves: bug 1360447 - nsslapd-workingdir is empty when ns-slapd is started by systemd (DS 48939)
  - Resolves: bug 1360327 - remove-ds.pl deletes an instance even if wrong prefix was specified (DS 48934)
  - Resolves: bug 1349815 - DS logs have warning:ancestorid not indexed for all CS subsystems (DS 48940)
  - Resolves: bug 1329061 - 389-ds-base-1.3.4.0-29.el7_2 "hang" (DS 48882)
  - Resolves: bug 1360976 - EMBARGOED CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack
  - Resolves: bug 1361134 - When fine-grained policy is applied, a sub-tree has a priority over a user while changing password (DS 48943) 
  - Resolves: bug 1361321 - Duplicate collation entries (DS 48936)
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-7
changelog:
  - Release 1.3.5.10-7
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1360976 - fixing a compiler warning


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-8
changelog:
  - Release 1.3.5.10-8
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates (DS 48954)
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366561 - ns-accountstatus.pl giving error even "No such object (32)" (DS 48956)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-9
changelog:
  - Release 1.3.5.10-9
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366828 - audit on failure doesn't work if attribute nsslapd-auditlog-logging-enabled is NOT enabled (DS 48958)
  - Resolves: bug 1368520 - Crash in import_wait_for_space_in_fifo() (DS 48960)
  - Resolves: bug 1368956 - man page of ns-accountstatus.pl shows redundant entries for -p port option
  - Resolves: bug 1369537 - passwordMinAge attribute doesn't limit the minimum age of the password (DS 48967)
  - Resolves: bug 1369570 - cleanallruv changelog cleaning incorrectly impacts all backends (DS 48964)
  - Resolves: bug 1369425 - ACI behaves erratically (DS 48972)
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)
  - Resolves: bug 1371283 - Server Side Sorting crashes the server. (DS 48970)
  - Resolves: bug 1371284 - Disabling CLEAR password storage scheme will crash server when setting a password (DS 48975)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-10
changelog:
  - Release 1.3.5.10-10
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-11
changelog:
  - Release 1.3.5.10-11
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-12
changelog:
  - Release 1.3.5.10-12
  - Resolves: bug 1384785 - Replica install fails with old IPA master sometimes during replication process (DS 48992)
  - Resolves: bug 1388501 - 389-ds-base is missing runtime dependency - bind-utils (DS 48328)
  - Resolves: bug 1388581 - Replication stops working only when fips mode is set to true (DS 48909)
  - Resolves: bug 1390342 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin (DS 49014)
  - Resolves: bug 1390343 - trace args debug logging must be more restrictive (DS 49009)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-13
changelog:
  - Release 1.3.5.10-13
  - Resolves: bug 1402030 - Non tombstone entry which dn starting with "nsuniqueid=...," cannot be deleted (DS 48133)
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 49020)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-15
changelog:
  - Release 1.3.5.10-15
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 48964)
  - Resolves: bug 1410080 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication (DS 49074)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-16
changelog:
  - Release 1.3.5.10-16
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)
  - Resolves: bug 1414678 - deadlock on cos cache rebuild (DS 49079)
  - Resolves: bug 1414679 - Release 1.3.5 may allow expired accounts access to systems (DS 49080, DS 49082)
  - Resolves: bug 1416368 - Aborted operation can leave RUV in incorrect state (DS 49008)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-17
changelog:
  - Release 1.3.5.10-17
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-19
changelog:
  - Release 1.3.5.10-19
  - Resolves: bug 1429495 - ns-slapd dies under heavy load 
  - Resolves: bug 1429498 - A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-20
changelog:
  - Bump version to 1.3.5.10-20
  - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-21
changelog:
  - Bump verison to 1.3.5.10-21
  - Resolves: Bug 1440654 - Possible deadlock while installing an ipa replica
  - Resolves: Bug 1445178 - Silent install localhost issue
  - Resolves: Bug 1445177 - retrocl crash at shutdown
  - Resolves: Bug 1445176 - case sensitivity in acl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-6
changelog:
  - Bump version to 1.3.6.1-6
  - Resolves: bug 1437006 - EMBARGOED CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages
  - Resolves: bug 1341689 - dbmon.sh / cn=monitor] nsslapd-db-pages-in-use is increasing
  - Resolves: bug 1394899 - RHDS should ignore passwordMinAge if "password must reset" is set
  - Resolves: bug 1397288 - typo in logconv.pl man page
  - Resolves: bug 1436994 - incorrect pathes in pkg-config files
  - Resolves: bug 1396448 - Add a hard dependency for >=selinux-policy-3.13.1-75


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-7
changelog:
  - Bump version to 1.3.6.1-7
  - Resolves: bug 1394899 - RHDS should ignore passwordMinAge if "password must reset" is set(fix crash regression)
  - Resolves: bug 1381326 - dirsrv-snmp.service is provided by 389-ds-base instead of 389-ds-base-snmp
  - Resolves: bug 1049190 - Better input argument validation and error messages for db2index and db2index.pl.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-8
changelog:
  - Bump version to 1.3.6.1-8
  - Resolves: Bug 1432016 - Possible deadlock while installing an ipa replica
  - Resolves: Bug 1438029 - Overflow in memberof


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-9
changelog:
  - Bump version to 1.3.6.1-9
  - Resolves: Bug 1442880 - setup-ds-admin.pl -u with nsslapd-localhost changed
  - Resolves: Bug 1443682 - util_info_sys_pages should be able to detect memory restrictions in a cgroup


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-10
changelog:
  - Bump version to 1.3.6.1-10
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default val 
  - Resolves: Bug 1111400 - logconv.pl lists sasl binds with no dn as anonymous 
  - Resolves: Bug 1377452 - Integer overflow in performance counters
  - Resolves: Bug 1441790 - ldapserch for nsslapd-errorlog-level returns incorrect values
  - Resolves: Bug 1444431 - ERR - symload_report_error - Netscape Portable Runtime error -5975
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-11
changelog:
  - Bump version to 1.3.6.1-11
  - Resolves: Bug 1410207 - Utility command had better use INFO log level for the output
  - Resolves: Bug 1049190 - Better input argument validation and error messages for db2index and db2index.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-13
changelog:
  - Bump version to 1.3.6.1-13
  - Resolves: Bug 1444938 - Fix backport issue from build 1.3.6.1-10 (part 2)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-14
changelog:
  - Bump version to 1.3.6.1-14
  - Resolves: Bug 1450910 - Modifying "nsslapd-cache-autosize" parameter using ldapmodify command is failing.
  - Resolves: Bug 1450893 - When nsslapd-cache-autosize is not set in dse.ldif, ldapsearch does not show the default value
  - Resolves: Bug 1449098 - ns-slapd crashes in role cache creation
  - Resolves: Bug 1441522 - AddressSanitizer: heap-use-after-free in libreplication-plugin.so
  - Resolves: Bug 1437492 - "ERR - cos-plugin - cos_cache_query_attr - cos attribute krbPwdPolicyReference failed schema check" in error log
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1451657 - -v option is not working for db2ldif.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-15
changelog:
  - Bump version to 1.3.6.1-15
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify 
  - Resolves: Bug 1357682 - RHDS fails to start with message: "Failed to delete old semaphore for stats file"
  - Resolves: Bug 1452739 - Zero value of nsslapd-cache-autosize-split makes dbcache to be equal 0


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-16
changelog:
  - Bump version to 1.3.6.1-16
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify
  - Resolves: Bug 1454921 - Fixup memberof task throws error "memberof_fix_memberof_callback: Weird
  - Resolves: Bug 1456774 - ipa-replica server fails to upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-17
changelog:
  - Bump version to 1.3.6.1-17
  - Resolves: Bug 1476161 - replication halt - pending list first CSN not committed, pending list increasing
  - Resolves: Bug 1476162 - Change the retrochangelog default cache size


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-18
changelog:
  - Bump version to 1.3.6.1-18
  - Require srvcore 4.1.3
  - Resolves: Bug 1479757 - dse.ldif and fsync
  - Resolves: Bug 1479755 - backup fails if changelog is enabled
  - Resolves: Bug 1479756 - Locked account provides different return code if password is correct


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.19-1
changelog:
  - Bump version to 1.3.6.19-1
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-19
changelog:
  - Bump version to 1.3.6.1-19
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-20
changelog:
  - Bump verions to 1.3.6.1-20
  - Resolves: Bug 1489693 - PasswordCheckSyntax attribute fails to validate cn, sn, uid
  - Resovles: Bug 1492829 - patch should of been applied to 7.4 but got missed
  - Resolves: Bug 1486128 - Performance issues with RHDS 10 - NDN cache investigation
  - Resolves: Bug 1489694 - crash in send_ldap_result
  - Resolves: Bug 1491778 - crash when adding invalid repl agmt
  - Resolves: Bug 1492830 - password expired control not sent
  - Resolves: Bug 1492833 - sasl-mechanisms removed during upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-21
changelog:
  - Bump verions to 1.3.6.1-21
  - Resolves: Bug 1498958 - unable to retrieve specific cosAttribute when subtree password policy is configured


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-23
changelog:
  - Bump version to 1.3.6.1-23
  - Resolves: Bug 1504536 - [memberOf Plugin] bulk deleting users causes deadlock when there are multiple backends
  - Resolves: Bug 1503001 - Adding a database entry fails if the same database was deleted after an import
  - Resolves: Bug 1506912 - Improve valueset sort performance during valueset purging


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-24
changelog:
  - Bump version to 1.3.6.1-24
  - Resolves: Bug 1508978 - replicated MODRDN fails breaking replication
  - Resolves: Bug 1511940 - heap corruption during import
  - Resolves: Bug 1510319 - [abrt] 389-ds-base: SLL_Next(): ns-slapd killed by SIGSEGV 
  - Resolves: Bug 1509347 - cleanallruv task is not logging any information


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-25
changelog:
  - Bump version to 1.3.6.1-25
  - Resolves: Bug 1526928 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1523505 - opened connection are hanging, no longer poll
  - Resolves: Bug 1523507 - IPA server replication broken, after DS stop-start, due to changelog reset


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-27
changelog:
  - Bump version to 1.3.6.1-27
  - Resolves: Bug 1536343 - Indexing of internationalized matching rules is failing
  - Resolves: Bug 1535539 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp function
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-28
changelog:
  - Bump version to 1.3.6.1-28
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-2
changelog:
  - Bump version to 1.3.6.1-2
  - Resolves: bug 1431877 - 389-1.3.6.1-1.el7 covscan errors
  - Resolves: bug 1432206 - content sync plugin can hang server shutdown
  - Resolves: bug 1432149 - sasl external binds fail in 1.3.6.1


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-4
changelog:
  - Bump version to 1.3.6.1-4
  - Resolves: bug 1379424 - Reset-agmt-update-staus-and-total-init
  - Resolves: bug 1394000 - dbmon.sh-fails-if-you-have-nsslapd-requi.patch
  - Resolves: bug 1417344 - targetattr-wildcard-evaluation-is-incorr.patch
  - Resolves: bug 1429770 - ds-logpipe.py-crashes-for-non-existing-u.patch
  - Resolves: bug 1433697 - Fix-double-free-in-_cl5NewDBFile-error-path.patch
  - Resolves: bug 1433996 - retrocl-can-crash-server-at-shutdown.patch
  - Resolves: bug 1434967 - rpm-would-not-create-valid-pkgconfig-fi.patch
  - Resolves: bug 1417338 - To-debug-DB_DEADLOCK-condition-allow-to.patch
  - Resolves: bug 1433850 - Deleting-suffix-can-hang-server.patch


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-5
changelog:
  - Bump version to 1.3.6.1-5
  - Resolves: bug 1377452 - Integer overflow in counters and monitor
  - Resolves: bug 1425907 - Harden password storage scheme
  - Resolves: bug 1431207 - ns-slapd killed by SIGABRT


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-2
changelog:
  - Bump version to 1.3.7.5-2
  - specfile updates: add asan support, make nunc-stans default, and general cleanup


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-5
changelog:
  - Bump version to 1.3.7.5-5
  - Resolves: Bug 1476207 - Enabling instance service doesn't work 
  - Resolves: Bug 1434335 - Errors log filled with attrlist_replace - attr_replace
  - Resolves: Bug 1453155 - unable to retrieve specific cosAttribute when subtree password policy is configured
  - Resolves: Bug 1459965 - repl-monitor - matches null string many times in regex 
  - Resolves: Bug 1463204 - Adding a database entry fails if the same database was deleted after an import
  - Resolves: Bug 1469567 - Activating roles returns error 16
  - Resolves: Bug 1498773 - Installation of ipa fails with crash in topology plugin
  - Resolves: Bug 1501058 - [memberOf Plugin] bulk deleting users causes deadlock when there are multiple backends
  - Resolves: Bug 1352121 - [RFE] allow to enable MemberOf plugin in dedicated consumer


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-6
changelog:
  - Bump version to 1.3.7.5-6
  - Resolves: Bug 1488836 - directory server fails to start because maxdisksize 
  - Resolves: Bug 1474100 - Use of uninitialized value in string ne at /usr/bin/logconv.pl
  - Resolves: Bug 1447308 - Add option to show full un-ellipsized output in status-dirsrv
  - Resolves: Bug 1438526 - Server allows to set any nsds5replicaid in the existing replica entry
  - Resolves: Bug 1185774 - Missing warning for invalid replica backoff configuration


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-7
changelog:
  - Bump version to 1.3.7.5-7
  - Resolves: Bug 1474100 - Use of uninitialized value in string ne at /usr/bin/logconv.pl
  - Resolves: Bug 1506425 - Improve valueset sort performance during valueset purging
  - Resolves: Bug 1505046 - [abrt] 389-ds-base: SLL_Next(): ns-slapd killed by SIGSEGV
  - Resolves: Bug 1271208 - nsds5ReplicaProtocolTimeout attribute accepts negative values


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-8
changelog:
  - Bump version to 1.3.7.5-8
  - Resolves: Bug 1509016 - cleanallruv task is not logging any information


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-10
changelog:
  - Bump version to 1.3.7.5-10
  - Resolves: Bug 1464463 - Replication fails to start with CBCA (Certificate-Based Client Authentication) while FIPS mode is enabled.
  - Resolves: Bug 1465383 - Segmentation fault in valueset_array_to_sorted_quick
  - Resolves: Bug 1510865 - python-ldap is not a dependency of 389-ds-base
  - Resolves: Bug 1513467 - IPA upgrade fails for latest ipa package
  - Resolves: Bug 1192099 - IPA server replication broken, after DS stop-start, due to changelog reset
  - Resolves: Bug 1445188 - Misleading error message - Incoming BER Element was 3 bytes 
  - Resolves: Bug 1498980 - heap corruption during import
  - Resolves: Bug 1511462 - scope one searches give incorrect results
  - Resolves: Bug 1514033 - opened connection are hanging, no longer poll


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-11
changelog:
  - Bump version to 1.3.7.5-11
  - Resolves: Bug 1518069 - heap-buffer-overflow in ss_unescape
  - Resolves: Bug 1516676 - gssapi authentication fails after upgrading 389-ds-base
  - Resolves: Bug 1511885 - Automatically load /usr/lib/sysctl.d/70-dirsrv.conf after installing 389-ds-base
  - Resolves: Bug 1517980 - stack-buffer-overflow in slapi_pblock_get


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-12
changelog:
  - Bump version to 1.3.7.5-12
  - Resolves: Bug 1459946 - GetEffectiveRights gives false-negative with ACIs containing targetfilter
  - Resolves: Bug 1507194 - cleanallruv could break replication if anchor csn in ruv originated in deleted replica
  - Resolves: Bug 1517788 - password policy: minimum token length fails when the token length is equal to attribute length
  - Resolves: Bug 1518287 - heap-use-after-free in csn_as
  - Resolves: Bug 1531153 - Indexing of internationalized matching rules is failing
  - Resolves: Bug 1517383 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired
  - Resolves: Bug 1523183 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1457315 - cmocka tests are not executed during rpm build
  - Resolves: Bug 1516309 - After cleanALLruv, replication is looping on keep alive DEL


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-13
changelog:
  - Bump version to 1.3.7.5-13
  - Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
  - Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7
  - Resolves: Bug 1534379 - CVE-2017-15134: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c 
  - Resolves: Bug 1533571 - memberof: schema violation error message is confusing as memberof will likely repair target entry
  - Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-14
changelog:
  - Bump version to 1.3.7.5-14
  - Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7 (fix regression in -13)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-15
changelog:
  - Bump version to 1.3.7.5-15
  - Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
  - Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy
  - Resolves: Bug 1541108 - Allow CRL handling to be configurable for outgoing connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-16
changelog:
  - Bump version to 1.3.7.5-16
  - Resolves: Bug 1542645 - Outgoing secure connection is failing with recent OpenLDAP


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5.17
changelog:
  - Bump version to 1.3.7.5.17
  - Resolves: Bug 1539082 - Child entry cenotaphs should not prevent the deletion of the parent
  - Resolves: Bug 1540106 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 
  - Resolves: Bug 1535538 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp


author: Matus Honek <mhonek@redhat.com> - 1.3.7.5-19
changelog:
  - Bump version to 1.3.7.5-19
  - Resolves: Bug 1563107 - IPA server is not responding, all authentication and admin tests failed [rhel-7.5.z]


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-20
changelog:
  - Bump version to 1.3.7.5-20
  - Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received 
  - Resolves: Bug 1559764 - memberof fails if group is moved into scope
  - Resolves: Bug 1554720 - "Truncated search results" pop-up appears in user details in WebUI 
  - Resolves: Bug 1553605 - ipa-server-install fails with Error: Upgrade failed with no such entry
  - Resolves: Bug 1559760 - ds-replcheck: add -W option to ask for the password from stdin instead of passing it on command line
  - Resolves: Bug 1559464 - replica_write_ruv log a failure even when it succeeds


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-21
changelog:
  - Bump version to 1.3.7.5-21
  - Resolves: Bug 1559818 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-22
changelog:
  - Bump version to 1.3.5.7-22
  - Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received
  - Resolves: Bug 1579702 - Replication stops working when MemberOf plugin is enabled on hub and consumer
  - Resolves: Bug 1579698 - replicated operations should be serialized
  - Resolves: Bug 1579700 - Upgrade script doesn't enable PBKDF password storage plug-in
  - Resolves: Bug 1580257 - ds-replcheck LDIF comparision fails when checking for conflicts
  - Resolves: Bug 1580523 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-23
changelog:
  - Bump version to 1.3.7.5-23
  - Resolves: Bug 1581588 - ACI deny rules do not work correctly
  - Resolves: Bug 1582747 - DS only accepts RSA and Fortezza cipher families


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-25
changelog:
  - Bump version to 1.3.7.5-25
  - Resolves: Bug 1597530 - Async operations can hang when the server is running nunc-stans


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-26
changelog:
  - Bump version to 1.3.7.5-26
  - Resolves: Bug 1615924 - Fine grained password policy can impact search performance
  - Resolves: Bug 1614836 - Disable nunc-stans by default
  - Resolves: Bug 1614861 - ldapsearch with server side sort crashes the ldap server


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-28
changelog:
  - Bump version to 1.3.7.5-28
  - Resolves: Bug 1628676 - 389-ds-base: race condition on reference counter leads to DoS using persistent search
  - Resolves: Bug 1628677 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-5
changelog:
  - Bump version to 1.3.8.4-5
  - Resolves: Bug 1595766 - CVE-2018-10871 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-6
changelog:
  - Bump version to 1.3.8.4-6
  - Resolves: Bug 1595766 - backout this fix for now because it breaks FreeIPA


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-7
changelog:
  - Bump version to 1.3.8.4-7
  - Resolves: Bug 1595766 - backout this fix for now because it breaks FreeIPA (removed patch file all together)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-8
changelog:
  - Bump version to 1.3.8.4-8
  - Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-9
changelog:
  - Bump version to 1.3.8.4-9
  - Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-10
changelog:
  - Bump verison to 1.3.8.4-10
  - Resolves: Bug 1614501 - Disable nunc-stans by default
  - Resolves: Bug 1607078 - ldapsearch with server side sort crashes the ldap server


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-11
changelog:
  - Bump version to 1.3.8.4-11
  - Resolves: Bug 1614820 - Server crash through modify command with large DN


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-12
changelog:
  - Bump version to 1.3.8.4-12
  - Resolves: Bug 1616412 - filter optimization fix causes regression(fix reverted)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-13
changelog:
  - Bump version to 1.3.8.4-13
  - Resolves: Bug 1623949 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-16
changelog:
  - Bump version to 1.3.8.4-16
  - Resolves: Bug 1638513 - Message: "CRIT - list_candidates - NULL idl was recieved from filter_candidates_ext." should not be critical


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-18
changelog:
  - Bump version to 1.3.8.4-18
  - Resolves: Bug 1638516 - CRIT - list_candidates - NULL idl was recieved from filter_candidates_ex


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-19
changelog:
  - Bump version to 1.3.8.4-19
  - Resolves: Bug 1653820 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user
  - Resolves: Bug 1645197 - on-line re-initialization hangs


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-21
changelog:
  - Bump version to 1.3.8.4-21
  - Resolves: Bug 1659510 - during MODRDN referential integrity can fail erronously while updating large groups
  - Resolves: Bug 1659936 - After RHEL 7.6 HTB update, unable to set nsslapd-cachememsize (RHDS 10) to custom value


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-22
changelog:
  - Bump version to 1.3.8.4-22
  - Resolves: Bug 1660120 - certmap fails when Issuer DN has comma in name


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-23
changelog:
  - Bump version to 1.3.8.4-23
  - Resolves: Bug 1672173 - import task should not be deleted after import finishes to be able to query the status
  - Resolves: Bug 1672177 - after certain failed import operation, impossible to replay an import operation.
  - Resolves: Bug 1672179 - cannot add cenotaph in read only consumer


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-24
changelog:
  - Bump version to 1.3.8.4-24
  - Resolves: Bug 1718184 - segfault when using pam passthru and addn plugins together


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-25
changelog:
  - Bump version to 1.3.8.4-25
  - Resolves: Bug 1722828 - referint update should discard any changes if mep update fails
  - Resolves: Bug 1718689 - dse.ldif strip-off string after 1023 character
  - Resolves: Bug 1719720 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-25.1
changelog:
  - Bump version to 1.3.8.4-25.1
  - Resolves: Bug 1718689 - dse.ldif strip-off string after 1023 character (missing patch file)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-2
changelog:
  - Bump version to 1.3.8.4-2
  - Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-3
changelog:
  - Bump version to 1.3.8.4-3
  - Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-4
changelog:
  - Bump version to 1.3.8.4-4
  - Resolves: Bug 1597384 - Async operations can hang when the server is running nunc-stans
  - Resolves: Bug 1598186 - A search with the scope "one" returns a non-matching entry
  - Resolves: Bug 1598718 - import fails if backend name is "default" 
  - Resolves: Bug 1598478 - If a replica is created with a bindDNGroup, this group is taken into account only after bindDNGroupCheckInterval seconds
  - Resolves: Bug 1525256 - Invalid SNMP MIB for 389 DS
  - Resolves: Bug 1597518 - ds-replcheck command returns traceback errors against ldif files having garbage content when run in offline mode


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-1
changelog:
  * Bump version to 1.3.9.1-1
  - Resolves: Bug 1438144 - [RFE] Include autounmembering feature in IPA
  - Resolves: Bug 1645359 - Rebase 389-ds-base in RHEL 7.7 to 1.3.9
  - Resolves: Bug 1561769 - [RFE] revise the "transient error" message in a replication agreement's last update status
  - Resolves: Bug 1563999 - Is it possible for Directory server to reject the current password only?
  - Resolves: Bug 1597202 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user
  - Resolves: Bug 1601241 - ns-slapd - Crash when using bak2db.pl to restore a single database
  - Resolves: Bug 1629055 - ds-replcheck unreliable, showing false positives
  - Resolves: Bug 1630513 - Customer requesting -y option for ds-replcheck
  - Resolves: Bug 1639192 - Request to add passwordSendExpiringTime in password policy objectclass
  - Resolves: Bug 1643587 - default of "nsslapd-errorlog-maxlogsperdir: 1" causing huge log files
  - Resolves: Bug 1643772 - ds-replcheck should validate suffix exists and it's replicated
  - Resolves: Bug 1647133 - Log warn instead of ERR when aci target does not exist.
  - Resolves: Bug 1653163 - certmap fails when Issuer DN has comma in name
  - Resolves: Bug 1602001 - cannot add cenotaph in read only consumer
  - Resolves: Bug 1589144 - shadowWarning is not generated if passwordWarning is lower than 86400 seconds (1 day)
  - Resolves: Bug 1600631 - In repicated topology a single-valued attribute can diverge
  - Resolves: Bug 1626375 - on-line re-initialization hangs
  - Resolves: Bug 1627846 - Contention on virtual attribute lookup
  - Resolves: Bug 1642838 - after certain failed import operation, impossible to replay an import operation
  - Resolves: Bug 1647099 - audit logs does not capture the operation where nsslapd-lookthroughlimit is modified 
  - Resolves: Bug 1648922 - during MODRDN referential integrity can fail erronously while updating large groups
  - Resolves: Bug 1652984 - Subtree password policy overrides a user-defined password policy
  - Resolves: Bug 1663829 - import task should not be deleted after import finishes to be able to query the status.
  - Resolves: Bug 1623935 - upgrade of 389-ds-base could remove replication agreements
  - Resolves: Bug 1622049 - db2bak.pl does not work with LDAPS, but ok with STARTTLS
  - Resolves: Bug 1633488 - fixup-memberof.pl -D cn=<> -w - -b <> -P LDAP fails with ldap_start_tls error
  - Resolves: Bug 1451460 - error messages during ldif2db after enabling encryption on an attribute
  - Resolves: Bug 1627512 - After RHEL 7.6 HTB update, unable to set nsslapd-cachememsize (RHDS 10) to custom value


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-11
changelog:
  - Bump version to 1.3.9.1-11
  - Resolves: Bug 1748198 - EMBARGOED CVE-2019-14824 389-ds-base: Read permission check bypass via the deref plugin
  - Resolves: Bug 1754831 - After audit log file is rotated, DS version string is logged after each update
  - Resolves: Bug 1763622 - Extremely slow LDIF import with ldif2db
  - Resolves: Bug 1763627 - ns-slapd crash on concurrent SASL BINDs, connection_call_io_layer_callbacks must hold hold c_mutex
  - Resolves: Bug 1749289 - DB Deadlock on modrdn appears to corrupt database and entry cache


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-13
changelog:
  - Bump version to 1.3.9.1-13
  - Resolves: Bug 1801693 - ns-slapd is crashing while restarting ipactl
  - Resolves: Bug 1801695 - LDAP server returning controltype in different sequence
  - Resolves: Bug 1801700 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  - Resolves: Bug 1801701 - etime displayed has an order of magnitude 10 times smaller than it should be
  - Resolves: Bug 1801702 - Regression: NSS has interop problems as server when using limited cipher list
  - Resolves: Bug 1801704 - Log the actual base DN when the search fails with "invalid attribute request"
  - Resolves: Bug 1801705 - Directory Server 10 not RFC 4511 compliant
  - Resolves: Bug 1801706 - Replace error by warning in the state machine defined in repl5_inc_run


author: Shakthi Kannan <shakthimaan [AT] fedoraproject dot org> 2.1.2-6
changelog:
  - Changed Group to System Environment/Libraries.
  - Remove executable permission from C files.
  - Created two separate patches for Makefile and manpage fixes.
  - Removed passing datarootdir from configure.


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.1.3-8
changelog:
  - Add %_isa to -devel base package dependency.
  - Headers get installed by "make install", copying them from the HTML
    doc headers dir is not necessary.
  - Configure build with --disable-static.
  - Drop unneeded spec stuff (buildroot def, removal, clean, pkgconfig dep).
  - Using %defattr is not needed anymore.
  - Deduplicate documentation files in unversioned docdir (#1001276).


author: Petr Machata <pmachata@redhat.com> - 2.2.2-29
changelog:
  - Tell GCC not to recognize builtins when compiling efence.c.
  - Resolves: #631316
  - Related: #632312


author: Philip Prindeville <philipp@fedoraproject.org> - 1.5.0-1
changelog:
  - Version bump to 1.5.0
  - Have GeoIP.dat be a symlink to the real data, and install the canned
    GeoIP.dat as GeoIP-initial.dat
  - Change config as per Boris' instructions to use 'lite' databases which are
    regularly updated.
  - Add pkgconfig (.pc) file into devel subpackage
  - Add cron support for refreshing the lite databases and make a separate
    subpackage.


author: Paul Howarth <paul@city-fan.org> - 1.5.0-5
changelog:
  - Make GeoIP.dat -> GeoIP-initial.dat symlink in %install, not %post,
    and don't %ghost it
  - Run geoipupdate silently in %post and cron job
  - Create empty database files for %ghost to work with old rpm versions
  - Don't try to use noarch subpackages on old rpm versions
  - Update %description to mention database updates
  - Drop outdated README.Fedora


author: Jan Safranek <jsafrane@redhat.com> - 1.5.0-7
changelog:
  - Don't download the database in %post (#1029807)
  - Don't download GeoLiteASNum as it's no longer provided.


author: Jan Safranek <jsafrane@redhat.com> - 1.5.0-10
changelog:
  - Added base IPv6 database to GeoIP package
  - Added GeoIP-data subpackage with all other databases (#1201857)


author: Michal Ruprich <mruprich@redhat.com> - 1.5.0-12
changelog:
  - Removed clean section
  - Resolves: #1589860 - Update GeoIP legacy databases
  - Resolves: #1409060 -  Missing symlink at the GeoIP-update package


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 6.7.8.9-7
changelog:
  - add aarch64 as a target by using 32 set by platform, instead of hardcoding the list of 64-bit arches (rhbz#1028584)


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 6.7.8.9-7
changelog:
  - add aarch64 as a target by using 64 set by platform, instead of hardcoding the list of 64-bit arches (rhbz#1028584)


author: Jan Horak <jhorak@redhat.com> - 6.7.8.9-15
changelog:
  - Added fix for CVE-2016-5118, CVE-2016-5240, rhbz#1269562,
    rhbz#1326834, rhbz#1334188, rhbz#1269553


author: Jai S <jsathyapalan@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els4
changelog:
  - CVE-2025-68618: fix DOS when processing a specially crafted malicious SVG file
  - CVE-2025-69204: fix DOS due to buffer overflow during image processing of a specially
    crafted SVG image


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els5
changelog:
  - CVE-2026-25798: fix NULL pointer dereference in ClonePixelCacheRepository
  - CVE-2026-24481: fix heap information disclosure in PSD handler
  - CVE-2026-25799: fix division-by-zero in YUV sampling factor validation
  - CVE-2026-26284: fix out-of-bounds read in PCD Huffman decoder
  - CVE-2026-25897: fix integer overflow in Sun decoder on 32-bit systems
  - CVE-2026-26066: fix infinite loop in IPTCTEXT profile writing
  - CVE-2026-26283: fix infinite loop in JPEG encoder extent binary search
  - CVE-2026-25795: fix NULL pointer dereference in ReadSFWImage
  - CVE-2026-25796: fix memory leak in ReadSTEGANOImage


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els6
changelog:
  - CVE-2026-25797: fix PostScript/HTML code injection via unsanitized filenames
  - CVE-2026-25982: fix heap out-of-bounds read in DICOM colormap decoder
  - CVE-2026-25968: fix stack buffer overflow in MSL opacity attribute processing
  - CVE-2026-25986: fix heap buffer overflow write in YUV 4:2:2 decoder
  - CVE-2026-25987: fix heap buffer over-read in MAP image decoder
  - CVE-2026-25970: fix signed integer overflow in SIXEL decoder
  - CVE-2026-23952: fix NULL pointer dereference in MSL comment/label handlers
  - CVE-2026-30883: fix heap buffer overflow in PNG profile writer
  - CVE-2026-25988: fix MSL stack index not updated causing memory leak
  - CVE-2026-27798: fix heap buffer over-read in WaveletDenoiseImage
  - CVE-2026-25965: fix path traversal bypassing security policy


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els9
changelog:
  - CVE-2026-28494: fix stack buffer overflow in morphology kernel parsing
  - CVE-2026-28691: fix uninitialized pointer dereference in JBIG decoder
  - CVE-2026-25989: fix off-by-one boundary check in CastDoubleToLong
  - CVE-2026-25985: fix memory allocation without limits in SVG decoder
  - CVE-2026-24485: fix infinite loop in PCD decoder
  - CVE-2025-66628: fix integer overflow in TIM decoder on 32-bit systems
  - CVE-2026-28693: fix integer overflow in DIB/BMP coder


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els12
changelog:
  - CVE-2026-33900: fix integer truncation in viff encoder leading to
    heap out-of-bounds write on 32-bit builds
  - CVE-2026-33905: fix out-of-bounds read in -sample operation via
    sample:offset define
  - CVE-2026-34238: fix integer overflow in despeckle operation causing
    heap buffer overflow on 32-bit builds
  - CVE-2026-40310: fix heap out-of-bounds write in JP2 encoder on
    invalid sampling index
  - CVE-2026-40311: fix heap use-after-free reading and printing values
    from an invalid XMP profile


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els13
changelog:
  - CVE-2026-42050: fix stack-based buffer overflow in XTileImage() triggered by a malicious MIFF file when right-clicking a tile to invoke the Load / Update menu item


author: Areg Gasparyan <agasparyan@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els14
changelog:
  - CVE-2026-46692: validate distributed pixel cache region on read and
    write to prevent a heap buffer over-write


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els15
changelog:
  - CVE-2026-46559: fix heap buffer overflow (out-of-bounds write) in JP2
    encoder by bounding tcp_distoratio and tcp_rates option parsing to array
    extents


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els16
changelog:
  - CVE-2026-49218: fix denial of service in DICOM reader by rejecting an
    image decoded with zero columns or rows


author: Viktor Borzov <vborzov@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els17
changelog:
  - CVE-2026-53460: fix unbounded memory allocation in AcquireAlignedMemory() leading to out-of-memory denial of service


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els18
changelog:
  - CVE-2026-42326: fix out-of-bounds read of a single byte when writing an
    IPTC output file
  - CVE-2026-45624: fix out-of-bounds over-read during polynomial distortion
    with crafted arguments
  - CVE-2026-46521: fix out-of-bounds write in the MIFF encoder when using
    LZMA compression
  - CVE-2026-48734: fix stack overflow via a crafted MVG file by adding a
    recursion-depth check in class-macro expansion
  - CVE-2026-48994: fix heap buffer over-write in the MAT decoder on 32-bit
    systems due to a missing return-value check


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els19
changelog:
  - CVE-2026-33901: fix heap buffer overflow (out-of-bounds write) in the MVG
    decoder when copying an over-long token into a fixed-size buffer
  - CVE-2026-33908: fix stack exhaustion denial of service in DestroyXMLTree()
    by imposing a recursion depth limit on deeply nested XML
  - CVE-2026-45031: fix list-length resource policy bypass in the PSD decoder
    by validating the layer count against the list limit
  - CVE-2026-45664: fix excessive resource use in the MNG coder by bounding the
    number of LOOP/ENDL operations
  - CVE-2026-46520: fix heap out-of-bounds write in the IPL coder when writing
    multiple images with differing dimensions
  - CVE-2026-46522: fix infinite loop (CPU exhaustion) in the MIFF decoder on a
    crafted file
  - CVE-2026-46523: fix heap use-after-free in the MSL coder by disabling blob
    support for the MSL format


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els20
changelog:
  - CVE-2026-56361: out-of-bounds access in AcquireKernelBuiltIn() when a user
    kernel offset equals the kernel width or height
  - CVE-2026-56367: heap overflow from an unchecked rows*channels multiplication
    in the PSD RLE size reader
  - CVE-2026-56368: memory leak of the quantum info buffer in the raw pixel
    writers (bgr, cmyk, gray, rgb, ycbcr) on output blob reopen failure
  - CVE-2026-56370: out-of-bounds write in ConnectedComponentsImage() via crafted
    connected-components:keep and :remove index ranges
  - CVE-2026-56378: out-of-bounds read in the PCD Huffman decoder from an
    unbounded output pointer


author: Viktor Borzov <vborzov@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els21
changelog:
  - CVE-2025-43965: fix incorrect buffer size calculation (CWE-131) in the MIFF
    decoder caused by image depth not being resynchronized after SetQuantumFormat


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els22
changelog:
  - CVE-2026-61857: check ResizeQuantumMemory() return value in ParseEntities()
    (magick/xml-tree.c) to avoid a NULL-pointer dereference
  - CVE-2026-61863: destroy the huffman_image clone on temp-file open failure in
    WriteGROUP4Image() (coders/tiff.c) to fix a memory leak
  - CVE-2026-61870: relinquish pixel_info before throwing on colormap allocation
    failure in WriteVIFFImage() (coders/viff.c) to fix a memory leak


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 6.9.10.68-7.0.3.tuxcare.els23
changelog:
  - CVE-2026-61866: fix a memory leak (CWE-401) in the JNG encoder
    (WriteOneJNGImage) when the blob for the grayscale JPEG alpha channel
    cannot be opened


author: Charles R. Anderson <cra@wpi.edu> - 1.0.4-4
changelog:
  - For Judy1 man page fix, patch Makefile.{am,in} instead of
    relying on autotools to regenerate the latter
  - Add README.Fedora with upstream's license explanation


author: Paul Howarth <paul@city-fan.org> - 1.0.5-1
changelog:
  - Update to 1.0.5
    - Added proper clean targets to enable multiple builds
    - Added examples directory
    - Correctly detects 32/64-bit build environment
    - Allow explicit configure for 32/64-bit environment
  - Cosmetic spec file clean-ups


author: Paul Howarth <paul@city-fan.org> - 1.0.5-8
changelog:
  - Fix some code with undefined behavior
  - Build with -fno-strict-aliasing
  - Disable various compiler tree optimizations that trigger reproducible
    crashes in gtkwave without generating compiler warnings (#1064090)


author: Kalev Lember <kalevlember@gmail.com> - 0.7.990-3.git20130515
changelog:
  - Install the libmm-glib.so symlink in -glib-devel
  - Include the /usr/share/libmm-glib directory in -glib-devel
  - Make sure -glib-devel subpackage depends on the base -glib package


author: Dan Williams <dcbw@redhat.com> - 0.7.991-1.git20130607
changelog:
  - Update to 0.7.991 snapshot
  - Fix SMS validity parsing
  - Allow registration changes to 'searching' without disconnecting
  - Fix reading SMS messages from some QMI-based devices
  - Increase connection timeout for Novatel E362
  - Fix PIN retries checking when unlocking Ericsson devices
  - Better handling of supported and preferred modes (eg 2G, 3G, 4G preference)


author: Dan Williams <dcbw@redhat.com> - 0.7.991-2.git20130710
changelog:
  - Handle PNP connected devices
  - Fall back to AT for messaging if QMI modem doesn't support the WMS service
  - Fix IPv6 bearer creation for HSO devices
  - Fix detection of supported modes on Icera-based modems
  - Fix handling of some Icera-based modems with limited capability ports
  - Add support for Olivetti Olicard 200


author: Tom Lane <tgl@redhat.com> 1.2.3-1
changelog:
  - Update to final release of 1.2.3
  Resolves: #660484
  - Rebuild was needed anyway for mysql ABI break (no more libmysqlclient_r)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-1.git20141107.git289f7881
changelog:
  - core: DHCP address lifetime expires before it can be updated (rh #1139326)
  - core: apply static IPv6 configuration while waiting for an RA (rh #1101809)
  - core: fix activation of IP configurations on unmanaged interfaces (rh #1067299)
  - core: serialize dispatcher state changes (rh #1061212)
  - core: increased dispatcher timeout and blocking events (rh #1048345)
  - core: add support for "lacp_rate" bonding option (rh #1061702)
  - core: better handle slave state changes done externally (rh #1066706)
  - core: fix checking whether NM is running for root clients (rh #1096772)
  - ifcfg-rh: ignore tailing spaces (rh #1100336)
  - cli: fix warning setting DCB application priority (rh #1080510)
  - tui: fix inverted 'Require IPvX addressing' checkbox (rh #1108839)
  - tui: fix entry of some IP address formats (rh #1090422)
  - tui: fix disabled <Add> button in IP configuration (rh #1131434)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-4.git20141114.669f74b8
changelog:
  - core: wait for IPv6LL address before starting DHCPv6-only configurations
  - core: fix race with kernel IPv6LL when deactiving connections that ignored IPv6
  - cli: fix waiting for activation success/failure
  - core: silence warning about bad ifindex for non-netdev devices
  - core: fix default route ordering issues
  - core: don't change firewall zone for assumed devices (rh #1098281)
  - libnm: fix translations in clients and non-UTF-8 encodings
  - tui: fix unsetting the gateway (rh #1163896)
  - cli/tui: only handle secrets for connection being activated


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-5.git20141118.646f335d
changelog:
  - cli: fix showing secrets when editing connections
  - cli: ignore timestamp when comparing connections (rh #1122995)
  - core: fix a few issues with the internal DHCP client (rh #1066700)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-6.git20141125.f32075d2
changelog:
  - tui: fix missing IPv4/IPv6 method popup (rh #1167710)
  - core: inherit parent managed state for VLAN devices (rh #1114681)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-3.git20140313
changelog:
  - core: read and assume team port configuration (rh #1035859)
  - core: looser IPv6 existing configuration assumption (rh #1073824)
  - core: follow network interface renames (rh #907836)
  - core: add support for VXLAN interfaces (rh #1066705)
  - wifi: fix connections to hidden SSIDs (rh #1069844)
  - cli: allow using master connection name when creating slaves (rh #1057494)
  - ifcfg-rh: fix reading and writing of Team port configurations (rh #1074160)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-4.git20140313
changelog:
  - core: fix startup auto-activation of slow carrier detect interfaces (rh #1076592)
  - core: align default bridge priority with kernel defaults (rh #1073664)


author: Dan Winship <danw@redhat.com> - 1:0.9.9.1-7.git20140313
changelog:
  - ifcfg-rh: give a better error on "permission denied" (rh #1070617)
  - tui: allow cancelling with "Esc" from "nmtui connect" (rh #1080059)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-8.git20140326
changelog:
  - core: fix management of some static configurations from initramfs (rh #1077743)
  - ifcfg-rh: add support for alias files (rh #1067170)
  - core: additional fixes for Data Center Bridging (DCB) (rh #799241)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-11.git20140326
changelog:
  - core: additional fixes for Data Center Bridging (DCB) (rh #799241) (rh #1081991)
  - core: ensure /etc/resolv.conf has the right SELinux label (rh #1070829)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-12.git20140326
changelog:
  - core: fix master interface DHCP handling if ignore-carrier is set (rh #1083624)
  - core: fix startup state not finishing correctly (rh #1084554)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-13.git20140326
changelog:
  - core: ignore IPv6 cache routes to fix initial connection generation (rh #1083153)
  - core: ensure slow DHCP emits 'dhcp4-change' and 'dhcp6-change' dispatcher events (rh #1091296)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.9.9.1-17.git20140326
changelog:
  - core: fix connection matching generally and for s390 as well (rh #1083196)
  - dhcp: fix DHCPv6 address lifetime handling (rh #1086237)


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-5.git20150107.1ea95cd3
changelog:
  - build: remove -bluetooth and -wwan Requires to prevent unwanted updates (rh #1066690)
  - build: remove erroneous libnm/libnm-devel dependencies


author: Thomas Haller <thaller@redhat.com> - 1:1.0.0-7.git20150107.1ea95cd3
changelog:
  - platform: fix handling of routes with special metric (rh #1172780)
  - ifcfg-rh: add reading and writing of route-metric property


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-9.git20150121.b4ea599c
changelog:
  - build: fix NetworkManager-libnm and old NetworkManager-glib conflict (rh #1066690)
  - core: accept numeric bond options (rh #1171009) (rh #1133544)
  - core/libnm: better validate setting properties (rh #1182567)
  - core: add dispatcher script to support policy based routing (rh #1160013)


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-13.git20150121.b4ea599c
changelog:
  - core: remove IPv6LL address when deactivating managed devices (rh #1184997)
  - core: recognize external IP config earlier on startup
  - core: fix bridge default metric


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-22
changelog:
  - platform: fix detection of s390 CTC device (rh #1272974)
  - core: fix queuing activation while waiting for carrier (rh #1079353)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.6-25
changelog:
  - vpn: cancel the secrets request on agent timeout (rh #1272023)
  - vpn: cancel the connect timer when vpn reconnects (rh #1272023)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-4
changelog:
  - settings: clear unsaved flag on new connections (rh #1525078)
  - platform-linux: reload qdiscs and tfilters after removing them (rh #1527197)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-5
changelog:
  - wwan: add default route even if modem didn't return a gateway (rh #1527934)
  - dhcp: fix assertion failure for dhcp-client-id (rh #1531173)


author: Thomas Haller <thaller@redhat.com> - 1:1.10.2-6
changelog:
  - core: use distinct route-metric to keep connectivity on first activated device (rh #1505893)
  - core: fix enabling connectivity-check-enabled via D-Bus (rh #1534477)
  - core: fix invalid assertion deleting volatile connection (rh #1506552)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-7
changelog:
  - po: import translations (rh #1481186)
  - device: increase carrier wait time to 6 seconds (rh #1520826)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-10
changelog:
  - device: skip IP configuration phase for external devices (rh #1530288)
  - platform: fix crash during route-get call (rh #1534721)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-11
changelog:
  - ovs-interface: avoid starting ip configuration twice (rh #1540063)
  - libnm-core: ensure alignment of team.config and other team properties (rh #1533830)
  - nmcli: clear link-watchers before adding the new ones (rh #1533926)
  - libnm-core: update team.runner description (rh #1533799)
  - libnm-core: team: fix runner sys_prio default value (rh #1533810)
  - libnm: avoid a symbol clash with json-glib (rh #1535905)
  - libnm-core: team: add support to runner "random" (rh #1538699)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-12
changelog:
  - ppp: don't start IPv6 configuration on the device (rh #1515829)
  - device: avoid setting the IPv4 rp_filter (rh #1492472)
  - nmcli: team: clear runner-tx-hash before adding new hashes (rh #1541922)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-14
changelog:
  - manager: retry activating devices when the parent becomes managed (rh #1553595)
  - manager: allow autoconnect-slaves to reconnect the same connection (rh #1548265)
  - manager: fix starting teamd after service restart  (rh #1551958)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-9
changelog:
  - device: don't change MTU unless explicitly configured (rh #1460760)
  - core: don't remove external IPv4 addresses (rh #1459813)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-11
changelog:
  - core: fix wrongly delaying startup-complete for unrealized devices (rh#1498807)
  - core: fix unfreezing signals when unrealizing device fails (rh#1498755)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.0-0.1.git20171024.b16c853b
changelog:
  - Update to a 1.10.0 snapshot:
  - core: fix connection auto-activation after slave failure (rh #1310676)
  - bridge: introduce a bridge.group-forward-mask connection property (rh #1358615)
  - ifcfg-rh: fix write of 802.1X EAP-LEAP connections (rh #1374660)
  - vlan: fix setting MTU value (rh #1414901)
  - core: support multiple routing tables (rh #1436531)
  - ipv6: support multiple default routes (rh #1445417)
  - core: extend D-Bus API to better export active connection state (rh #1454883)
  - nmcli: fix crash (rh #1458311)
  - device: avoid touching IPv6 on external connections without IPv6 conf (rh #1462260)
  - core: downgrade warning messages about missing parent devices (rh #1490157)
  - device: fix delay startup complete for unrealized devices (rh #1498807)
  - device: fix frozen notify signals on unrealize error path (rh #1498755)
  - tui: improve tracking of activation state (rh #1500651)
  - ifcfg-rh: allow updates to connections with routing rule files (rh #1384799)
  - core: fix taking over external connection on modification (rh #1462223)
  - bond: ignore miimon option only when it is zero (rh #1463077)
  - core: don't re-add routes that already exist (rh #1470930)
  - tui: guess the prefix length (netmask) based on network class (rh #1474295)
  - dhcp: fix dhcp over Infiniband when using the internal client (rh #1477678)
  - device: extend wait time for carrier after MTU change (rh #1487702)
  - cli: wifi: connect with PSK when the AP supports WPA-PSK and WPA-EAP (rh #1492064)
  - core: fixed memory leak in dhcp code (rh #1461643)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.0-0.2.rc1
changelog:
  - Update to first Release Candidate of NetworkManager 1.10
  - added basic OpenVSwitch support (rh #1470282)
  - fixed race condition in the nmcli secret agent (rh #1438476)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-1
changelog:
  - Update to upstream release 1.10.2
  - all: added support for onlink route attribute (rh #1428334)
  - device: don't necessarily fail the connection when ipv4 DAD fails (rh #1508001)
  - device: update device mtu from ip interface platform when required (rh #1460217)
  - device: extend carrier lost defer time after MTU change (rh #1487702)
  - ifcfg-rh: persist the wep key type (rh #1518177)
  - settings: introduce an Update2() D-Bus method (rh #1401515)


author: Thomas Haller <thaller@redhat.com> - 1:1.12.0-1
changelog:
  - Update to upstream 1.12.0 release (rh #1592311)
  - device: improve MTU handling for VLAN (rh #1586191)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-2
changelog:
  - device: disable rp_filter handling (rh #1593194)
  - ibft: grant required CAP_SYS_ADMIN capabilities (rh#1596954)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.12.0-3
changelog:
  - cli: remove assertion in nmc_device_state_to_color() (rh #1614691)
  - po: import Japanese translation (rh #1569438)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-6
changelog:
  - dns: dnsmasq: avoid crash when no reverse domains exist (rh #1628576)
  - initscripts: fix ownership of ifup/ifdown executables (rh #1626517)
  - cli: fix parsing vpn secrets from password file (rh #1628946)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-7
changelog:
  - manager: accept non-null device for VPN activations (rh #1641174)
  - drop dependency of NetworkManager-ovs on openvswitch (rh #1633190)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-10
changelog:
  - manager: ignore ovs-system master when assuming connections (rh #1676551)
  - device: do ARP announcements only after masters have a slave (rh #1678796)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-14
changelog:
  - manager: retry activating devices when the parent becomes managed (rh #1553595)
  - manager: allow autoconnect-slaves to reconnect the same connection (rh #1548265)
  - manager: fix starting teamd after service restart (rh #1551958)


author: Thomas Haller <thaller@redhat.com> - 1:1.12.0-0.1
changelog:
  - Update to upstream release 1.11.90 (release candidate) (rh #1592311)
  - libnm: properly handle cancelling of async operations (rh #1555281)
  - libnm: support handling checkpoints (rh #1496739)
  - core: fix blocking/not-blocking autoconnect related to missing secrets (rh #1553113)
  - core: rework and improve IPv4 address collission detection (rh #1507864)
  - wifi: fix timeout handling for supplicant when no secrets provided (rh #1575501)
  - macsec: enable sending SCI by default and make it configurable (rh #1588041)
  - ethernet: support announcing duplex/speed in combination with autonegotiation (rh #1487477)
  - wwan: improve failure reason for unsupported IP methods (rh #1459529)
  - tun: use netlink kernel API for tun devices if available (rh #1547213)
  - ovs: fix assertion during shutdown of NetworkManager (rh #1543871)
  - dhcp: improve handling DHCP timeouts (rh #1573780)
  - dhcp: support specifying ipv6.dhcp-duid (rh #1414093)
  - dhcp: support generating ipv4.dhcp-client-id based on MAC/stable-id
  - dns: avoid updating resolv.conf when exiting (rh #1541031)
  - ifcfg-rh: fix IPv4 settings in combination with method "shared" (rh #1519299)
  - ifcfg-rh: fix handling unset Wi-Fi mode (rh #1549972)
  - iface-helper: fix invalid reentrant call to platform (rh #1546656)
  - doc: various improvments to documentation (rh #1543832)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.16.2-0.2.20190328git8ec0954570
changelog:
  - Update to a 1.16 snapshot:
  - device: apply static addresses immediately for DHCPv4 method (rh #1369905)
  - man/openvswitch: advise to use "master" instead of "conn.master" (rh #1519176)
  - manager: don't update ifindex of existing devices (rh #1542366)
  - ovs-interface: allow re-activating an already active interface (rh #1543557)
  - ovs: avoid reactivating devices when their master gets removed (rh #1540218)
  - cli: avoid possible crash on device disconnect (rh #1546061)
  - cli: fix upping of the connection after it was updated (rh #1546805)
  - device: restore IPv6 addresses when the link comes back up (rh #1548237)
  - device: set token only after router discovery was started (rh #1560652)
  - team: make teamd log to syslog (rh #1596917)
  - device: fix a possible crash on generating a connection (rh #1631741)
  - ovs: remove NetworkManager-ovs dependency on openvswitch (rh #1633190)
  - dhcp/internal: handle multiple Router DHCP options (rh #1634657)
  - cli: fix a possible crash when removing devices (rh #1639208)
  - device: avoid taking down link to change MAC address (rh #1639274)
  - libnm: fix crash in activate_info_complete() when cancelling (rh #1642625)
  - dhcp6: make sure we have enough space for the DHCP6 option header (rh #1643985)
  - lldp: fix parsing of vlan-name attribute (rh #1652210)
  - team: add support for 'vlanid' link-watchers property (rh #1652931)
  - manager: ignore ovs-system master when assuming connections (rh #1676551)
  - device: do ARP announcements only after masters have a slave (rh #1678796)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-0.2.20190404git9a8fe5f339
changelog:
  - Update to a 1.18 snapshot:
  - clients: only ask secrets for settings that require them (rh #1506536)
  - checkpoint: remove a device from checkpoint if it disappears (rh #1578335)
  - lldp: support more VLAN TLVs (rh #1652211)
  - bridge: add VLAN filtering support (rh #1652910)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-0.3.20190408git43d9187c14
changelog:
  - infiniband: allow large MTU (rh #1534869) (rh #1653494)
  - sr-iov: tolerate lack of sriov_drivers_autoprobe sysfs property (rh #1695093)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.18.0-0.4.20190408git43d9187c14
changelog:
  - keyfile: ensure keyfiles don't get a .nmconnection file name extension (rh#1697858)
  - dhcp: preserve legacy dhcp-client-id default for internal dhcp (rh #1695723)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.0-1
changelog:
  - Update to 1.18.0 release
  - cli: fix crash handling gsm secrets (rh #1698495)
  - rules: fix duplicate policy routing rules (rh #1652653)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-2
changelog:
  - cli: hide certificate blobs unless --show-secrets is passed (rh #1702199)
  - device: fix reapply of MTU (rh #1702657)
  - settings: fix failed assertion when adding connections (rh #1707261)
  - core: ensure software devices are managed when networking gets enabled (rh #1701585)
  - device: restore IPv6 configuration on link up (rh #1548237)
  - dbus: fix return value for LoadConnection and avoid assertion for relative path (rh #1708660)
  - core: fix file permissions of /var/lib/NetworkManager/secret_key (rh #1709849)
  - tc: add suppor for mired action an fq_codel qdisc (rh #1546802)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-3
changelog:
  - team: don't kill teamd for external devices (rh #1711952)
  - ifcfg-rh: use PKCS#12 private key also as client certificate in reader (rh #1714610)
  - po: update translations (rh #1689962)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.0-4
changelog:
  - cli: don't wait forever in the editor on update connection failure (rh #1702203)
  - team: fix setting validate_active, validate_inactive and send_always flags (rh #1720153)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.4-1
changelog:
  - Update to 1.18.4 release
  - cli: fix bash completion for slave-types (rh #1654062)
  - core: improve handling of policy routing rules when restarting daemon (rh #1696881)
  - ifcfg-rh: preserve existance of ethernet setting in profile (rh #1703960)
  - tui: only add bond options to profile that are supported by tui (rh #1715720)
  - cli: fix resetting default value for properties (rh #1715887)
  - core: fix detecting parent device by connection's UUID (rh #1716438)
  - core: fix setting IPv6 route options and destination (rh #1727193)
  - core: support more "arp_validate" bond options (rh #1730793)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.4-2
changelog:
  - dhcp: include conditionals from existing dhclient configuration (rh #1758550)
  - core: fix sending ARP announcements (rh #1767681)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.6-1
changelog:
  - Update to 1.18.6 release
  - cli: unset "ipv[46].never-default" when setting "ipv[46].gateway" (rh #1785039)
  - core: keep MTU of MACsec and MAC-VLAN interfaces in sync with parent (rh #1723690)
  - core: forbid autoactivation of parent when it is blocked by user request (rh #1765566)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.6-2
changelog:
  - vpn: gracefully handle invalid routes from VPN plugins
  - workaround g_strtoll() failing with EAGAIN (rh #1797915)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-1
changelog:
  - Update to 1.18.8 relase
  - ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841397, CVE-2020-10754)
  - ifcfg-rh: handle 802-1x.pin properties.


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-2
changelog:
  - Backport OVS related fixes (rh #1871935)
  - ovs: support changing the MTU of ovs interfaces (rh #1820052)
  - ovs: fix race condition in setting MAC address (rh #1852106)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-2
changelog:
  - ifcfg-rh: clear IP settings for slave connections (rh#1368761)
  - ifcfg-rh: accept TEAM connections also without DEVICETYPE setting (rh#1367180)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-3
changelog:
  - wifi: fix activation failure due to error changing MAC address (rh#1371623)
  - core: fix wrong source interface for PropertiesChanged D-Bus signal (rh#1371920)
  - team: restore validation of JSON configuration (rh#1371967)
  - device: manage firewall zone for assumed persistent connections (rh#1366288)
  - device: don't let external changes cause a release of the slave (rh#1357738)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-5
changelog:
  - libnm,nmtui: fix handling empty cloned-mac-address property (rh#1372799)
  - ibft: grant required CAP_SYS_ADMIN capabilities (rh#1371201)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-7
changelog:
  - wifi: another fix activation failure due to error changing MAC address (rh#1371623, rh#1374023)
  - dhcp: fix race condition that may cause lost lease events and DHCP timeouts (rh#1373276)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-8
changelog:
  - libnm: fix crash in nm_vpn_plugin_info_list_get_service_types() (rh#1374526)
  - device: wait for MAC address change before setting up interface (rh#1371623, rh#1374023)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.4.0-9
changelog:
  - clients: handle secret requests only for current connection (rh#1351272)
  - device: fix crash reapplying connection to slave devices (rh#1376784)
  - cli: fix autocompletion after ifname (rh#1375933)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.4.0-16
changelog:
  - libnm-core: remove INFERRABLE flag from dhcp-hostname property (rh#1421082)
  - core: honor order of IP addresses from configuration (rh#1394500)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.8.0-0.2.git20170215.1d40c5f4
changelog:
  - Update to a 1.7.1 snapshot:
  - rebase NetworkManger package to new upstream 1.8.x version (rh #1414103)
  - device: introduce support to ipv6.method=shared (rh #1256822)
  - device: add support to vlan on virtual devices (rh #1312359)
  - core/supplicant: introduce support to MACsec connections (rh #1337997)
  - core: allow enforcing of 802-3 link properties (rh #1353612)
  - manager: allow a slave connection which has slaves to autoactivate them (rh #1360386)
  - cli: check the active-connection state to detect activation failure (rh #1367752, rh #1384937)
  - cli: remove the separate thread when in editor mode to fix races (rh #1368353)
  - ifcfg-rh: write the master device name even if the master property is an UUID (rh #1369008)
  - ifcfg-rh: higly improved parsing of ifcfg files (rh #1369380)
  - checkpoint: improved the checkpoint/rollback functionality (rh #1369716)
  - core: core: don't unmanage devices on shutdown (rh #1371126, rh #1378418)
  - cli: properly set multiple addresses in questionnaire mode (rh #1380165)
  - manager: keep scheduling connectivity check if there is a default active connection (rh #1386106)
  - device: allow custom MAC address on bond and bridge interfaces (rh #1386872)
  - core: avoid race reading permanent MAC address before udev initialized (rh #1388286)
  - ifcfg-rh: fix import of 802.1x connections with empty EAP-TLS identity (rh #1391477)
  - libnm-core: remove INFERRABLE flag from dhcp-hostname property (rh #1393997)
  - platform: preserve the order when multiple ip addresses are present (rh #1394500)
  - device: avoid a crash when both IPv4 and IPv6 configurations fail (rh #1404148)
  - dns: export dns state to DBUS (rh #1404594)
  - ppp: moved PPP support into a separate package (rh #1404598)
  - dns: don't apply DNS configuration coming from non-active devices (rh #1405431)
  - vlan: inherit default MTU from parent device (rh #1414186)
  - bond: fix crash when reading from sysfs 'NULL' (rh #1420244)
  - build: rebuild with correct hardening flags (rh #1420771)
  - platform: downgrade warning about failure to detect kernel support to debug (rh #1421019)
  - dns: change behavior for "rc-manager=symlink" to preserve "/etc/resolv.conf" as file (rh #1367551)
  - libnm: order the property updates (rh #1417292)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc1
changelog:
  - Update to first Release Candidate of NetworkManager 1.8
  - nmcli: speedup with large numbers of VLANs (rh #1231526)
  - dns: avoid cleaning resolv.conf on exit if not needed (rh #1344303, rh #1426748)
  - device: bond: implement connection reapply (rh #1348198)
  - platform: add support for some route options (rh #1373698)
  - core: add mtu property to cdma and gsm settings (rh #1388613)
  - nmcli: fix output in terse mode (rh #1391170)
  - improve handling of unmanaged/assumed devices (rh #1394579)
  - policy: make DHCP hostname behaviour configurable (rh #1405275)
  - manager: ensure proper disposal of unrealized devices (rh #1433303)
  - nmcli: fix connection down (rh #1433883)
  - libnm-glib: fix memory leak (rh #1433912)
  - device: deal with non-existing IP settings in get_ip_config_may_fail() (rh #1436601)
  - nmcli: make --ask and --show-secrets global options (rh #1351263)
  - nmcli: improve error handling (rh #1394334)
  - device: apply a loose IPv4 rp_filter when it would interfere with multihoming (rh #1394344)
  - core: make connectivity checking per-device (rh #1394345)
  - manager: sort slaves to be autoconnected by device name (rh #1420708)
  - policy: add support to configurable hostname mode (rh #1422610)
  - team: support the ethernet.cloned-mac-address property (rh #1424641)
  - ifcfg-rh: fix reading team slave types of vlan type (rh #1427482)
  - default-route-manager: alyways force a sync of the default route (rh #1431268)
  - device: fail DHCPv6 if a link-local address is not present (rh #1432251)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc2
changelog:
  - Update to second Release Candidate of NetworkManager 1.8
  - device: don't update disconnected devices routes after connectivity check (rh #1436978)
  - ifcfg-rh: also check BONDING_OPTS to determine the connection type (rh #1434555)
  - nmcli: fix nmcli con edit crash (rh #1436993)
  - nmcli: fix nmcli con down (rh #1436990)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc3
changelog:
  - Update to third Release Candidate of NetworkManager 1.8
  - device: leave device up when setting it as unmanaged by user (rh #1371433)
  - core: properly track manager, route manager and default route manager references (rh #1440089)
  - vpn: fix a crash on disconnect (rh #1442064)
  - cli: fix hang on connection down (rh #1422786)
  - vpn: fix early error handling on failed activations (rh #1440077)
  - core: only persist explicit managed state in device's state file (rh #1440171)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-1
changelog:
  - Update to upstream release 1.8.0
  - device: support dummy devices (rh#1398932)
  - core: support attaching user-data to connection profiles (rh#1421429)
  - core: fix allowing FQDN in dhcp-hostname setting (rh#1443437)
  - core: fix configuring firewall while device is activating (rh#1445242)
  - core: don't block activation without carrier for IPv6 DAD (rh#1446367)
  - tui: force writing master key to ifcfg file when editing connection (rh#1425409)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-2
changelog:
  - core: fix persisting managed state of device (rh #1440171)
  - proxy: fix use-after-free (rh #1450459)
  - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-3
changelog:
  - dhcp: don't add route to DHCP4 server (rh #1448987)
  - libnm: fix NUL termination of device's description (rh #1443114)
  - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
  - core: fix device's UDI property on D-Bus (rh #1443114)
  - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-4
changelog:
  - device: update external configuration before commit (rh #1449873)
  - bluetooth: fix crash on connecting to a NAP (rh #1454385)
  - device: release removed devices from master on cleanup (rh #1448907)
  - core: activate slaves using ifindex order by default (rh #1452585)
  - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
  - po: update translations (rh #1382625)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-5
changelog:
  - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
  - tui: fix crash during connect (rh #1456826)
  - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-6
changelog:
  - connectivity: fix periodic connectivity check (rh #1458399)
  - bond: improve option matching on daemon restart (rh #1457909)
  - device: fix touching device after external activation (rh #1457242)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-7
changelog:
  - bond: fix crash comparing mode while generating bond connection (rh #1459580)
  - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
  - device: persist nm-owned in run state (rh #1376199)
  - device: fix assuming master device on restart (rh #1452062)
  - device: apply route metric penality only when the default route exists (rh #1459604)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-8
changelog:
  - cli: fix output of iface in overview output (rh#1460219)
  - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
  - cli: remove spurious device names from wifi subcommands output (rh#1460527)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc3
changelog:
  - Update to third Release Candidate of NetworkManager 1.8
  - device: fix regressions in assuming devices on carryover from initrd (rh #1443878)
  - device: add support for SRIOV num_vfs (rh #1398934)
  - device: leave device up when setting it as unmanaged by user (rh #1371433)
  - core: properly track manager, route manager and default route manager references (rh #1440089)
  - route: properly deal with routes with non-empty host parts (rh #1439376)
  - vpn: fix a crash on disconnect (rh #1442064)
  - cli: fix hang on connection down (rh #1422786)
  - cli: fix interactive edit of bond slaves (rh #1440957)
  - vpn: fix early error handling on failed activations (rh #1440077)
  - core: only persist explicit managed state in device's state file (rh #1440171)


author: Avesh Agarwal <avagarwa@redhat.com> - 0.9.8.0-2
changelog:
  - Fixed rhbz#921061
  - Fixed rhbz#999353
  - Fixed rhbz#1035786
  - Fixed rhbz#1014830
  - Fixes 1035786 (and its duplicate 1040924)
  - Fixed 926225
  - Fixed dependency to libreswan.
  - Created a new sub package NetworkManager-openswan-gnome
  - Various other spec file fixes.
  - Additional code changes are as follows:
  - Fixed an issue where proper network stack is not loaded unless
    _stackmanager is run before starting pluto daemon service.
  - Fixed the termination operation of pluto daemon to comply with
    libreswan changes.
  - Fixed various debug messages.
  - Fixed initiation of pluto daemon by this plugin to reflect the
    changes in libreaswan.
  - Fixed defaults values for more parameters to help the VPN
    connection stay more reliable.
  - Rewrote pluto watch API which watches the pluto process for its status.
    Fixed memory leak issues as not all child processes were reaped correctly.
    Also g_spwan_close_pid was not being called after children were reaped.
    Also modified debugs and added more to help with debugging in the future.
  - Fixed an issue where nm-openswan service is searching for ipsec binary in
    both /sbin and /usr/sbin leading to same operation twice, as /sbin is just
    symlink to /usr/sbin, so removed /sbin from the search paths.
  - Fixed some libreswan related macro changes.
  - Fixed netmask issue when sending IP information to the nm openswan
    plugin service.
  - Fixed the current code as it does not set the default route field
    NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT when sending VPN information
    to nm-openswan plugin. This fix sets the field to TRUE.
  - Fixed some issues found by coverity scan.
  - Fixed an issue where writing configuration on stdin should not end with
    \n as it gives error. It used to work previously, but not with latest
    NetworkManager versions.
  - libreswan related fixes, as some macros have been modified after forking
    to libreswan from openswan.
  - openswan/libreswan does not provide tun0 interface, so fixed the code
    where it sends tun0 interface.
  - Fix prcoessing of nm-openswan-dialog.ui file and added more error notifications.
  - Fixed dead code based on coverity scan.
  - Fixed gnomekeyring lib dependencies.
  - Fixed Networkmanager and related lib dependencies.
  - Fixed gtk label max width issue by setting it to 35.
  - NM-openswan was missing support for nm-openswan-auth-dialog.desktop.in.in.
    So added a new nm-openswan-auth-dialog.desktop.in.in, and modified related
    Makefile and configure.ac files.


author: Lubomir Rintel <lrintel@redhat.com> - 1.2.0-0.1.beta3
changelog:
  - Update to 1.2-beta3:
  - Added support for main exchange type (rh #1292912)
  - A device libreswan is unable listen on no longer aborts connection (rh #1285367)
  - Added import/export support (rh #1129878)
  - Replace NetworkManager-openswan (rh #1264552)


author: Thomas Haller <thaller@redhat.com> - 1.2.4-1
changelog:
  - Update to 1.2.4 release
  - Move base VPN plugin library to base libreswan package
  - Don't require nm-connection-editor anymore


author: Nicolas Chauvet <kwizart@gmail.com> - 1.7.1-1
changelog:
  - Update to 1.7.1

  -* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.0-5
  -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild


author: Jan Safranek <jsafrane@redhat.com> - 2.0.19-2
changelog:
  - Updated RPM scriptlets with latest systemd-rpm macros (#850246)
  - Fixed fedora-review tool complaints


author: Ledvinka Ales <aledvink@redhat.com> - 2.0.19-5
changelog:
  - Support aarch64 by replicating release toolchain.
  - Configuration subpackage with kernel probed wildcard module aliases.
    as workaround for bz#961878 and fesco#1110
  - Man pages symlinks same as bin symlinks.
  - ipmi_ui command help argument.
  - ipmilan missing options.
  - Fixed build requirements.


author: Ledvinka Ales <aledvink@redhat.com> - 2.0.19-7
changelog:
  - Hint compilation to avoid strict aliasing and prevent type-punned pointer issues.
  - Fix rPath regression for OpenIPMI-perl library.


author: Boris Ranto <branto@redhat.com> - 2.0.19-12
changelog:
  - New release
  - Move OpenIPMI modprobe conf to /usr/lib/modprobe.d/ (#1195289)
  - Avoid warning on update/removal (#1256798)
  - Stop manually creating and shipping /var/run/OpenIPMI (#1296560)


author: Tom Lane <tgl@redhat.com> 3.8.1-2
changelog:
  - Fix License tag and permissions on example scripts under tutorial/,
    per discussion in package review request.
  Related: #452321


author: Tom Lane <tgl@redhat.com> 4.0-1
changelog:
  - Update to PyGreSQL 4.0
  - Relabel license as PostgreSQL now that that's separately recognized by OSI.


author: Petr Pisar <ppisar@redhat.com> - 1.2.15-14
changelog:
  - Do not harness backing store by default. Export SDL_VIDEO_X11_BACKINGSTORE
    environment variable to enable it.
  - Resolves: rhbz#1245417


author: Wim Taymans <wtaymans@redhat.com> - 1.2.15-17
changelog:
  - Fix Some CVEs: CVE-2019-7572, CVE-2019-7573, CVE-2019-7574,
    CVE-2019-7575, CVE-2019-7576, CVE-2019-7577, CVE-2019-7578,
    CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638
  - Resolves: rhbz#1716201, rhbz#1716202, rhbz#1716206,
  - Resolves: rhbz#1716207, rhbz#1716208


author: Jakub Filak <jfilak@redhat.com> 2.1.11-3
changelog:
  - fix a double free error in abrt-applet
  - configure Augeas to parse only required files
  - show 'Close' button in the Configuration dialogue
  - Resolves: #1050167, #1053534, #1054158


author: Jakub Filak <jfilak@redhat.com> 2.1.11-5
changelog:
  - abrt-cli requires libreport-rhel (the reporting workflows)
  - applet: don't notify missing ignored_problems file
  - abrt-cli: show a hint about creating a case in RHTS
  - abrt-cli: show a info text suggesting enabling the autoreporting
  - Related: #1044424
  - Resolves: #1054291, #1055565, #1056980


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-7
changelog:
  - Fix-handling-of-Machine-Check-Exceptions
  - abrt-harvest-vmcore recovers from Permission denied errors
  - never stop 'notify' event
  - install abrt-python files to arch specific dir
  - Resolves: #1032077, #1032511, #1057710
  - Related: #881123


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-9
changelog:
  - Stop consuming 100%CPU in abrt-upload-watch
  - Turn off Autoreporting
  - Enabled GPG check
  - Resolves: #1051480, #1063317


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-11
changelog:
  - Capture all necessary logs in sosreport.tar.gz
  - do not send ureport from abrt-applet
  - do not run gdb under root
  - Resolves: #1067114, #1069278, #1069719


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-13
changelog:
  - Translation updates
  - localization fixes
  - applet: confirm ignoring of notifications
  - cli: batch reporting in abrt-cli
  - cli: add option remove crash dirs after reporting
  - cli: robustize abrt-console-notification.sh
  - cli: make consistent commands in abrt-cli
  - applet: chown each notified problem before reporting it
  - dbus: fixed abrt-dbus memory leaks
  - plugins: add abrt-action-generate-machine-id
  - spec: add abrt-action-generate-machine-id
  - spec: remove dependency on crash from abrt-addon-vmcore
  - spec: hook abrt-oops.conf.5
  - spec: don't use native unwinder on arm arch
  - spec: remove stray space from %description
  - spec: add missing requires for python api
  - spec: add dependency on abrt-python
  - python: support exceptions without traceback
  - spec: hook Kernel oops configuration files
  - koops: add an option controlling MCE detection
  - gdb: disable loading of auto-loaded files
  - vmcore: start the service after kdump service
  - Resolves: #1066482, #1084031, #1067545, #1084027, #1087880, #1087777
  - Resolves: #1015473, #1139001, #1076820, #1139552, #1128637, #1066501
  - Resolves: #1086642


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-14
changelog:
  - ureport: attach contact email
  - mce: separate mce analysis from Kernel oops analysis
  - console-notifications: use return instead of exit
  - Resolves: #1150389, #1150169
  - Related: #1076820


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-15
changelog:
  - console-notifications: skip non-interactive shells
  - applet: show component instead of duphash in the notification
  - Related: #1084031, #1150169


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-19
changelog:
  - abrt-auto-reporting: add ureport authentication command line arguments
  - add python-augeas to the requirements
  - mark all strings for translations
  - translation updates
  - Related: #1087880, #1174833


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-20
changelog:
  - remove the old dump directories during upgrade
  - abrt-action-install-debuginfo-to-abrt-cache: sanitize arguments and umask
  - fix race conditions and directory traversal issues in abrt-dbus
  - use /var/spool/abrt instead of /var/tmp/abrt
  - make the problem directories owned by root and the group abrt
  - validate uploaded problem directories in abrt-handle-upload
  - don't override files with user core dump files
  - fix symbolic link and race condition flaws
  - Resolves: #1211969, #1212819, #1212863, #1212869
  - Resolves: #1214453, #1214610, #1216973, #1218583


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-22
changelog:
  - do not open the build_ids file as the user abrt
  - do not unlink failed and big user core files
  - Related: #1212819, #1216973


author: Richard Marko <rmarko@redhat.com> - 2.1.11-27
changelog:
  - abrt-merge-pstoreoops: merge files in descending order
  - abrt-auto-reporting: fix related to conditional compilation
  - Update translations
  - Related: #1233662, #1191572, #1181248


author: Richard Marko <rmarko@redhat.com> - 2.1.11-28
changelog:
  - doc: fix related to conditional compilation of man page
  - spec: add dbus dependency for abrt-cli and abrt-python
  - Related: #1191572, #1245527


author: Richard Marko <rmarko@redhat.com> - 2.1.11-29
changelog:
  - ccpp: use global TID
  - ccpp: fix comment related to 'MakeCompatCore' option in CCpp.conf
  - cli: fix testing of DBus API return codes
  - dbus-api: unify reporting of errors
  - Related: #1210601, #1252419, #1224984


author: Richard Marko <rmarko@redhat.com> - 2.1.11-31
changelog:
  - Only analyze vulnerabilities when coredump present
  - Only generate core_backtrace if it's not already present.
  - Related: #1210601


author: Richard Marko <rmarko@redhat.com> - 2.1.11-33
changelog:
  - abrt-auto-reporting documentation
  - ccpp: Use global PID
  - ccpp: correct comments mentioning TID
  - Related: #1252590, #1261036, #1223805


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-35
changelog:
  - make /var/spool/abrt owned by root
  - remove 'r' from /var/spool/abrt for other users
  - abrt-action-install-debug-info: use secure temporary directory
  - stop saving abrt's core files to /var/spool/abrt if DebugLevel < 1
  - Fixes for: CVE-2015-5273 and CVE-2015-5287
  - Resolves: #1266853


author: Sergey Fokin <sfokin@cloudlinux.com> - 2.1.11-35.cloudlinux
changelog:
  - add 0016-cli-list-show-a-hint-about-creating-a-case-in-RHTS.patch
  - add 0079-cli-mark-the-suggestion-text-for-translation.patch


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-36
changelog:
  - lib: prevent from creating non-root sub-dirs in dump dir
  - Save Vendor and GPG Fingerprint
  - augeas: augtool save /files/etc/abrt/plugins/oops.conf/DropNotReportableOopses
  - ccpp: add AllowedUsers and AllowedGroups feature
  - ccpp: add IgnoredPath option
  - lib: hooklib: make signal_is_fatal() public
  - vmcore: catch IOErrors and OSErrors
  - translations: update zanata configuration
  - Resolves: #1311100, #1277848, #1277849, #1175679


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-39
changelog:
  - python: fix check for absolute path
  - console-notifications: add timeout
  - vmcore: generate 'reason' file in all cases
  - Fix memory leaks in abrt-dbus
  - Resolves: #1250337, #1166633, #1249101, #1319704


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-46
changelog:
  - remove not implemented option AttemptHardlink in vmcore.conf
  - introduce unsafe reporting for not-reporable problems
  - rewrite skip_pfx() function to work with journal msgs
  - don't expect kernel's version '2.6.*' or '3.*.*'
  - Related: #1416586, #1257159, #1328264, #1378469


author: Martin Kutlak <mkutlak@redhat.com> - 2.1.11-49
changelog:
  - Translation updates
  - Stop creating uReports for unpackaged executables
  - koops: add detailed taint flag description for kernel oopses
  - koops: fix kernel oops and fatal MCE recognition
  - python: provide more information about Python exceptions
  - vmcore: fix replication of vmcore files
  - Related: #1271213, #1460224, #1374648, #1361116, #1228344,
  - Related: #1395285, #1214730, #1446410, #1319828, #1501718


author: Matej Marusak <mmarusak@redhat.com> - 2.1.11-51
changelog:
  - a-a-s-p-data: fix segfault if GPGKeysDir isn't configured
  - spec: turn on --enable-native-unwinder aarch64
  - plugins: a-a-g-machine-id use dmidecode command
  - spec: use dmidecode instead of python-dmidecode
  - Related: #1566707, #1566707, #1260074, #1591141


author: Martin Kutlak <mkutlak@redhat.com> - 2.1.11-53
changelog:
  - cli: load config file at the beginning
  - ccpp: fast dumping and abrt core limit
  - conf: increase MaxCrashReportsSize to 5GiB
  - vmcore: /var/tmp/abrt is no longer a dump location
  - koops: Filter kernel oopses based on logged hostname
  - daemon: Fix double closed fd race condition
  - Related: #1618818, #1647841, #1613236, #1613182, #1655241


author: Jakub Filak <jfilak@redhat.com> - 1.0.6-1
changelog:
  - Fix a deadlock in GC start callback
  - Disable experimental features in production releases
  - Resolves: #1012827


author: Jakub Filak <jfilak@redhat.com> - 1.0.6-3
changelog:
  - Mark stack trace with remote paths as not-reportable
  - Do not provide own reporting workflows
  - Code optimization
  - Do not report exception caught by native functions
  - Use the last frame class path for executable
  - Gracefully handle JVMTI errors
  - Add an abstract to README
  - Add support for journald and syslog
  - Make log output disabled by default
  - Add support for changing log directory
  - Fix a race condition causing a crash of JVM
  - Related: #1051198
  - Resolves: #1051483, #1054720, #1054737, #1055581


author: Jakub Filak <jfilak@redhat.com> - 1.0.6-6
changelog:
  - Make sure that agent_onload and agent_onunload are processed only once
  - Add test results for Linux-aarch64
  - Resolves: #1044756, #1063322


author: Ray Strode <rstrode@redhat.com> - 0.6.35-11
changelog:
  - address minor bug in previous patch
    Related: #1220904

  - fix memory leak in log handler
    Resolves: #1292543


author: Ray Strode <rstrode@redhat.com> - 0.6.42-2
changelog:
  - Update to 0.6.44
    Related: #1424623
  - export password expiration policy from shadow
    Resolves: #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-1
changelog:
  - Update to 0.6.45 so password expiration policy is wrapped by libaccountsservice
    Related: #1424623 #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-2
changelog:
  - Don't tread explicitly requested users as cached
    Fixes UncacheUser operation.
    Resolves: 1446620
    Related: #1432602


author: Ray Strode <rstrode@redhat.com> - 0.6.45-6
changelog:
  - Don't return bogus password expiration policy when
    shadow file is unavailable
    Resolves: #1530659


author: Kamil Dudka <dkdudka@redhat.com> - 2.2.51-13
changelog:
  - avoid failure of %check when building as root (#1085389)
  - setfacl.1: document the meaning of '-' in perms (#1337039)


author: Al Stone <ahs3@redhat.com> - 20130517-1
changelog:
  - Update to latest upstream source.
  - Remove acpica-tools-config.patch -- now in upstream
  - Remove iasl-signed-char.patch -- now in upstream
  - Updated debian-big_endian.patch
  - Updated debian-unaligned.patch


author: Al Stone <ahs3@redhat.com> - 20130517-2
changelog:
  - Correct an oversight: we provide an acpidump in conflict with the
    version in pmtools (which appears to be dead upstream) but had not
    made it an alternative before


author: Al Stone <ahs3@redhat.com> - 20130626-1
changelog:
  - Update to latest upstream source.
  - Move acpidump to acpidump-acpica so it be an alternative properly
  - Add basic man page for acpidump
  - Enable use of AAPITS tests during the check step


author: Al Stone <ahs3@redhat.com> - 20130725-2
changelog:
  - Fix several rpmlint items (listed below)
  - Add versions to explicit provides for acpixtract, acpidump
  - Not all setup steps used -q
  - Setup executable test script (run-misc-tests.sh) differently
  - Removed unneeded commented out line with macros in it
  - Removed mixed use of spaces and tabs (all spaces now)
  - Corrected source URLs (upstream moved)


author: Al Stone <ahs3@redhat.com> - 20130823-2
changelog:
  - Add in a copy of the GPLv2 text in order to comply with the requirement
    to always redistribute the terms of the license.


author: Dean Nelson <dnelson@redhat.com> - 20130823-3
changelog:
  - Fix run-misc-tests.sh script to properly set the number of BITS to 64 when run
    on a s390x system.


author: Dean Nelson <dnelson@redhat.com> - 20130823-7
changelog:
  - Fix the dangling symlink issue for acpidump(1) and acpixtract(1) man pages
    that was reported in RHBZ 1074681.


author: Dean Nelson <dnelson@redhat.com> - 20130823-8
changelog:
  - Fix run-misc-tests.sh script to properly set the number of BITS to 64 when run
    on a ppc64le system as requested by RHBZ 1125471.


author: Dean Nelson <dnelson@redhat.com> - 20140926-1
changelog:
  - Update to the latest upstream version of acpica as requested by RHBZ 967963.
  - Refresh existing patches and add new ones to enable a clean build.
  - Fix build failures that start before and finish after midnight.


author: Dean Nelson <dnelson@redhat.com> - 20150619-1
changelog:
  - Update to the latest upstream version of acpica as requested by RHBZ 1211328.
  - Refresh existing patches and add/delete ones to enable a clean build.
  - Add missing return status checks after a few calls to AcpiDmDumpTable() and
    one to fopen().


author: Dean Nelson <dnelson@redhat.com> - 20150619-3
changelog:
  - Remove acpitests-unix-20150619 directory from the build because it was a
    mistake that it was present and it complicated the fixing of the file
    permissions done related to RHBZ 1211328's requested rebase.


author: Dean Nelson <dnelson@redhat.com> - 20150619-3
changelog:
  - Remove acpitests-unix-20160527 directory from the build because it was a
    mistake that it was present and it complicated the fixing of the file
    permissions done related to RHBZ 1211328's requested rebase.


author: Dean Nelson <dnelson@redhat.com> - 20160527-1
changelog:
  - Update to the latest upstream version of acpica as requested by RHBZ 1278038.
  - Refresh existing patches and add/delete ones to enable a clean build.


author: Dean Nelson <dnelson@redhat.com> - 20150619-3
changelog:
  - Remove acpitests-unix-%{version} directory from the build because it was a
    mistake that it was present and it complicated the fixing of the file
    permissions done related to RHBZ 1211328's requested rebase.


author: Al Stone <ahs3@redhat.com> - 20160527-2
changelog:
  - Corrected the use of percent signs in the change log and made sure
    they are all properly escaped.  Resolves: #1425899.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.18-1
changelog:
  - New version
  - Replaced RPM_BUILD_ROOT variables by {buildroot} macros
  - Updated URLs to project home page and source code
  - Dropped mk patch, handled better way in the spec


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.19-5
changelog:
  - Used unitdir macro instead of the hardcoded systemd paths
    Related: rhbz#1057268
  - Fixed bogus date in changelog (best effort)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.19-7
changelog:
  - Switched to dynamic connections (increased max connections from 20 to 1024)
    Resolves: rhbz#1351999
  - Simplified conversion script and moved it to posttrans to get rid of warnings
    during upgrade from RHEL-6 to RHEL-7
    Resolves: rhbz#1086686


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.19-9
changelog:
  - Switched kacpimon to dynamic connections (increased max connections
    from 20 to 1024)
    Resolves: rhbz#1450980


author: Stef Walter <stefw@redhat.com> - 0.7-1
changelog:
  - Work around broken krb5 with empty passwords [#960001]
  - Fix memory corruption issue [#959999]
  - Update to 0.7, fixing various bugs


author: Stef Walter <stefw@redhat.com> - 0.7.4-1
changelog:
  - Update to upstream point release 0.7.4
  - Correctly handle truncating long host names [#1001667]
  - Try to contact all available addresses for discovery [#1004442]
  - Build fixes [#1004823]


author: Stef Walter <stefw@redhat.com> - 0.7.5-1
changelog:
  - Update to upstream point release 0.7.5
  - Workaround for discovery via IPv6 address [#1004442]
  - Correctly put IPv6 addresses in temporary krb5.conf


author: Sumit Bose <sbose@redhat.com> - 0.8.1-3
changelog:
  - fix crash when name is specified on the command line and detect names with
    lower case characters [#1359773]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-4
changelog:
  - adcli doesn't update kvno while joining system to AD domain (RODC) [#1471021]
  - adcli_tool_computer_delete description spelling [#1450179]
  - adcli man page should not only mention FILE type credential caches [#1423871]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-5
changelog:
  - enable "Trust this computer for delegation to any service (Kerberos only)" [#1538730]
  - realm join fails with Insufficient permissions [#1542354]
  - adcli update option cannot add principals for computer object [#1545568]
  - adcli refuses to add service principals [#1547013]
  - [RFE] Support adding SPN of a different host [#1547014]
  - adcli segfaults during AD join RHEL 7.5 [#1575554]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-6
changelog:
  - Couldn't set service principals on computer account [#1608212]
  - additional fix #1547014 and #1593240


author: Sumit Bose <sbose@redhat.com> - 0.8.1-7
changelog:
  - use autosetup macro to simplify patch handling
  - fixed rpmlint warnings in the spec file
  - join failed if hostname is not FQDN [#1649868]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-8
changelog:
  - Various updates for RHEL-7.7
  - many adcli-krb5-????? directories are created /tmp [#1588596]
  - adcli exports kerberos ticket with old kvno [#1642546]
  - [RFE] Have `adcli join` work without FQDN in `hostname` output [#1595911]
  - Improve handling of service principals [#1644311]
  - [RFE] adcli command with --unix-* options doesn't update
    values in UnixAttributes Tab for user [#1337489]
  - [RFE] adcli join should preserve SPN added by adcli preset-computer [#1630187]
  - [RFE] Need an option for adcli command which will show domain join status. [#1622583]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-9
changelog:
  - Fixes for RHEL-7.7 updates
  - additional patch for [RFE] adcli join should preserve SPN added by adcli
    preset-computer [#1630187]
  - new patches for many adcli-krb5-????? directories are created /tmp [#1588596]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-10
changelog:
  - adcli is failing with "Couldn't add keytab entries: FILE:/etc/krb5.keytab:
    Cannot allocate memory" [1665162]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-11
changelog:
  - Fixes and improvements for RHEL-7.8
  - Issue is that with arcfour-hmac as first encryption type in the config ... [#1683745]
  - adcli update --add-samba-data does not work as expected [#1738573]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-14
changelog:
  - Fixes for RHEL-7.9
  - Update' adcli update --add-samba-data ' info under correct section in man adcli [#1774622]
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1802258]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-15
changelog:
  - More fixes for RHEL-7.9
  - No longer able to delete computer from AD using adcli [#1840752]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1762633]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-1
changelog:
  - Update to upstream release 0.8.1
  - Rebase adcli in RHEL-7.3 to version 0.8.0 [#1292530]
  - Support Host Keytab renewal [#1288485]
  - realmd not joining AD so ssh gssapi-with-mic works [#1061371]
  - technically wrong length checks in binary parsers  [#1027905]
  - avoid alloca in _adcli_ldap_have_in_mod [#1027889]
  - [RFE] adcli --stdin-password should be able to strip newline character from
    the input [#1134330]


author: Than Ngo <than@redhat.com> - 1.15-21
changelog:
  - Resolves: #1711051, CVE-2019-8383 denial of service
  - Resolves: #1710910, CVE-2019-8379 null pointer dereference


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 2.5-9
changelog:
  - also remove include/agg_conv_gpc.h as it also carries a copy of the non-Free
    GPC license (upstream also recommends removing that file under
    http://www.antigrain.com/license/index.html#toc0005) (#559611)


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-4
changelog:
  - added patch to fix aide in FIPS mode
  - use only FIPS approved digest algorithms in aide.conf so that
    aide works by default in FIPS mode


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-6
changelog:
  - warn if processing prelinked binary objects and the prelink binary
    is not available
    Resolves: rbhz#1004826


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-10
changelog:
  - Updated the default configuration file. New defaults contributed
    by Steve Grubb.
    Resolves: rhbz#1304334


author: Steve Grubb <sgrubb@redhat.com> - 0.14-3
changelog:
  - Fix bz 590561 aide does not detect the change of SElinux context
  - Fix bz 590566 aide reports a changed file when it has not been changed


author: Jaroslav Kysela <jkysela@redhat.com> - 1.0.25-1
changelog:
  - Updated to 1.0.25
  - Moved plugin specific configuration from /etc/alsa/pcm to /usr/share/alsa/alsa.conf.d


author: Tim Jackson <rpm@timj.co.uk> - 1.0.25-4
changelog:
  - Move udev rules to /lib/udev/rules.d (rhbz #748206)
  - remove %BuildRoot and %clean sections; no longer required


author: Rahul Sundaram <sundaram@fedoraproject.org> - 1.0.26.1-3
changelog:
  - remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247
  - clean up spec to follow current guidelines
  - don't build -tools for RHEL. Bill Nottingham patch. Resolves rhbz#586030


author: Jaroslav Kysela <jkysela@redhat.com> - 1.1.0-1
changelog:
  - Updated to 1.1.0
  - Enable hda-verb, hdajackretast, hdajacksensetest for i686/x86_64
  - Resolves: rhbz#1172560


author: Jaroslav Kysela <jkysela@redhat.com> - 1.0.27.1-1
changelog:
  - Updated to 1.0.27.1
  - Updated alsa-info.sh to 0.4.61
  - Remove dependency on the dialog package (it is optional for alsa-info.sh)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-19.1
changelog:
  - ALTPHP-1501: Update to 7.1.1-19
  - Updated libwebp to 1.3.2
  - Added package with libraries for static linking
  - Build with newer libraries for RHEL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-43.1
changelog:
  - ALTPHP-1896: Update to 7.1.1-43
  - ALTPHP-1920: Update libwebp to 1.5.0
  - ALTPHP-1932: Fix perfomance issues


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.2-29.2
changelog:
  - ALTEAPLN-4: Fix grid-HEIC decode deadlock/crash under constrained nproc (LVE)
    by bumping bundled libde265 to 1.1.1 and libheif to 1.23.1 and patching
    libde265 to fall back to single-threaded decoding when worker threads cannot
    be created; also cap libheif per-tile parallel decoding in the HEIC coder


author: Robert-André Mauchin <zebob.m@gmail.com> - 1.0.0-5.20180925gitd0076f5
changelog:
  - Update to commit d0076f507a6027455540e2e4f25f84ca38803e07
  - Set CONFIG_LOWBITDEPTH to 1
  - Fix #1632658


author: Robert-André Mauchin <zebob.m@gmail.com> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Close: rhbz#1954337
  - Security fix for CVE-2021-30473
  - Fix: rhbz#1961375
  - Fix: rhbz#1961376
  - Security fix for CVE-2021-30475
  - Fix: rhbz#1968017
  - Fix: rhbz#1968018


author: Kamil Dudka <kdudka@redhat.com> 7.33.0-1
changelog:
  - new upstream release
  - fix missing initialization in NTLM code causing test 906 to fail
  - fix missing initialization in SSH code causing test 619 to fail


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.11.0-2
changelog:
  - don't add link to ldap in *.pc file if ldap.pc doesn't exist
  - don't add link to mit-krb5-gssapi in *.pc file if mit-krb5-gssapi.pc.pc doesn't exist


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.19.0-2
changelog:
  - ALTPHP-2119: patch to allow building alt-curlssl11 with OpenSSL 1.1
    (curl 8.19.0 dropped OpenSSL < 3.0 support upstream)
  - Fix OPENSSL_VERSION_STRING -> OPENSSL_VERSION for OpenSSL 1.1 compat
  - Fix doc file references: FAQ -> FAQ.md, TODO -> TODO.md, KNOWN_BUGS -> KNOWN_BUGS.md
  - Disable flaky tests 763, 1501, 1583


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 8.19.0-3
changelog:
  - ALTPHP-2106: pin alt-nghttp2 runtime requirement to the version we built
    against, to avoid undefined-symbol errors when an older alt-nghttp2 is
    installed alongside a freshly built alt-curlssl11


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.19.0-4
changelog:
  - Restore short "OpenSSL/1.1.1w" SSL version string (drop the duplicated
    "OpenSSL " prefix and trailing release date introduced when working
    around OPENSSL_VERSION_STRING for alt-openssl11)


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.21.0-2
changelog:
  - ALTPHP-2543: build libcurl with brotli support on el8+ and all deb platforms
    (--with-brotli + brotli-devel / libbrotli-dev) so curl_version() reports
    brotli and Accept-Encoding: br is handled. el7 is left without brotli (the
    libbrotlidec runtime lib is not in CL7 customer repos)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 8.21.0-3
changelog:
  - ALTEAPLN-6: honour the nscd hosts cache again. Since 8.20.0 the threaded
    resolver splits one getaddrinfo(AF_UNSPEC) call into separate AF_INET6 and
    AF_INET lookups. glibc answers a single-family AF_INET lookup via
    gethostbyname2_r(), which reaches nscd as a GETHOSTBYNAME request, and nscd
    refuses to cache those answers when they hold more than one address. Hosts
    behind a load balancer were therefore re-resolved through DNS on every
    request. Resolve both families in one AF_UNSPEC lookup when both are
    wanted, as curl did up to 8.19.x; requests pinned to a single family
    (CURLOPT_IPRESOLVE / curl --ipv4) keep their existing code path.


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.21.0-4
changelog:
  - ALTEAPLN-23: restore NTLM support. Upstream curl 8.20.0 made NTLM opt-in:
    --enable-ntlm has to be requested explicitly, whereas up to 8.19.x NTLM was
    built unless --disable-ntlm was passed. The spec passed neither flag, so
    libcurl 8.20.0 and 8.21.0 shipped without NTLM and broke NTLM-authenticated
    SOAP/HTTP calls. Pass --enable-ntlm explicitly.
    Upstream schedules NTLM for removal in September 2026 (docs/DEPRECATE.md),
    so this restores the feature for the 8.21.x series only; consumers still on
    NTLM need a migration path before the next major bump.
    SMB became opt-in in the same release and is deliberately left disabled: it
    is scheduled for removal on the same date, upstream considers it weak
    security, and it was not part of the reported regression.


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 1.5.3-1
changelog:
  - EA4D-914: Update to 1.5.3 (libheif 1.23.x requires the dav1d >= 1.0 API)
  - Track libdav1d.so.7 soname


author: Philippe Makowski <makowski[at]fedoraproject.org> 2.5.0.26074.0-2
changelog:
  - Fix wrong assign file for classic and classic common
  - sync the s390(x) utilities list with other arches
  - add libatomic_ops-devel as BR: on non-x86 arches


author: Frediano Ziglio <freddy77@angelfire.com>
changelog:
  - remove dependency from freetds-unixodbc
  - fix field name (Copyright instead of License)
  - updated URL


author: Caolan McNamara <caolanm@redhat.com> 4.0-2
changelog:
  - Resolves: rhbz#459698 drop Malayalam patches. Note test with Rachana/Meera
  instead of Lohit Malayalam before filing bugs against icu wrt.
  Malayalam rendering


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 57.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow): not applied
    for v57 yet (see TODO.md)
  - Drop SOURCE100/101 dep filters, use alt_default_filter
  - Drop downstream ".cloudlinux.1" release suffix; align Release with
    other ICU lines


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 65.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Run %check as two top-level make calls (source/test + xcheck-local)
    to dodge ICU's broken nested-make jobserver pattern; tests now run
    strictly without "||:"


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 71.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Release bumped to align with other ICU lines


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.1.1-1
changelog:
  - Update to 1.1.1
  - Port spec to CMake (autotools build system removed upstream in 1.1.x)
  - Drop sherlock265/SDL/Qt bits and no-longer-shipped example tools


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 3.14.1-1
changelog:
  - EA4D-913: Update to 3.14.1
  - Port spec to CMake (autotools build system removed upstream in 3.10)
  - Stop shipping static libraries and libtool archives (CMake shared-only build)
  - C++ library is now versioned libgeos.so.3.14; C API soname libgeos_c.so.1
    is unchanged and stays backward compatible


author: Alex71 <nyrk71@gmail.com> 2.1.0-2
changelog:
  - put libhpdf.so in the devel package and libhpdf-2.1.0.so in the main one
  - removed duplicated README and CHANGES from devel package
  - fixed "E: empty-debuginfo-package" with --enable-debug flag in configure
  - removed INSTALL file
  - added demo/ directory in doc (devel only) as doc


author: Brian Aker <brian@tangent.org> - 1.0.8
changelog:
  * Fri Jan  8 2010 Brian Aker <brian@tangent.org> - 0.37
  - Modified to be explicit in install include files.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5.0-3
changelog:
  - Use C.UTF-8 locale
    See https://fedoraproject.org/wiki/Changes/Remove_glibc-langpacks-all_from_buildroot


author: Mosaab Alzoubi <moceap@hotmail.com> - 0.7.0-4
changelog:
  - First build on EPEL8
  - Use one branch to build on Fedora and EPEL
  - Use python3 as BR except EPEL7
  - Use LC_ALL=en_US.UTF-8 in EPEL7


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.11.1-4
changelog:
  - ALTPHP-2484: Fix CVE-2026-55200 (transport.c OOB write), CVE-2026-55199
    (EXT_INFO handler DoS), CVE-2025-15661 (sftp_symlink OOB read)


author: Remi Collet <remi@remirepo.net> - 1.3.2-1
changelog:
  - update to 1.3.2
  - drop multilib header hack
  - change URL to https://libzip.org/
  - test suite now ok on all arch


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.29-22
changelog:
  - Rebase upon passenger-5.0.29
  - Return back to Passenger 4.0 tmp/restart.txt behavour (minimal lag
    between touching app/tmp/restart.txt and app restart)
  - Fixup installation script for non-panel server


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-27
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-3
changelog:
  - Check configs to migrate from 4.x to 5.x Passenger
  - Restart Passenger (via httpd) to reload fresh liblve


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-4
changelog:
  - Install Passenger into separate version folders
  - Tune simlinks to point to proper Passenger version
  - Fix permissions of PassengerInstanceRegistryDir to 755


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.6-1
changelog:
  - ALMODP-77: Make /var/passenger less worldwide accessible
  - ALMODP-60: Use `PASSENGER_INSTANCE_REGISTRY_DIR` instead `PASSENGER_TEMP_DIR`
  - ALMODP-81: Add conflict for package ea-ruby24-mod_passenger


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.11-1
changelog:
  - ALMODP-91: Arbitrary file read vulnerability in passenger
  - ALMODP-89: Made graceful reload Apache instead of restart when alt-mod-passenger install/update
  - Remove dependency from old package which obsoletes ea-apache24-alt_mod_passenger
  - ALMODP-86: Add Node.js language support for alt-mod-passenger


author: Vladimir Prokofev <vprokofev@cloudlinux.com> - 5.0.29-27.cloudlinux.2
changelog:
  - Rebuild ea-apache24-alt-mod-passenger as ea-apache24-mod-alt-passenger
  -ALMODP-67: Rebuild ea-apache24-alt-mod-passenger as ea-apache24-mod-alt-passenger
  -


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.9.5.2-1
changelog:
  - EA4D-928: Update to 5.9.5.2 version
  - rebase net-snmp-5.7.2-pie.patch and net-snmp-5.5-dir-fix.patch onto 5.9.5.2
  - drop net-snmp-5.6-test-debug.patch and
    net-snmp-5.7.2-agentx-disconnect-crash-part2.patch, both applied upstream
  - point PKG_CONFIG_PATH at alt-openssl11: since 5.9 configure finds OpenSSL
    through pkg-config only, and without it NETSNMP_USE_OPENSSL is left undefined
  - fix the --with-openssl path typo (opnessl11 -> openssl11)
  - add libnl3 dependency: 5.9 rewrote etherlike-mib's dot3stats_linux.c on top
    of netlink, where 5.8 used ioctl and needed no such dependency
  - package the netsnmp.pc / netsnmp-agent.pc files newly installed by 5.9
  - add /opt/alt/net-snmp11/usr/lib64 to the rpath so libnetsnmpagent/libnetsnmpmibs can resolve
    their sibling libnetsnmp on CL9/CL10, where libtool no longer supplies it


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-8
changelog:
  - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering
    with Hash class internals in policy mechanism


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-10
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits()
    that could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-11
changelog:
  - CVE-2022-32213: fix missing CR validation in header separators to prevent
    HTTP request smuggling via malformed headers
  - CVE-2022-32214: fix Transfer-Encoding header validation to reject invalid
    and repeated chunked encoding values
  - CVE-2022-32215: fix Transfer-Encoding header parsing to prevent smuggling
    attacks via conflicting encoding declarations
  - CVE-2022-35256: fix header overflow calculation to properly detect and
    reject oversized HTTP headers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-13
changelog:
  - CVE-2023-46809: fix a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-14
changelog:
  - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource
    exhaustion during decompression


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-15
changelog:
  - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection
    on abrupt socket close


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 12.22.12-16
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism that could expose uninitialized memory when using vm module with
    timeout options, preventing potential information disclosure


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-17
changelog:
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-19
changelog:
  - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame
    so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow
    instead of leaking memory


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-20
changelog:
  - CVE-2026-21717: scramble V8 array-index hash_field with a 3-round
    xorshift-multiply so consecutive numeric strings no longer hash to
    consecutive buckets, preventing O(n^2) HashDoS via JSON.parse


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-21
changelog:
  - CVE-2023-30581: handle mainModule.__proto__ bypass of the experimental
    policy mechanism; set the policy-wrapped require on Module.prototype and
    use setOwnProperty for process.mainModule (backport of nodejs/node d0a8264ec9)
  - CVE-2023-44487: HTTP/2 Rapid Reset; backport the nghttp2 RST_STREAM
    rate-limit mitigation (token-bucket limiter, default burst 1000 / rate 33,
    GOAWAY on exhaustion) into bundled deps/nghttp2 (backport of nghttp2 72b4af6)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-22
changelog:
  - CVE-2026-48619: cap the HTTP/2 client originSet at 128 entries so a
    malicious server can no longer drive unbounded memory growth via repeated
    ORIGIN frames; the session is destroyed with ERR_HTTP2_TOO_MANY_ORIGINS
    once the cap is exceeded (backport of nodejs/node c79968e108)
  - CVE-2026-48930: reject dns.lookup()/dnsPromises.lookup()/net.connect()
    hostnames that contain an embedded NUL byte, preventing silent authority
    rebinding caused by C-string truncation in the resolver bindings; adds
    validateStringWithoutNullBytes (backport of nodejs/node 7dafafa2)
  - CVE-2026-48933: guard the legacy CipherBase::Update() output-length
    computation against signed-int overflow (len + block_size > INT_MAX),
    turning ~2 GiB one-shot cipher inputs into a clean failure instead of an
    out-of-bounds write; the legacy analog of the WebCrypto fix in
    nodejs/node 98fbc89211 (Node 12 has no WebCrypto)


author: Viktor Borzov <vborzov@cloudlinux.com> - 12.22.12-23
changelog:
  - CVE-2026-48931: destroy keep-alive sockets that receive unsolicited data
    while idle in the http.Agent freeSockets pool, so injected bytes can no
    longer be parsed as the response to the next request that reuses the
    socket (response-queue poisoning); backport of nodejs/node 179ddaedfb
  - CVE-2026-48937: detect a GOAWAY that nghttp2 emitted on its own initiative
    (e.g. on an oversized frame) and surface it to JS as a session error, so
    the Http2Session, its streams and its socket are released instead of
    leaking indefinitely; backport of nodejs/node 4a32c00fb8, adapted -- v12
    has no graceful-close state machine, so that guard is dropped


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-24
changelog:
  - CVE-2026-48618: normalize the peer hostname with domainToASCII() before
    splitting it into DNS labels in tls.checkServerIdentity(), so the verifier
    counts the same labels the resolver connected to; Unicode dot separators
    (U+3002, U+FF0E, U+FF61) can no longer defeat the wildcard-depth rule and
    make a *.example.com certificate authenticate a host two levels below it
    (backport of nodejs/node 1efb4ff51a plus the required IPv6 IP-SAN
    follow-up 1d87a24050)
  - CVE-2026-48928: add the 'i' flag to the SNI RegExp built by
    tls.Server.prototype.addContext(), so an uppercase or mixed-case SNI
    hostname selects its per-hostname SecureContext instead of silently
    falling back to the server's default context and bypassing per-tenant
    client-certificate authorization in multi-context mTLS deployments
    (backport of nodejs/node 39d1d09684)
  - CVE-2026-48934: bind a reusable TLS client session to the host it was
    authenticated for, so a session obtained from host A can no longer be
    replayed against host B to skip checkServerIdentity() via
    isSessionReused(); adds wrapSessionState/getSessionForReuse and an
    explicit TLSSocket.prototype.getSession (backport of nodejs/node
    fd890ba01d, with the fix's optional chaining rewritten to && form
    because V8 7.8 has no ?.)
  - CVE-2026-58040: bind identity checks to session and socket reuse in the
    https.Agent, the vector CVE-2026-48934 left open. A request supplying its
    own checkServerIdentity is tagged with a unique per-request index that
    Agent.prototype.getName() appends, so it gets its own pool bucket;
    createConnection() neither reads nor writes the TLS session cache for it,
    and a new keepSocketAlive() override keeps its socket out of freeSockets.
    A later request using the default strict check can therefore no longer
    inherit a session or a keep-alive socket authenticated under permissive
    rules and be reported authorized against an unverified host (backport of
    nodejs/node 51123159fe)


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-11
changelog:
  - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data.


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-22
changelog:
  - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a
    Name's hash_field via a 3-round xorshift-multiply with compile-time
    constants so consecutive numeric strings no longer collide in V8's
    internal string table (HashDoS via JSON.parse)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 14.21.3-23
changelog:
  - CVE-2023-30581: policy: handle mainModule.__proto__ bypass by installing
    the policy-aware require() on the module prototype and assigning
    process.mainModule via setOwnProperty(), closing the
    process.mainModule.__proto__.require() experimental-policy bypass
  - CVE-2023-44487: nghttp2 (HTTP/2 Rapid Reset): backport the upstream
    nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled
    nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming
    RST_STREAM frames now trigger a GOAWAY instead of unbounded work


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 14.21.3-24
changelog:
  - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent
    silent authority rebinding via C-string truncation in the resolver bindings
    (backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes)
  - CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a
    malicious server can no longer cause unbounded memory growth via ORIGIN frames
    (backport of nodejs/node@c79968e1)
  - CVE-2026-48933: crypto: guard the cipher output-length computation against
    signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc
    (Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892)


author: Viktor Borzov <vborzov@cloudlinux.com> - 14.21.3-25
changelog:
  - CVE-2023-39333: module: stop code injection through WebAssembly export names
    in lib/internal/modules/esm/create_dynamic_module.js -- the ESM facade now
    uses index-derived local bindings and a JSONStringify-quoted
    import.meta.exports key instead of interpolating the attacker-controlled
    export name into code position (adapted from nodejs/node@eaf9083c: V8 8.4
    has no ES2022 arbitrary module namespace names, so the `export { ... as NAME }`
    clause is emitted only for names matching the IdentifierName grammar)
  - CVE-2026-48931: http: destroy keep-alive sockets that receive unsolicited data
    while idle in the Agent freeSockets pool, closing the response-queue poisoning
    window left open once responseKeepAlive() detaches the parser and its 'data'
    listener (backport of nodejs/node@0a22d401 squashed with its regression
    follow-up nodejs/node@eaa29254, which guards the idle socket at the handle
    level instead of attaching a public 'data' listener plus resume())


author: Viktor Borzov <vborzov@cloudlinux.com> - 14.21.3-26
changelog:
  - CVE-2026-48937: http2: tear down the session when nghttp2 internally queues a
    GOAWAY for a low-level protocol error. nghttp2 calls
    nghttp2_session_terminate_session() itself and returns success from
    nghttp2_session_mem_recv() without any callback, so the Http2Session stayed
    live on a dead socket, holding its streams, buffers and handle -- repeatable
    by an unauthenticated peer for memory/handle exhaustion. OnFrameSent() now
    flags a GOAWAY we did not initiate and SendPendingData() raises
    NGHTTP2_ERR_PROTO to JavaScript after it is written (backport of
    nodejs/node@a8a0d128; Node 14 has no graceful_close_initiated_ flag, so that
    term of the guard is covered by the new goaway_initiated_ flag and by
    is_closing())


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1.1.1p-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free on empty digestAlgorithms)
  - Build on CL8 again: drop ExcludeArch: x86_64 (ELS-2378)


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-8
changelog:
  - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to
    prevent sensitive data leakage


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 16.20.2-12
changelog:
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 16.20.2-13
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism preventing race condition that could expose uninitialized memory


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 16.20.2-16
changelog:
  - Obsolete alt-nodejs16-openssl{,-devel,-libs} < 1.1.1e on el8+ to prevent
    OPENSSL_1_1_1e symbol version mismatch when stale alt OpenSSL in RPATH
    shadows system OpenSSL


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 18.20.8-9
changelog:
  - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to
    prevent uncaught TypeError when a __proto__ header is received and the
    application accesses req.headersDistinct or req.trailersDistinct


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-10
changelog:
  - CVE-2026-21713: use CRYPTO_memcmp instead of memcmp in Web Cryptography
    HMAC signature verification to prevent timing attacks


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-11
changelog:
  - CVE-2026-21712: return original href when ada::parse fails in
    url.format() instead of crashing on malformed IDN hostnames


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 18.20.8-13
changelog:
  - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a
    Name's hash_field via a 3-round xorshift-multiply with compile-time
    constants, so consecutive numeric strings no longer collide in V8's
    internal string table


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 18.20.8-14
changelog:
  - CVE-2026-48619: cap http2 client originSet size (default 128, option
    maxOriginSetSize) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS,
    preventing unbounded memory growth from malicious ORIGIN frames
  - CVE-2026-48930: reject dns/net hostnames containing embedded NUL bytes via
    new validateStringWithoutNullBytes, preventing silent authority rebinding
    from c-string truncation in the resolver bindings
  - CVE-2026-48933: guard the WebCrypto AES cipher output length with
    TryGetIntCipherOutputLength so ~2 GiB inputs fail cleanly instead of
    overflowing the signed int buffer length and aborting the process


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-15
changelog:
  - CVE-2026-48618: IDNA-normalize the hostname with domainToASCII() before
    label-splitting in tls.checkServerIdentity(), so Unicode dot separators
    (U+3002/U+FF0E/U+FF61) can no longer collapse labels and let a shallower
    wildcard certificate match; IP literals stay un-normalized so IPv6
    IP-Address SANs keep matching (includes follow-up 1d87a24050)
  - CVE-2026-48928: add the 'i' flag to the SNI matching RegExp built by
    tls.Server.prototype.addContext(), so uppercase or mixed-case SNI hostnames
    select their intended per-hostname SecureContext instead of falling back to
    the default context and bypassing mTLS client-certificate authorization
  - CVE-2026-48934: bind reusable client TLS sessions to the authenticated host
    by wrapping session state with the target servername and gating
    setSession()/tls.connect({ session }) through getSessionForReuse(),
    preventing a session from one host being resumed against another with
    checkServerIdentity() skipped


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-16
changelog:
  - CVE-2026-48931: guard idle keep-alive sockets in the http.Agent freeSockets
    pool with a handle-level onread guard (installFreeSocketDataGuard /
    removeFreeSocketDataGuard), destroying sockets that receive unsolicited data
    while the HTTPParser is detached so a server can no longer poison the
    response queue of the next request; includes the upstream follow-up that
    avoids stream listeners on idle sockets
  - CVE-2026-48937: detect in OnFrameSent a GOAWAY that nghttp2 queued
    internally (no callback is invoked for frame-size, padding or HPACK
    errors) and raise NGHTTP2_ERR_PROTO at the end of SendPendingData so the
    Http2Session is destroyed after the GOAWAY is written, instead of the
    server accepting data forever on an abandoned session


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-17
changelog:
  - CVE-2025-23167: restore terminator validation in the loose state machine of the
    bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done,
    chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require
    the LF after a CR instead of consuming any byte; a header block ending in
    "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather
    than swallowing the byte and parsing what follows as a second, smuggled request


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 18.20.8-18
changelog:
  - CVE-2026-58040: bind HTTPS identity checks to connection and session reuse.
    Follow-up to the incomplete fix for CVE-2026-48934: https.request() now tags
    requests that pass their own checkServerIdentity (one that is neither the
    stock tls.checkServerIdentity nor inherited from the agent options) with a
    unique per-request id, https.Agent.getName() mixes that id into the agent
    key, createConnection() skips the TLS session cache for such requests and a
    new https.Agent.keepSocketAlive() override refuses to park their sockets in
    freeSockets, so a per-request callback can no longer be skipped by reusing a
    socket or a TLS session whose identity was accepted by a different callback


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-5
changelog:
  - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch
    blocks to route exceptions through error handlers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 20.20.2-3
changelog:
  - CVE-2026-48619: cap HTTP/2 client originSet size to prevent unbounded
    memory growth from malicious ORIGIN frames
  - CVE-2026-48930: reject dns/net hostnames with embedded NUL bytes to
    prevent silent authority rebinding via C-string truncation
  - CVE-2026-48933: guard WebCrypto cipher output length to avoid signed
    integer overflow on ~2 GiB inputs


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-4
changelog:
  - CVE-2026-48618: tls: normalize the hostname with domainToASCII() before
    splitting it into labels in checkServerIdentity(), so Unicode dot
    separators cannot defeat the wildcard-depth check
  - CVE-2026-48928: tls: match SNI contexts case-insensitively in
    Server.prototype.addContext() as required by RFC 6066
  - CVE-2026-48934: tls: bind reusable client sessions to the host they were
    authenticated for, so a resumed session cannot skip host verification


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-5
changelog:
  - CVE-2026-48931: guard idle keep-alive sockets in the http.Agent freeSockets
    pool against unsolicited data to prevent response queue poisoning
  - CVE-2026-48937: destroy the HTTP/2 session when nghttp2 internally sends a
    GOAWAY so the server stops accepting data after a protocol error


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-6
changelog:
  - CVE-2026-48617: gate process.report.writeReport() on the fs.write permission
    so diagnostic reports cannot escape the --allow-fs-write allow-list
  - CVE-2026-48935: disable FileHandle.utimes() when the Permission Model is
    enabled so file timestamps cannot be changed with read-only access


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 6.9.1-2
changelog:
  - Rebuild from zvetlik/rh-nodejs6
  - newer releases have problems with debug
  - add procps-ng for tests
  - remove unused patches


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.9.10-1
changelog:
  - Update to 6.9.10
  - Drop betaver macro: 6.9.10 has no revised re-release (rev1 was 6.9.5-only)
  - Build with --enable-binary-compatible-posix-api: keep exporting the
    unprefixed POSIX symbols (regcomp/regexec/regfree/regerror + reg_*)
    that 6.9.5 exported; upstream renamed them to onig_posix_* in 6.9.6
    and the soname does not change, so dropping them would be a silent
    ABI break for any POSIX-API consumer


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1598103)
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.4.59-1
changelog:
  - EA4D-969: Update to 2.4.59
  - Drop openldap-ldapi-sasl.patch and the two ITS7595 OpenSSL EC support
    patches, all taken upstream in 2.4.59
  - Drop openldap-tlso-use-openssl-api-to-verify-host.patch, superseded by the
    TLS_REQSAN option upstream added in 2.4.52 (ITS#9318)
  - Set the TLS_REQSAN default to try, preserving the #1740070 behaviour via
    upstream's own SAN check (matches RHEL 8 openldap-2.4.46-18)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.0.2u-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free)
  - Guard -Wno-error=incompatible-pointer-types/-implicit-function-declaration
    to gcc >= 6 (rhel >= 8) so the build no longer fails on CL7 gcc 4.8.5


author: Lubomir Rintel <lkundrak@v3.sk> 7.8-1
changelog:
  - Update to 7.8, drop upstreamed patches
  - Fix destination of documentation (#427763)
  - Use buildroot macro consistently
  - Separate the static library, as per current Guidelines
  - Satisfy rpmlint


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 10.47-1
changelog:
  - EA4D-932: Update to 10.47 version
  - Upstream renamed AUTHORS -> AUTHORS.md and LICENCE -> LICENCE.md


author: Tomas Hoger <thoger@redhat.com> - 7.3-3
changelog:
  - Backport patch from upstream pcre 7.6 to address buffer overflow
    caused by "a character class containing a very large number of
    characters with codepoints greater than 255 (in UTF-8 mode)"
    CVE-2008-0674, #431660
  - Try re-enabling make check again.


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 7.4.16-2
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - ALTPHP-1082: Add alt-php-pdo requires for alt-php-mysqlnd and alt-php-firebird


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 7.4.21-3
changelog:
  - ALTPHP-1154: Fix libxml requires
  - ALTPHP-1156: Get rid of manipulations with enabling extensions (mysqli.so) in default.ini


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.4.33-4
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.4.33-7
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-10
changelog:
  - ALTPHP-1531: add provides alt-php-handler-lsphp and alt-php81-handler-lsphp
  - remove changes from ALTPHP-1508


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.4.33-12
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 4.4.9-109
changelog:
  - Fixed bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fixed bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 4.4.9-113
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.1.6-147
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - ALTPHP-1082: Add alt-php-pdo requires for alt-php-firebird


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-161
changelog:
  - Fix for hardened PHP
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-163
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.1.6-169
changelog:
  - Fix for hardened PHP
  - CVE-2022-31629: use stack instead of heap, check correct one var
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.1.6-171
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.1.6-35
changelog:
  - disable firebird/interbase in CL7
  - fix db4 requires for CL7
  - remove redunant libmm-devel require
  - move /var/lib/php/session to /opt/alt/php55/var/lib/php/session
  - add filde-devel to build requires
  - change __GMP_BITS_PER_MP_LIMB to GMP_LIMB_BITS in ext/gmp/*
  - use autoconf213 and autoheader213


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.1.6-36
changelog:
  - add /opt/alt/php51/usr/include/php/ext/date to includes
  - use autoconf213 adn autoheader213 for all builds


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.1.6-32
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-12
changelog:
  - APM downgraded from 1.1.0beta1 to 1.1.0RC2
  - doublemetaphone updated from 1.0.0 to 1.0.1
  - igbinary updated from 1.1.1 to 1.2.1
  - xdebug updated from 2.2.4 to 2.2.5
  -


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-12
changelog:
  - APM downgraded from 1.1.0beta1 to 1.1.0RC2
  - doublemetaphone updated from 1.0.0 to 1.0.1
  - igbinary updated from 1.1.1 to 1.2.1
  - xdebug updated from 2.2.4 to 2.2.5


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-19
changelog:
  - lzf updated from 1.6.2 to 1.6.3
  - timezonedb updated from 2015.4 to 2015.7
  - gnupg-1.3.6 added to builtin modules


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-45
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-47
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Added dependency to new xdebug extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-51
changelog:
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1950: Moved inotify to separate package


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.2.17-178
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - ALTPHP-1082: Add alt-php-pdo requires for alt-php-firebird and alt-php-sqlite


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.2.17-182
changelog:
  - ALTPHP-1164: Update hardened php
  - ALTPHP-1154: Fix libxml requires
  - ALTPHP-1156: Get rid of manipulations with enabling extensions (mysqli.so) in default.ini


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-188
changelog:
  - Fix for Harden PHP
  - CVE-2021-21704: fix errors in pdo_firebird extension
  - CVE-2021-21705: add user name and password validation in filters module


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.2.17-189
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.2.17-198
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-203
changelog:
  - Security fixes
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-206
changelog:
  - Security fixes
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-207
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    injection


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-208
changelog:
  - Security fixes
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-210
changelog:
  - Security fixes
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-211
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-212
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-214
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-215
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-221
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.2 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-223
changelog:
  - ELS-2362: build litespeed SAPI with devtoolset-7 on CL6 (lsapi uses C11 __atomic builtins requiring gcc >= 4.7)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-225
changelog:
  - CVE-2013-4113: ext/xml heap overflow in xml_parse_into_struct() via deeply
    nested XML - parser->ltags[parser->level-1] was written past the XML_MAXLEVEL
    (255) slot allocation. Backport upstream 7d163e8 (truncate results at depth
    255 and emit "Maximum depth exceeded - Results truncated" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-226
changelog:
  - CVE-2014-3515: SplObjectStorage::unserialize() type confusion in
    ext/spl/spl_observer.c — the unserialized members payload was passed to
    zend_hash_copy() without checking it is an array. Backport the
    spl_observer.c half of upstream a374dfab (reject non-IS_ARRAY members).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-228
changelog:
  - CVE-2016-5385: httpoxy - PHP populated HTTP_PROXY from the untrusted "Proxy"
    request header in CGI/FastCGI environments, letting a remote attacker
    redirect an application's outbound HTTP traffic to an arbitrary proxy
    (_SERVER/_ENV and getenv() now honor HTTP_PROXY only from the real
    local environment; sapi_getenv() never returns HTTP_PROXY)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-230
changelog:
  - CVE-2012-0057: XSLT (libxslt) write access - XSLTProcessor transformations
    could create/overwrite files and write to the network via the stylesheet
    output/document extensions; write file, create directory and network write
    are now forbidden by default, with XsltProcessor::setSecurityPrefs()/
    getSecurityPrefs() and XSL_SECPREF_* constants to override
  - CVE-2014-2497: NULL pointer dereference in gdImageCreateFromXpm() when a
    crafted XPM image contains a color entry with no c_color; imagecreatefromxpm()
    now fails cleanly instead of crashing
  - CVE-2014-9709: out-of-bounds buffer read in the libgd GIF decoder GetCode_()
    (ext/gd/libgd/gd_gif_in.c) on a crafted GIF; reads past the static buffer are
    now bounded (CSD_BUF_SIZE)
  - CVE-2015-0232: use of an uninitialized pointer in exif_process_unicode()
    leading to an invalid free / potential code execution via a crafted EXIF
    tag; xp_field->value is now initialized


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-231
changelog:
  - CVE-2012-0789: memory leak in the date/time extension - parsing a date
    string with an embedded timezone identifier (e.g. strtotime with
    "Europe/Paris") allocated a fresh timelib_tzinfo on every call that was
    never freed, letting a remote attacker exhaust memory; timezone lookups
    now go through the cached php_date_parse_tzfile_wrapper (upstream bug
    - CVE-2012-0831: magic_quotes_gpc could be re-enabled during request
    startup because it was reset with a direct PG() write instead of going
    through the INI subsystem while importing environment/server variables;
    now switched off via zend_alter_ini_entry_ex() (upstream bug #323016;
    the fpm SAPI hunk is dropped as 5.2 ships no fpm)
  - CVE-2014-4721: phpinfo() type confusion / information leak - the
    PHP_SELF, PHP_AUTH_TYPE, PHP_AUTH_USER and PHP_AUTH_PW request variables
    were printed with Z_STRVAL_PP() without a type check; each lookup now
    also requires Z_TYPE_PP(data) == IS_STRING (upstream bug #67498)


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 5.2.17-232
changelog:
  - CLOS-5751: isolated lsphp re-execs via its handler dir (cwd) so the per-domain PHP version applies under LSWS isolation
  - CLOS-5752: fix outside-cagefs site-token shard (uid/100 -> uid%100) to match cagefs.server get_prefix and clcagefslib


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-235
changelog:
  - CVE-2026-7260: phar circular symlink chain caused unbounded recursion in
    phar_get_link_source(); the chain is now walked iteratively with Floyd
    cycle detection and a cycle resolves to NULL. Applies to ext/phar/util.c
    from the bundled PECL phar-2.0.0, which is unpacked before patching.
    The NULL guard in phar_get_entry_data() that this relies on is already
    present via php-5.2.17-bug69720.patch. Adds
    ext/phar/tests/tar/gh21986.phpt, taken from the earlier public fix
    b2de3cf170 because it needs no binary fixture, adapted for 5.2
    (--SKIPIF-- instead of --EXTENSIONS--, dirname(__FILE__) instead of
    __DIR__); %check picks it up automatically from this patch
  - CVE-2026-9672: bundled libgd GIF LZW decoder fixes in
    ext/gd/libgd/gd_gif_in.c - clear the whole suffix table
    (sd->table[1][i], not sd->table[1][0]), stop decoding unconditionally at
    the LZW end code, and zero-initialise the LZW_STATIC_DATA scratch struct
    in ReadImage()


author: Dmitry Kasyanov <dkasyanov@cloudlinux.com> 5.2.17-36
changelog:
  - enable t1lib build
  - build sockets as shared extension
  - add paches for CVE-2013-4248 and CVE-2013-6420


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.2.17-39
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.
  - ALTPHP-1769: Build for RHEL 9.


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.8.0-3
changelog:
  - Fix build on el10: relax -Werror=incompatible-pointer-types for c-ares 1.34 ares_callback signature change


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-121
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-123
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-129
changelog:
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-131
changelog:
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-132
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-134
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-135
changelog:
  - ALTPHP-2013: Moved APC, ares, bcompiler, bloomy, big_int, bz2_filter, coin_acceptor to separate packages; add runtime requires


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-76
changelog:
  - APM upgraded from 1.1.0beta1 to 1.1.0RC2
  - doublemetaphone updated from 1.0.0 to 1.0.1
  - igbinary updated from 1.1.1 to 1.2.1
  - memcached updated from 2.1.0 to 2.2.0
  - mongo updated from 1.5.1 to 1.5.7
  - timezonedb updated from 2014.2 to 2014.9
  - xdebug updated from 2.2.4 to 2.2.5
  - yaf updated from 2.2.9 to 2.3.2
  - ZendOpcache updated from 7.0.2 to 7.0.3
  - rar-3.0.2 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-80
changelog:
  - mongo updated from 1.5.7 to 1.6.0
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb updated from 2014.9 to 2015.1
  - xdebug updated from 2.2.5 to 2.2.7
  - ZendOpcache updated from 7.0.3 to 7.0.4


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-80.el7.centos
changelog:
  - mongo updated from 1.5.7 to 1.6.0
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb updated from 2014.9 to 2015.1
  - xdebug updated from 2.2.5 to 2.2.7
  - ZendOpcache updated from 7.0.3 to 7.0.4
  -


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-86
changelog:
  - lzf updated from 1.6.2 to 1.6.3
  - timezonedb updated from 2015.4 to 2015.7
  - yaf updated from 2.3.2 to 2.3.5


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.4.4-20
changelog:
  - ALTPHP-2455: Allow CL10 (el10) build for alt-php53; keep php52/54/55 excluded (not on CL10).
  - ALTPHP-2455: Add -Wno-incompatible-pointer-types for GCC 15 (const mismatch in imagick_file.c).
  - ALTPHP-2455: Link static ImageMagick delegate libs explicitly on el10 from bundled .la dependency_libs (fixes undefined symbols jpeg_resync_to_restart / ZSTD_initCStream / SharpYuvGetConversionMatrix).


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> 3.4.4-25
changelog:
  - ALTEAPLN-4: rebuilt against alt-ImageMagick 7.1.2-29.2 (Fix grid-HEIC decode deadlock under constrained nproc)


author: Eduard Chiganov <echiganov@cloudlinux.com> 2.1.0-1
changelog:
  - ALTPHP-1654: Newer version of memcached for alt-php 74-82.
  - EA4D-454: Create alt-phpXX-pecl-memcached.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.2.8-11
changelog:
  - ALTPHP-2283: Fix test crash from missing require_once files; fix testObject for Redis 7+ listpack.
  - ALTPHP-2283: Add PHP 5.2 early-exit to avoid running tests requiring 5.3+ features.


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.3.29-7
changelog:
  - disable firebird/interbase in CL7
  - fix db4 requires for CL7
  - remove redunant libmm-devel require
  - move /var/lib/php/session to /opt/alt/php55/var/lib/php/session


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.3.29-141
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - ALTPHP-1082: Add alt-php-pdo requires for alt-php-sqlite, alt-php-mysqlnd and alt-php-firebird


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-152
changelog:
  - CVE-2021-21703: fix error in php fpm shared memory organization leading to privilage escalation
  - CVE-2021-21707: fix handling of paths with percent encoded NULL byte


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-167
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-1713: add ext/curl/php_curl.h to devel sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-173
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-175
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-178
changelog:
  - Security fixes
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-179
changelog:
  - Security fixes
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-185
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.3.29-186
changelog:
  - ALTPHP-2049: Change method of creating php_handlers for plesk.
  - ALTPHP-2060: Rename alt-phpXY-fpm to alt-phpXY-php-fpm.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-189
changelog:
  - ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-190
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php53/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-193
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.3 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.3 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-201
changelog:
  - CVE-2015-4604: fileinfo/libmagic out-of-bounds read in mcopy() FILE_SEARCH/FILE_REGEX
    (clamp offset to nbytes; backport of upstream file(1) f938112c)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-203
changelog:
  - CVE-2016-5385: httpoxy - do not trust client-supplied Proxy header exposed as the HTTP_PROXY environment variable


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-203.1
changelog:
  - ALTPHP-2352: fix %changelog chronological order (2352 entry was dated before
    the CVE-2015-4604 entry below it) to unbreak the SRPM build on CL7/CL8


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-204
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. Adopt the same FPM layout as php70+: a global php-fpm.conf that includes php-fpm.d/*.conf plus a default www.conf pool listening on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port and per-domain pools in php-fpm.d still load. On Debian-like distros the pool group is set to nogroup (no nobody group). Drop the now redundant php-fpm.conf.default/.plesk.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-205
changelog:
  - CVE-2014-1943: fileinfo denial of service (infinite recursion) via a crafted
    indirect-offset magic rule; add FILE_INDIRECT offset==0 guard and bound the
    recursion depth
  - CVE-2013-7345, CVE-2014-3538: fileinfo denial of service (CPU consumption) via
    catastrophic regex backtracking on the awk-rule detector; cap the regex search
    window (CVE-2014-3538 is the complete fix for the incomplete CVE-2013-7345 fix)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-206
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-
    padding ciphers (aes-*-wrap-pad); the output buffer was sized data_len + one
    block but RFC 5649 wrap-pad output can exceed that, so reserve an extra
    EVP_CIPHER_block_size() for EVP_CIPH_WRAP_MODE ciphers


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-207
changelog:
  - ALTPHP-2471: fix alt-php53-php-fpm %post scriptlet failure (exit status 1) on
    install. The postinstall chmod loop walks
    /opt/cpanel/alt-php53/root/usr/var/run/php-fpm, but that dir was never created,
    so the trailing test left the scriptlet non-zero. Create and own the cPanel
    php-fpm socket dir (etc/php-fpm.d + usr/var/run/php-fpm), ship an empty _.conf,
    and add the /opt/cpanel php-fpm.d include glob to php-fpm.conf. Parity with php56+.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-209
changelog:
  - CVE-2026-9672: bundled libgd GIF LZW decoder defects in
    ext/gd/libgd/gd_gif_in.c; reset table[1][i] instead of table[1][0] when
    clearing the LZW table, stop decoding once the LZW end code is seen instead of
    falling through with a stale code, and zero-initialise the LZW_STATIC_DATA
    scratch struct in ReadImage()
  - CVE-2026-7260: phar stack exhaustion (unbounded recursion) on circular symlink
    chains in tar-based archives (GHSA-vc5h-9ppw-p5f3); replace the self-recursion
    in phar_get_link_source() with an iterative Floyd cycle-detection walk over a
    new phar_follow_one_link() helper, and restore the path separator in
    phar_get_link_location() so that helper is idempotent


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-210
changelog:
  - ALTPHP-2571: point session.save_path in the php.ini shipped on Debian/Ubuntu
    at this version's own /opt/alt/php53/var/lib/php/session; it named php55's
    directory, so sessions were written to another runtime's tree
  - ALTEAPLN-29: write a pid file. php-fpm.conf is generated from the upstream
    default where pid is commented out, so the master created none and
    alt-php53-fpm failed to start; set it to /var/run/alt-php53-fpm.pid,
    matching the PIDFile line in the unit and the php56+ layout
  - ALTEAPLN-3: drop the hard Requires on alt-php53-fpm from alt-php53-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php53/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php53-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php53-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: give the FPM master its own error_log. php-fpm.conf is
    generated from the upstream default where error_log is commented out, so
    php53, php54 and php55 all fell back to the built-in /var/log/php-fpm.log
    and wrote to one shared file; set it to /var/log/alt-php53-error.log,
    matching php56+. Also ship the FPM logrotate config that ALTPHP-2168 added
    for php56+ but skipped for 5.3-5.5, so the log is now rotated
    The config sets rotate 7 so a week of error logs is kept: logrotate
    defaults to rotate 0, which deletes the previous log on every rotation
    instead of retaining any history


author: Matthias Saou <http://freshrpms.net/> 1:0.9.6.1-7
changelog:
  - Add missing tmpwatch requirement (#711236).
  - Stop using macros for simple commands, following recent guidelines changes.


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.0.0-5.dfe1ab17b0
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/geos.ini
    so geos loads outside cagefs/panel.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1.0.0-6.dfe1ab17b0
changelog:
  - CLOS-5732: rebuild against alt-libgeos 3.14.1 (EA4D-913). The C++ library soname
    changed to libgeos.so.3.14, so a geos.so built against 3.6.2 fails to load with
    "libgeos-3.6.2.so: cannot open shared object file". Rebuilt, the extension links
    only the stable C API libgeos_c.so.1 and is portable across libgeos versions.


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 3.1.3-3
changelog:
  - Remove failing eio tests (custom_basic, grp_add, open_error, seek) on CL10 due to floating-point related issues in eio environment


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.1.4-1
changelog:
  - ALTPHP-2492: Update to 3.1.4 version
  - php85-fix.patch dropped (fix absorbed upstream in 3.1.4)
  - Exclude (php53/54/55, platform) combos with no base alt-php runtime
  - Skip kernel-flaky tests on newer platforms: fork.phpt (el10); via debian/rules
    the floating eio-env set (custom_basic/grp_add/open_error/seek) + fork on
    ubuntu24 (kernel 6.8, same set already removed on el10/debian13) and fork on
    debian13; eio_write_variation.phpt on php<=53 deb (PHP 5.4+ syntax). All are
    env/test artifacts, not eio functional regressions.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.1.4-2
changelog:
  - ALTPHP-2201: Fix the root cause of the "floating eio environment" test
    failures instead of deleting the affected tests.
    PHP_EIO_RET_IF_FAILED() inspected req->result right after libeio's SEND
    macro had already called eio_submit(), so when a worker thread finished the
    syscall first the extension returned FALSE for a request that had actually
    succeeded (eio_read/eio_open/eio_seek/eio_custom all return non-zero on
    success). eio_grp_add() then got a bool, the group lost a member request and
    the run ended in SIGSEGV. Submission can only fail with a NULL req, so that
    is now the only condition checked (eio-req-result-race.patch).
  - Fix fork.phpt deleting the parent process's file from the forked child while
    the parent's write callback still stats and reads it (fork-test-unlink-race.patch).
  - Restore eio_grp_add/eio_open_error/eio_seek and fork.phpt on el10, debian13
    and ubuntu24_04 - they are no longer removed on any platform.
  - Skip eio_custom_basic.phpt on all platforms: eio_custom() runs userspace PHP
    from a libeio worker thread with no synchronisation, so it races with the main
    thread over the output buffer. Reported upstream.


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-91
changelog:
  - APM updated from 1.1.0beta1 to 1.1.0RC2
  - timezonedb updated from 2014.7 to 2014.9
  - APCu updated from 4.0.6 to 4.0.7
  - propro-1.0.0 added to builtin modules
  - raphf-1.0.4 added to builtin modules
  - pecl_http-2.1.3 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-94
changelog:
  - APM updated from 1.1.0beta1 to 1.1.0RC2
  - timezonedb updated from 2014.7 to 2014.9
  - APCu updated from 4.0.6 to 4.0.7
  - rar-3.0.2 added to builtin modules
  - pecl_http-2.1.3 added to builtin modules
  - propro-1.0.0 added to builtin modules
  - raphf-1.0.4 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-96
changelog:
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  -


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-99
changelog:
  - mongo updated from 1.5.8 to 1.6.0
  - timezonedb updated from 2014.10 to 2015.1
  - xdebug updated from 2.2.6 to 2.2.7


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-96
changelog:
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - ZendOpcache updated from 7.0.3 to 7.0.4
  - libevent-0.1.0 added to builtin modules


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-101
changelog:
  - jsmin updated from 1.0.0 to 1.1.0
  - redis updated from 2.2.5 to 2.2.7
  - timezonedb updated from 2015.1 to 2015.2
  - mongo updated from 1.6.0 to 1.6.6


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-103
changelog:
  - pecl_http 2.1.3 extension added (was missing after 1-94 version)
  - raphf 1.0.4 extension added (was missing after 1-94 version)
  - rar 3.0.2 extension added (was missing after 1-94 version)


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-104
changelog:
  - mongo updated from 1.6.7 to 1.6.11
  - stomp updated from 1.0.6 to 1.0.8
  - timezonedb updated from 2015.4 to 2015.6.1
  - uuid updated from 1.0.3 to 1.0.4
  - yaf updated from 2.3.2 to 2.3.5
  - raphf updated from 1.0.4 to 1.1.0
  - pecl_http updated from 2.1.3 to 2.5.2


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-106
changelog:
  - eio updated from 1.2.5 to 1.2.6
  - lzf updated from 1.6.2 to 1.6.3
  - timezonedb updated from 2015.6.1 to 2015.7
  - pecl_http updated from 2.5.2 to 2.5.3


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-112
changelog:
  - ssh2 updated from 0.12 to 0.13
  - jsmin updated from 1.1.0 to 2.0.1
  - APCu updated from 4.0.7 to 4.0.11
  - Bitset updated from 1.0.1 to 2.0.3
  - timezonedb updated from 2015.7 to 2016.4
  - gender updated from 1.0.0 to 1.1.0
  - stats updated from 1.0.3 to 1.0.5
  - mongo updated from 1.6.11 to 1.6.14
  - radius updated from 1.2.7 to 1.3.0
  - redis updated from 2.2.7 to 2.2.8
  - lzf updated from 1.6.2 to 1.6.5
  - yaml-1.2.0 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-114
changelog:
  - timezonedb updated from 2016.6 to 2016.8
  - pdflib updated from 3.0.4 to 4.0.1
  - yaz updated from 1.1.9 to 1.2.1
  - yaml updated from 1.2.0 to 1.3.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1-123
changelog:
  - move APC from alt-phpXY-pecl-apc to the current package
  - move dbase from alt-phpXY-pecl-dbase to the current package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-155
changelog:
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-157
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-158
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-159
changelog:
  - ALTPHP-1087: Removed non-functional amqp package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-161
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-162
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-164
changelog:
  - ALTPHP-2014: Moved out extensions: crack, doublemetaphone, functional, haru, hidef, huffman, idn, inclued


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-87
changelog:
  - doublemetaphone updated from 1.0.0 to 1.0.1
  - igbinary updated from 1.1.1 to 1.2.1
  - mongo updated from 1.5.1 to 1.5.5
  - timezonedb updated from 2014.2 to 2014.7
  - xdebug updated from 2.2.4 to 2.2.5
  - ZendOpcache updated from 7.0.2 to 7.0.3
  - Add APCu extension


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 4.3.0-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.1.6-1
changelog:
  - ALTPHP-1935: Support for tideways_xhprof for alt-php84.
  - ALTPHP-1957: Create alt-phpXX-pecl-xhprof-extension.


author: Oleg Cherniy <oleg.cherniy@gmail.com> 0.8.0.20121218-0
changelog:
  - Update to last alfa relase 0.8.0 from github 20121218
  - Removed unnecessary intermediate zvals when retrieving array items reducing overall memory comsumption
  - Removed unnecessary intermediate zvals when retrieving object members reducing overall memory comsumption
  - Removed PH_CHECK constant making simpler calling functions and methods internally
  - Added Phalcon\Text::increment, Phalcon\Text::random, Phalcon\Text::lower, Phalcon\Text::upper, Phalcon\Text::
  - Added Phalcon\Config::merge to merge recursively a configuration with another one
  - Added Phalcon\Config::toArray method to recursively convert an object to an array
  - Improved Volt runtime error/syntax error messages including always line and file
  - Added Phalcon\Security providing a set of functions to improve the security in Phalcon applications like bcry
  - Added Phalcon\Mvc\View\Engine\Volt\Compiler::addFunction to register user functions
  - Added Phalcon\Mvc\View\Engine\Volt\Compiler::addFilter to register user filters
  - Added Phalcon\Mvc\Model\Relation as class for model relationships
  - Added support for aliasing of model relationships in Phalcon\Mvc\Model
  - Relationships in Models are now case insensitive to be compliant with the PHP standard
  - Looking for a relationship in the models manager now performs a search in O(1) order
  - Added "cache" statement in Volt to cache view fragments
  - Added "do" statement to Volt to execute an expression without printing its evaluated value
  - Added "include" statement to Volt to perform a statical include of other views in compiling time
  - Added an internal method cache to speed up overall execution
  - Reduced memory allocation when reading/writing properties from objects
  - Added missing Phalcon\Mvc\Collection::getMessages() and Phalcon\Mvc\Collection::appendMessage
  - Added Phalcon\Config::get method to obtain a value from the configuration object setting a default value
  - Added an optional default value to Phalcon\Session\Adapter::get if this method returns a null value
  - Added OO methods to Phalcon\Session\Bag::get
  - Added an optional default value to Phalcon\Session\Bag::get if this method returns a null value
  - Added multiple inheritance and two-way replacement of blocks in Volt
  - Added evaluation of "tests" to Volt
  - Added support to call methods and read properties in sub-objects in Volt
  - Volt now checks if a variable name is a registered service and injects it to the views
  - The "For" statement in Volt now supports get the current key and add an optional if evaluation
  - Added support to read PHP constants in Volt
  - Added "prefix" option to Volt, allowing prefixing the resulting compiled paths
  - Now registerAutoloader in module definitions receives the services container (DI) as first parameter
  - Fixed skipAttributes methods in Phalcon\Mvc\Model
  - Fixed use of muliples databases in the ORM
  - Fixed use of a common events manager databases in the ORM
  - Now Phalcon\Mvc\Router can be configured to remove extra slashes passed in the URI
  - In Phalcon\Mvc\Router the default route is '/' when none is giving


author: Oleg Cherniy <oleg.cherniy@gmail.com> 0.8.0.20130110-0
changelog:
  - Update to version 0.8.0b1
  - Improved Phalcon\Escaper, this component provides contextual escaping of different kinds of texts (CSS, Javascript, URL, HTML Attributes etc)
  - Added serialization of Mvc\Collection instances
  - Added Phalcon\Mvc\View::setLayout to change the layout instead of looking for a controller with the same name as the latest controller dispatched
  - Now is possible to pass an option called 'options' to any of the Phalcon\Db\Adapter\Pdo adapters to set extra PDO options in the connection
  - Removed filtering of keys from Phalcon\Cache\Backend\File
  - Support for creating groups of routes using Phalcon\Router\Route\Group
  - Added Phalcon\Mvc\Micro middleware events
  - Implemented virtual scopes in Phalcon\Mvc\View

  - Update to version 0.8.0a2
  - Added support for behaviors in the ORM including: Phalcon\Mvc\Model\Behavior\Timestampable and Phalcon\Mvc\Model\Behavior\SoftDelete
  - Improved serialization of Mvc\Model instances and complex resultsets
  - Added an option to change the layouts directory and partials directory in Phalcon\Mvc\View
  - Added an option to disable an specific level of rendering in Phalcon\Mvc\View
  - Added Phalcon\Mvc\Model::setup to globally enable/disable specific features in the ORM
  - Added Phalcon\Db::setup to globally enable/disable specific features in the database component
  - Added Phalcon\Mvc\Model\Resultset::delete to delete every complete object returned in a resultset using a transaction
  - Added Phalcon\Mvc\Model\Resultset::update to update every complete object returned in a resultset using a transaction
  - Added support for converters in Phalcon\Mvc\Router
  - Added Phalcon\Mvc\View::getRender to return contents of a template into a string
  - Added methods to support HTTP method PATCH
  - Now Phalcon\Mvc\Model uses the last part of a namespaced class name as source name
  - Phalcon\DI now implements ArrayAccess to get/set services
  - Phalcon\Mvc\Micro now implements ArrayAccess to get services from the related services container
  - Improved building of complex service definitions in the DI
  - Added toArray method to Phalcon\Mvc\Model instances
  - Added autoescape mode in Volt


author: Oleg Cherniy <oleg.cherniy@gmail.com> 0.9.0.20130201-0
changelog:
  - Update to version 0.9.0b2
  - Added 'elseif' statement to Volt
  - Changed static key in Volt's 'cache' to any valid expression
  - Added Phalcon\Logger\Adapter\Syslog and Phalcon\Logger\Adapter\Stream to Phalcon\Logger
  - Added Phalcon\Logger\Multiple to send logs to multiples adapters
  - Added formatters abstraction to Phalcon\Logger, now including: Phalcon\Logger\Formatter\Line, Phalcon\Logger\Formatter\Json and Phalcon\L
  - Added Phalcon\Annotations\Adapter\Files to Phalcon\Annotations, this adapter stores the annotations in PHP files

  - Update to version 0.9.0b1
  - Added Phalcon\Annotations, a general purpose component to read annotations from docblocks
  - Phalcon\Mvc\Model now supports saving related records using magic methods with a unique call to 'save'
  - Adding autoescaping option to Phalcon\Tag
  - Added andWhere/orWhere to Phalcon\Mvc\Model\Criteria
  - Added passing an HTTP body to the Phalcon\Http\Response's constructor
  - Phalcon\Mvc\View is now able to pass variables to the views using magic methods
  - Support for slice with filter and built-in syntax in Volt
  - Added magic methods in the ORM to find/findFirst by a single field
  - Improved XSS protection in Phalcon\Tag
  - Implemented queuing events with priorities in Phalcon\Events
  - Implemented collecting of returned responses in Phalcon\Events
  - Added toArray method to Phalcon\Mvc\Model\Resultset classes
  - Added hydration modes to Phalcon\Mvc\Model\Resultset (HYDRATE_RECORDS, HYDRATE_ARRAYS, HYDRATE_OBJECTS)


author: Oleg Cherniy <oleg.cherniy@gmail.com> 0.9.0.20130206-0
changelog:
  - Update to last stable release
  - Support for reusable records. A relation can be marked to cache in memory the records to speedup getting related records


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.4.45-134
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.4.45-162
changelog:
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.4.45-173
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php54/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-178
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.4 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.4 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-186
changelog:
  - CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with aes-*-wrap-pad by reserving an extra cipher block for RFC 5649 padded key-wrap output


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.4.45-187
changelog:
  - ALTPHP-2471: fix alt-php54-php-fpm %post scriptlet failure (exit status 1) on
    install. The postinstall chmod loop walks
    /opt/cpanel/alt-php54/root/usr/var/run/php-fpm, but that dir was never created,
    so the trailing test left the scriptlet non-zero. Create and own the cPanel
    php-fpm socket dir (etc/php-fpm.d + usr/var/run/php-fpm), ship an empty _.conf,
    and add the /opt/cpanel php-fpm.d include glob to php-fpm.conf. Parity with php56+.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-189
changelog:
  - CVE-2026-17543: SQL injection in ext/pgsql via an E'...' backslash breakout
    (GHSA-7qpv-r5mr-78m4); php_pgsql_add_quotes() wrapped a
    PQescapeStringConn()-escaped value in an E'...' literal, where a backslash
    still acts as an escape character, so a value such as "zzz\' OR 1=1 --" broke
    out of the literal and injected SQL through pg_convert(), pg_insert(),
    pg_update(), pg_delete() and pg_select(); emit a plain '...' literal instead,
    which is what PQescapeStringConn() is meant to be paired with
  - CVE-2026-9672: bundled libgd GIF LZW decoder defects in
    ext/gd/libgd/gd_gif_in.c; reset table[1][i] instead of table[1][0] when
    clearing the LZW table, stop decoding once the LZW end code is seen instead of
    falling through with a stale code, and zero-initialise the LZW_STATIC_DATA
    scratch struct in ReadImage()
  - CVE-2026-7260: phar stack exhaustion (unbounded recursion) on circular symlink
    chains in tar-based archives (GHSA-vc5h-9ppw-p5f3); replace the self-recursion
    in phar_get_link_source() with an iterative Floyd cycle-detection walk over a
    new phar_follow_one_link() helper, and restore the path separator in
    phar_get_link_location() so that helper is idempotent


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.4.45-191
changelog:
  - ALTPHP-2571: point session.save_path in the php.ini shipped on Debian/Ubuntu
    at this version's own /opt/alt/php54/var/lib/php/session; it named php55's
    directory, so sessions were written to another runtime's tree
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php54/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-29: write a pid file. php-fpm.conf is generated from the upstream
    default where pid is commented out, so the master created none and
    alt-php54-fpm failed to start; set it to /var/run/alt-php54-fpm.pid,
    matching the PIDFile line in the unit and the php56+ layout
  - ALTEAPLN-3: drop the hard Requires on alt-php54-fpm from alt-php54-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php54/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php54-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php54-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: give the FPM master its own error_log. php-fpm.conf is
    generated from the upstream default where error_log is commented out, so
    php53, php54 and php55 all fell back to the built-in /var/log/php-fpm.log
    and wrote to one shared file; set it to /var/log/alt-php54-error.log,
    matching php56+. Also ship the FPM logrotate config that ALTPHP-2168 added
    for php56+ but skipped for 5.3-5.5, so the log is now rotated
    The config sets rotate 7 so a week of error logs is kept: logrotate
    defaults to rotate 0, which deletes the previous log on every rotation
    instead of retaining any history


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 0.14.2-1
changelog:
  - ALTPHP-2268: rebuild as PECL brotli extension
  - ALTPHP-2268: rename package to alt-php*-pecl-brotli


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-94
changelog:
  - pecl_http updated from 2.5.2 to 2.5.3
  - eio updated from 1.2.5 to 1.2.6
  - timezonedb updated from 2015.6.1 to 2015.7
  - yaf updated from 2.3.2 to 2.3.5


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-100
changelog:
  - ssh2 updated from 0.12 to 0.13
  - jsmin updated from 1.1.0 to 2.0.1
  - xdebug updated from 2.3.3 to 2.4.0
  - redis updated from 2.2.7 to 2.2.8
  - APCu updated from 4.0.7 to 4.0.11
  - Bitset updated from 1.0.1 to 2.0.3
  - lzf updated from 1.6.2 to 1.6.5
  - timezonedb updated from 2015.7 to 2016.4
  - gender updated from 1.0.0 to 1.1.0
  - stats updated from 1.0.3 to 1.0.5
  - mongo updated from 1.6.11 to 1.6.14
  - radius updated from 1.2.7 to 1.3.0
  - yaml-1.2.0 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-102
changelog:
  - timezonedb updated from 2016.6 to 2016.8
  - pdflib updated from 3.0.4 to 4.0.1
  - oci8 updated from 2.0.8 to 2.0.12
  - xdebug updated from 2.4.0 to 2.4.1
  - yaz updated from 1.1.9 to 1.2.1
  - yaml updated from 1.2.0 to 1.3.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-105
changelog:
  - libsodium 1.0.6 extension added
  - imagick updated from 3.4.3RC1 to 3.4.3RC4
  - mongodb updated from 1.1.9 to 1.2.4


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-144
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Updated imagick to 3.7.0


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-150
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-151
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-154
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package
  - ALTPHP-1822: Moved oci8 to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-77
changelog:
  - doublemetaphone updated from 1.0.0 to 1.0.1
  - igbinary updated from 1.1.1 to 1.2.1
  - mongo updated from 1.5.1 to 1.5.5
  - timezonedb updated from 2014.2 to 2014.7
  - xdebug updated from 2.2.4 to 2.2.5
  - ZendOpcache updated from 7.0.2 to 7.0.3
  - add APCu extension


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-89
changelog:
  - jsmin updated from 1.0.0 to 1.1.0
  - redis updated from 2.2.5 to 2.2.7
  - timezonedb updated from 2015.1 to 2015.2
  - mongo updated from 1.6.0 to 1.6.6
  - xdebug updated from 2.2.7 to 2.3.2


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-90
changelog:
  - timezonedb updated from 2015.2 to 2015.4
  - trader updated from 0.3.0 to 0.4.0
  - mongo updated from 1.6.6 to 1.6.7
  - ZendOpcache updated from 7.0.4 to 7.0.5


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-91
changelog:
  - pecl_http 2.5.2 added (was missing after some update)
  - raphf 1.1.0 added (was missing after some update)


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-92
changelog:
  - mongo updated from 1.6.7 to 1.6.11
  - stomp updated from 1.0.6 to 1.0.8
  - timezonedb updated from 2015.4 to 2015.6.1
  - uuid updated from 1.0.3 to 1.0.4
  - xdebug updated from 2.3.2 to 2.3.3


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1:5.5.25-2
changelog:
  - group is changed to linksafe
  - add linksafe configuration to /etc/sysctl.conf in pre section
  - SCL imitation


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-126
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Expand allowed version list for bison package


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-131
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.5.38-141
changelog:
  - Security fixes
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-153
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php55/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.5.38-155
changelog:
  - ALTPHP-2340: Add Conflicts with zend-guard-loader < 7.0.0-9 to opcache
    subpackage to block co-install with broken old zend-guard-loader versions


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-159
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.5 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.5 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-160
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin
  - Add remaining utf8mb4_0900 collation ids 304-323 to mysqlnd charset table (MySQL 8.0.x/8.4)


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-161
changelog:
  - CLOS-4506: Fix lsphp site-isolation ctor overwriting per-vhost DOCUMENT_ROOT
  - ALTPHP-2448: Gate %postun per-user PHP Selector reset on Elevate upgrade markers


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-164
changelog:
  - CVE-2016-1283: heap buffer overflow in bundled PCRE 8.38 pcre_compile2()
    via a crafted regex with multiple identically named nested groups
    (ELSLANG-50866, ELSLANG-40077, ELSLANG-40080, ELSLANG-40110, ELSLANG-40125)
    - debian/patches/php-5.5-CVE-2016-1283.patch: backport PCRE 8.39 rev 1636 /
      PHP bug #75207 - remove the "else" so the named-group recno scan is always
      performed, over-allocating rather than under-allocating. PHP 5.5 was EOL
      before the bug #75207 backport landed for 5.6/7.0/7.1.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-165.1
changelog:
  - ALTPHP-2352: fix %changelog chronological order (2352 entry was dated before
    the CVE-2016-1283 entry below it) to unbreak the SRPM build on CL7/CL8


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-167
changelog:
  - CVE-2026-14355: heap buffer overflow in openssl_encrypt()/openssl_decrypt()
    with AES key-wrap-with-padding ciphers (aes-*-wrap-pad, RFC 5649) when built
    against OpenSSL 3.x (ELSLANG-59751, ELSLANG-59676, ELSLANG-59675,
    ELSLANG-59687, ELSLANG-59692)
    - debian/patches/php-5.5-CVE-2026-14355.patch: backport upstream
      cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187) - reserve one extra
      EVP_CIPHER_block_size for EVP_CIPH_WRAP_MODE ciphers at the output-buffer
      allocation. 5.5 has no php_openssl_cipher_update() helper, so the fix is
      applied to both inline call sites (openssl_encrypt + openssl_decrypt).


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-168
changelog:
  - ALTPHP-2471: fix alt-php55-php-fpm %post scriptlet failure (exit status 1) on
    install. The postinstall chmod loop walks
    /opt/cpanel/alt-php55/root/usr/var/run/php-fpm, but that dir was never created,
    so the trailing test left the scriptlet non-zero. Create and own the cPanel
    php-fpm socket dir (etc/php-fpm.d + usr/var/run/php-fpm), ship an empty _.conf,
    and add the /opt/cpanel php-fpm.d include glob to php-fpm.conf. Parity with php56+.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-172
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php55/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-29: write a pid file. php-fpm.conf is generated from the upstream
    default where pid is commented out, so the master created none and
    alt-php55-fpm failed to start; set it to /var/run/alt-php55-fpm.pid,
    matching the PIDFile line in the unit and the php56+ layout
  - ALTEAPLN-3: drop the hard Requires on alt-php55-fpm from alt-php55-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php55/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php55-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php55-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: give the FPM master its own error_log. php-fpm.conf is
    generated from the upstream default where error_log is commented out, so
    php53, php54 and php55 all fell back to the built-in /var/log/php-fpm.log
    and wrote to one shared file; set it to /var/log/alt-php55-error.log,
    matching php56+. Also ship the FPM logrotate config that ALTPHP-2168 added
    for php56+ but skipped for 5.3-5.5, so the log is now rotated
    The config sets rotate 7 so a week of error logs is kept: logrotate
    defaults to rotate 0, which deletes the previous log on every rotation
    instead of retaining any history


author: Eduard Abdullin <eabdullin@cloudlinux.com> 1-127
changelog:
  - ALTPHP-1195: Updated alt-ImageMagick require to 7.1.0 version
  - ALTPHP-1188: Update imagick to 3.5.1


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-133
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-138
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-62
changelog:
  - mongo updated from 1.5.5 to 1.5.7
  - yaf updated from 2.2.9 to 2.3.2
  - APCu updated from 4.0.2 to 4.0.6
  - doublemetaphone updated from 1.0.0 to 1.0.1
  - igbinary updated from 1.1.1 to 1.2.1
  - timezonedb updated from 2014.2 to 2014.7
  - xdebug updated from 2.2.4 to 2.2.5


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-66
changelog:
  - APCu updated from 4.0.6 to 4.0.7
  - APM updated from 1.1.0beta1 to 1.1.0RC2
  - timezonedb updated from 2014.7 to 2014.9
  - rar-3.0.2 added to builtin modules
  - pecl_http-2.1.3 added to builtin modules
  - propro-1.0.0 added to builtin modules
  - raphf-1.0.4 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-68
changelog:
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - libevent-0.1.0 added to builtin modules
  -


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-68
changelog:
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - libevent-0.1.0 added to builtin modules


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-74
changelog:
  - timezonedb updated from 2015.2 to 2015.4
  - trader updated from 0.3.0 to 0.4.0
  - mongo updated from 1.6.6 to 1.6.7


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-75
changelog:
  - propro 1.0.0 added (was missing after some update)
  - pecl_http 2.5.2 added (was missing after some update)
  - raphf updated from 1.0.4 to 1.1.0


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-78
changelog:
  - pecl_http updated from 2.5.2 to 2.5.3
  - eio updated from 1.2.5 to 1.2.6
  - timezonedb updated from 2015.6.1 to 2015.7
  - yaf updated from 2.3.2 to 2.3.5
  -


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-84
changelog:
  - jsmin updated from 1.1.0 to 2.0.1
  - xdebug updated from 2.3.3 to 2.4.0
  - redis updated from 2.2.7 to 2.2.8
  - APCu updated from 4.0.7 to 4.0.11
  - oci8 updated from 2.0.8 to 2.0.11
  - Bitset updated from 1.0.1 to 2.0.3
  - lzf updated from 1.6.2 to 1.6.3
  - timezonedb updated from 2015.7 to 2016.4
  - gender updated from 1.0.0 to 1.1.0
  - stats updated from 1.0.3 to 1.0.5
  - mongo updated from 1.6.11 to 1.6.14
  - radius updated from 1.2.7 to 1.3.0
  - ssh2 updated from 0.12 to 0.13
  - yaml-1.2.0 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-86
changelog:
  - timezonedb updated from 2016.6 to 2016.8
  - pdflib updated from 3.0.4 to 4.0.1
  - oci8 updated from 2.0.11 to 2.0.12
  - xdebug updated from 2.4.0 to 2.4.1
  - yaz updated from 1.1.9 to 1.2.1
  - yaml updated from 1.2.0 to 1.3.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.24-1.1
changelog:
  - update mail-header patch
  - ALTPHP-212: Implement additional code to mail.c to track sending file path (X-PHP-Filename)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.30-2
changelog:
  - ALTPHP-306: LSPHP: Return response code and response status line in cgi/fcgi manner
  - Update CRIU patch to version 7
  - Fix always_populate_raw_post_data


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.30-3
changelog:
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess
  - ALTPHP-315: Remove mod_php provide


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.30-7
changelog:
  - LSPHP: fix php_value wrong priorities
  - LSPHP: fix using options from .user.ini
  - build shmop as build-in extension


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.31-2
changelog:
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.31-3
changelog:
  - add symlinks for MultiPHP support
  - session.save_path set to "/opt/alt/phpXY/var/lib/php/sessions"


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.31-5
changelog:
  - AAP-176: Add сorrect exit from lve if the nproc limit is reached for php-fpm
  - Change lve log levels for php-fpm


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.31-6
changelog:
  - add conflicts with alt-php-config and lvemanager
  - alt-phpXY-intl requires alt-libcu >= 57.1
  - ALTPHP-380: added user.ini lookup in home dir
  - ALTPHP-380: changed CRIU messaging


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.36-2
changelog:
  - ALTPHP-498: Fixed ability to override parameters with ini_set() that
    were defined via php_value
  - ALTPHP-499: Fixed patch for LiteSpeed SIGTERM cleanup


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.36-5
changelog:
  - Fixed bug #74385 Locale::parseLocale() broken with some arguments
  - Fixed bug #76075 --with-fpm-acl wrongly tries to find libacl on FreeBSD


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.38-2
changelog:
  - backported fix for bug #76505 (array_merge_recursive() is duplicating sub-array keys)
  - backported fix for bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler)
  - backported fix for bug #76536 (PHP crashes with core dump when throwing exception in error handler). (Laruence)
  - backported fix for bug #76532 (excessive memory usage in mb_strimwidth)
  - backported fix for bug #76548 pg_fetch_result did not fetch the next row
  - backported fix for bug #74670
  - backported fix for bug #75231
  - backported fix for bug #76333 PHP built-in server does not find files if root path contains special characters
  - backported fix for bug #76488 Memory leak when fetching a BLOB field
  - backported fix for bug #76524 - ZipArchive memory leak
  - backported fix for #73817: Incorrect entries in get_html_translation_table
  - backported fix for #52974: jewish.c: compile error under Windows with GBK charset
  - backported fix for #76665: SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle
  - backported fix for bug #75402 Possible Memory Leak using PDO::CURSOR_SCROLL option
  - backported fix for bug #76335 "link(): Bad file descriptor" with non-ASCII path
  - backported fix for #76704: mb_detect_order return value varies based on argument type
  - backported fix for incorrect restoring of LDFLAGS
  - backported fix for bug #72443: Generate enabled extension
  - backported fix for bug #65988: Zlib version check fails
  - backported fix for bug #76709: Minimal required zlib library is 1.2.0.4
  - backported fix for bug #74484 MessageFormatter::formatMessage memory corruption
  - backported fix for arginfo for bzcompress
  - backported fix for bug #76754 (parent private constant in extends class memory leak)
  - backported fix for #68175: RegexIterator pregFlags are NULL instead of 0
  - backported fix for bug #76296 (openssl_pkey_get_public does not respect open_basedir)
  - backported fix for bug #76705 (unusable ssl => peer_fingerprint in stream_context_create())
  - backported fix for #68825: Exception in DirectoryIterator::getLinkTarget()
  - backported fix for #55146: iconv_mime_decode_headers() skips some headers
  - backported fix for #63839: iconv_mime_decode_headers function is skipping headers
  - backported fix for #60494: iconv_mime_decode does ignore special characters
  - backported fix for #68180: iconv_mime_decode can return extra characters in a header
  - backported fix for bug #76367 (NoRewindIterator segfault 11)
  - backported fix for bug #76383 (array_map on $GLOBALS returns IS_INDIRECT)
  - backported fix for bug #73342


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.38-3
changelog:
  - backported fix for bug #76800 (foreach inconsistent if array modified during loop)
  - backported fix for bug #76901
  - backported fix for 76480: Use curl_multi_wait() so that timeouts are respected
  - backported fix for #66828: iconv_mime_encode Q-encoding longer than it should be
  - backported fix for bug #76832 ZendOPcache.MemoryBase periodically deleted by the 
  - backported fix for #75696: posix_getgrnam fails to print details of group
  - backported fix for #74454: Wrong exception being thrown when using ReflectionMethod
  - backported fix for bug #73457
  - backported fix for bug #74764 and add a test case
  - backported fix for #76886: Can't build xmlrpc with expat
  - backported fix for #75273: php_zlib_inflate_filter() may not update bytes_consumed


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.38-3
changelog:
  - backported fix for #66828: iconv_mime_encode Q-encoding longer than it should be
  - backported fix for bug #76800 (foreach inconsistent if array modified during loop)
  - backported fix for bug #76901
  - backported fix for 76480: Use curl_multi_wait() so that timeouts are respected
  - backported fix for bug #76832 ZendOPcache.MemoryBase periodically deleted by the 
  - backported fix for #75696: posix_getgrnam fails to print details of group
  - backported fix for #74454: Wrong exception being thrown when using ReflectionMethod
  - backported fix for bug #73457
  - backported fix for bug #74764 and add a test case
  - backported fix for #76886: Can't build xmlrpc with expat
  - backported fix for #75273: php_zlib_inflate_filter() may not update bytes_consumed


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-108.1
changelog:
  - ALTPHP-2148: Remove erroneous HAVE_UNIX_H from php_config.h
  - ALTPHP-2132: remove php_handler header from /etc/psa/php_versions.d/alt-php*.conf


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-117
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php56/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-122
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.6 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.6 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-129
changelog:
  * Thu Jun 18 2026 Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 5.6.40-130
  - CLOS-4642: LSWS site-isolation - normalize trailing slash in docroot hash


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-129
changelog:
  * Mon Jun 09 2026 Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-129
  - Bump release to include CLOS-4506 and ALTPHP-2448 in RPM tag


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-132
changelog:
  - ALTPHP-2485: ship a default www.conf pool listening on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) so alt-phpXY-fpm starts on non-panel hosts without colliding on 127.0.0.1:9000; php-fpm.conf already includes php-fpm.d/*.conf. group=nogroup on Debian-like distros. Ship an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-133
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding
    (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + one cipher
    block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and
    overflows the heap when built against OpenSSL 3.x. Backport of upstream commit
    cbc0489126 (GH-22187): reserve one extra block for EVP_CIPH_WRAP_MODE ciphers.
    (5.6 has no php_openssl_cipher_update() helper; the fix is applied to the inline
    allocations in both openssl_encrypt() and openssl_decrypt())


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-135
changelog:
  - CVE-2026-9672: three defects in the GIF LZW decoder of the bundled libgd
    (ext/gd/libgd/gd_gif_in.c), reachable from attacker-controlled GIF data:
    the prefix/suffix table reset cleared table[1][0] repeatedly instead of
    table[1][i], the LZW end_code branch fell through and kept decoding with a
    stale code when the trailing data blocks drained cleanly, and ReadImage()
    left its LZW_STATIC_DATA scratch struct uninitialised. Backport of upstream
    commit fcd691b377d0 (libgd patch by Pierre Joye), byte-identical to upstream.
  - CVE-2026-17543: SQL injection in ext/pgsql (GHSA-7qpv-r5mr-78m4).
    php_pgsql_add_quotes() wrapped a PQescapeStringConn()-escaped value in an
    E'...' literal, where a backslash is an escape character, so a value such as
    "zzz\' OR 1=1 --" escaped the doubled quote and broke out of the literal via
    pg_convert()/pg_insert()/pg_update()/pg_delete()/pg_select(). Backport of
    upstream commit ab048bd83b57: emit a plain '...' literal, which is what
    PQescapeStringConn() is documented to be used with. 5.6 builds the literal
    with smart_str, so the fix drops the smart_str_appendc(&str, 'E') call.
    The pg_convert()/pg_insert()/pg_update() expectations are updated for the
    dropped E prefix, including the 5.6-era non-"_9" duplicates upstream no
    longer ships, and a 5.6-compatible replacement for the upstream regression
    test is added.
  - CVE-2026-7260: phar stack exhaustion on a circular symlink chain in a
    tar-based archive (GHSA-vc5h-9ppw-p5f3). phar_get_link_source() recursed
    into itself with no cycle detection, so an archive whose symlinks form a
    loop crashed the process on open/read. Backport of upstream commit
    2e0fa0a44441: a new static phar_follow_one_link() performs a single hop and
    phar_get_link_source() walks the chain iteratively with Floyd cycle
    detection (kept on the 5.6 zend_hash_find()/TSRMLS API). Also restores the
    path separator in phar_get_link_location() ("*p = '/'"), without which the
    Floyd walk's second visit to an entry resolves a truncated prefix and
    crashes on *valid* nested archives; upstream carries the same defect but
    its fixtures use flat entry names and never reach that branch. Adds
    ext/phar/tests/tar/gh21986.phpt, taken from the earlier public fix
    b2de3cf170 because it needs no binary fixture; it segfaults on an
    unpatched 5.6.40 build and passes on a patched one.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-136
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php56/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php56-fpm from alt-php56-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php56/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php56-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php56-php-fpm rather than
    alt-php56-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-80
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Constraint max version for bison package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-113
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Moved xdebug to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-116
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-31
changelog:
  - APCu updated from 4.0.6 to 4.0.7
  - APM updated from 1.1.0beta1 to 1.1.0RC2
  - timezonedb updated from 2014.7 to 2014.9
  - rar-3.0.2 added to builtin modules
  - pecl_http-2.1.3 added to builtin modules
  - raphf-1.0.4 added to builtin modules
  - propro-1.0.0 added to builtin modules


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-33
changelog:
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - libevent-0.1.0 added to builtin modules
  - mongo updated from 1.5.7 to 1.5.8
  - stomp updated from 1.0.5 to 1.0.6
  - timezonedb downgraded from 2014.9 to 2014.10
  - xdebug updated from 2.2.5 to 2.2.6
  - libevent-0.1.0 added to builtin modules


author: Eugene Zamriy <ezamriy@cloudlinux.com> 1-40
changelog:
  - raphf updated from 1.0.4 to 1.1.0
  - pecl_http updated from 2.1.3 to 2.5.2
  - Fixed json extension duplication in http.ini


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-50
changelog:
  - yaml 1.2.0 extension added
  - rar 3.0.2 extension added
  - jsmin updated from 1.1.0 to 2.0.1
  - APCu updated from 4.0.7 to 4.0.11
  - stats updated from 1.0.3 to 1.0.5
  - redis updated from 2.2.7 to 2.2.8
  - ssh2 updated from 0.12 to 0.13
  - eio updated from 1.2.6 to 2.0.0
  - timezonedb updated from 2015.7 to 2016.4
  - radius updated from 1.2.7 to 1.3.0
  - LZF updated from 1.6.2 to 1.6.3
  - gender updated from 1.0.0 to 1.1.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-52
changelog:
  - timezonedb updated from 2016.6 to 2016.8
  - yaml updated from 1.2.0 to 1.3.0
  - xdebug updated from 2.3.3 to 2.4.1
  - oci8 updated from 2.0.8 to 2.0.12
  - update pdflib from 3.0.4 to 4.0.1
  - update bitset from 2.0.1 to 2.0.3
  - update LZF from 1.6.3 fo 1.6.5
  - update yaz from 1.1.9 to 1.2.1
  - update gnupg from 1.3.6 to 1.4.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-54
changelog:
  - timezonedb updated from 2016.9 to 2016.10
  - imagick updated from 3.1.2 to 3.4.3RC1
  - xdebug updated from 2.4.1 to 2.5.0


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.8.1-20
changelog:
  - ALTPHP-2455: Allow CL10 (el10) build for alt-php53; keep php52/54/55 excluded (not on CL10).
  - ALTPHP-2455: Add -Wno-incompatible-pointer-types for GCC 15 (const mismatch in imagick_file.c).


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.8.1-22
changelog:
  - ALTPHP-2352: drop redundant php8.5 smart-string patch on Debian (3.8.1 already includes the fix; patch rejected and broke the deb build)


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.5.7-2
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/20-msgpack.ini
    so msgpack loads outside cagefs/panel. Load-order prefix 20- (base dep).


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 4.2.0-3
changelog:
  - Skip test 065phpt (Directory streams with RecursiveDirectoryIterator).
  PECL RAR dir_readdir returns full paths instead of single path components,
  so RecursiveDirectoryIterator only lists 4 files instead of 10. Proper fix
  belongs in rar_stream.c (php_rar_dir_ops_read).


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 4.2.0-5
changelog:
  - ALTPHP-2213: initialize php_stream_dirent in php_rar_dir_ops_read.
  PHP 8.3 added a d_type member to php_stream_dirent; rar_stream.c only ever
  filled in d_name, so d_type was memcpy'd out as uninitialized stack memory.
  RecursiveDirectoryIterator::hasChildren() early-returns false on d_type ==
  DT_REG, so directories whose garbage d_type happened to be 8 were treated as
  plain files and never recursed into - test 065 then saw 4 entries instead of
  10. Zeroing the struct yields DT_UNKNOWN and restores the php_stat() fallback.
  - Re-enable tests/065.phpt on CL10; it was skipped in 4.2.0-3 against a
  misdiagnosed root cause (dir_readdir does strip the directory prefix).


author: Oleg Cherniy <oleg.cherniy@gmail.com> 0.6.1.20121111-1
changelog:
  - Fixed bug in Phalcon\Mvc\Micro's not-found handler
  - Fixed bug reading named-parameters with quantifiers in Phalcon\Mvc\Router
  - Now named-routes are processed without use regular expressions
  - Now $this->view->disable() disables the auto-rendering mode completely
  - Added Phalcon\Mvc\View::enable that re-enables the auto-rendering mode
  - Added Phalcon\Cache\Backend::stop() to stop the cache without store anything into the backend
  - Fixed bug in Phalcon\Mvc\View that saves a empty cached content when using a cache
  - Implemented Phalcon\Db::FETCH_OBJ to return objects instead of arrays
  - Removed checking for callable definitions in Phalcon\DI due to security reasons


author: Oleg Cherniy <oleg.cherniy@gmail.com> 0.7.0.20121205-0
changelog:
  - Update to last relase 0.7.0 from github 20121205
  - Now the namespace can be set in a path of the route and it will passed automatically to the dispatcher
  - Implementing URL generation based on routed without regular expressions
  - Now is possible register a template engine in Phalcon\Mvc\View with an anonymous function
  - Passing 'compileAlways' => true as option for Volt makes that the templates will be always compiled instead of checking if they have changes
  - Now Phalcon\Cache\Backend adapters return false in the "exists" method if the cache has expired
  - Reduced number of re-executions when using scrollable cursors
  - Reducing class entry resolution in function calls
  - Disabling search of class execution scope when classes don't have a parent class
  - Removing unnecessary duplication of memory when printing string zvals
  - Implemented a fast way to retrieve object's members without add a memory frame
  - Now Phalcon\Mvc\Dispatcher checks for methods beforeExecuteRoute and afterExecuteRoute in the controller handler
  - Added phalcon_start_with to check if a zval string starts with other string avoiding substrs in PHP userland
  - Added interfaces to most classes helping the developer to easily create component replacements and add new adapters/classes
  - Implemented interfaces on their own components
  - Implemented event propagation, event cancelation and ability to stop events in EventsManager
  - Added Phalcon\Dispatcher::getDefaultNamespace
  - Added a $merge parameter to every Phalcon\Loader strategy to merge current values with a new array
  - Implemented registering services as "always shared"
  - Now Phalcon\Mvc\Model::save, Phalcon\Mvc\Model::create, Phalcon\Mvc\Model::update receives an array to assign the model's attributes from it
  - Support for UTF-8/UTF-16 characters on 32 bit platforms for PHQL/Volt parsers
  - Support for custom schemas in PHQL
  - Now is possible pass bound parameters to Phalcon\DB::fetchOne and Phalcon\Db::fetchAll
  - Implemented independent column map for models and a full escaping system for columns/tables/schemas according to the database system conventions
  - Added a $merge parameter to Phalcon\Mvc\Application::registerModules to merge new modules with current ones
  - Phalcon\Mvc\Application now allows registering a module using an anonymous function
  - Added Phalcon\Mvc\Model\Query\Builder to aid in the creation of PHQL queries using an OO interface
  - Support for COUNT(DISTINCT x) syntax in PHQL
  - Allowing user-defined messages in most Phalcon\Mvc\Model\Validators
  - Now Phalcon\Mvc\Model\Validator\StringLength uses mb_strlen when it is available
  - Allowed pass a URI manually to Phalcon\Mvc\Micro::handle()
  - Fixed missing json_encode filter in Volt
  - Moving cache implementation from Phalcon\Mvc\Model to Phalcon\Mvc\Model\Query, this allows caching both simple and complex resultsets


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.0.0-0.alpha.0.2
changelog:
  - Update to the latest phpng snapshot (ce862a25d52850d93e16f784c1953f9a4c50fadc)
  - Remove deprecated mysql.so extension from the spec file


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.0.0-0.rc.6.1
changelog:
  - update to PHP 7.0.0 RC 6
  - Link Traversal Protection configuration removed from pre section,
    added cloudlinux-linksafe dependency which does the same thing


author: Eugene Zamriy <ezamriy@cloudlinux.com> 7.0.0-0.rc.6.1
changelog:
  - update to PHP 7.0.0 RC 6
  - Link Traversal Protection configuration removed from pre section,
  added cloudlinux-linksafe dependency which does the same thing


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.0.8-1.1
changelog:
  - ALTPHP-177: Re-patch alt-phpXX with wink_server_is_ready.patch
  - ALTPHP-182: enable pdo_dblib build
  - ALTPHP-185: fix empty configure line


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.0.9-1.4
changelog:
  - add mail-header patch
  - ALTPHP-212: Implement additional code to mail.c to track sending file path (X-PHP-Filename)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 7.0.15-2
changelog:
  - ALTPHP-306: LSPHP: Return response code and response status line in cgi/fcgi manner
  - Update CRIU patch to version 7


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.0.26-1
changelog:
  - update to 7.0.26
  - ALTPHP-415: Fix MariaDB102 segfault
  - ALTPHP-420: update phpNN.dat files while installing alt-php


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.30-5
changelog:
  - Fixed bug #74385 Locale::parseLocale() broken with some arguments
  - Fixed bug #76205 PHP-FPM sporadic crash when running Infinitewp
  - Fixed bug #76075 --with-fpm-acl wrongly tries to find libacl on FreeBSD


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.31-3
changelog:
  - backported fix for bug #76505 (array_merge_recursive() is duplicating sub-array keys)
  - backported fix for bug #76502
  - backported fix for bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler)
  - backported fix for bug #76536 (PHP crashes with core dump when throwing exception in error handler). (Laruence)
  - backported fix for bug #76532 (excessive memory usage in mb_strimwidth)
  - backported fix for bug #76548 pg_fetch_result did not fetch the next row
  - backported fix for bug #74670
  - backported fix for bug #75231
  - backported fix for bug #76333 PHP built-in server does not find files if root path contains special characters
  - backported fix for bug #76488 Memory leak when fetching a BLOB field
  - backported fix for bug #76366 (references in sub-array for filtering breaks the filter)
  - backported fix for bug #76524 - ZipArchive memory leak
  - backported fix for #73817: Incorrect entries in get_html_translation_table
  - backported fix for #52974: jewish.c: compile error under Windows with GBK charset
  - backported fix for bug #68553 (array_column: null values in $index_key become incrementing keys in result)
  - backported fix for #76665: SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle
  - backported fix for bug #75402 Possible Memory Leak using PDO::CURSOR_SCROLL option
  - backported fix for bug #76335 "link(): Bad file descriptor" with non-ASCII path
  - backported fix for #76704: mb_detect_order return value varies based on argument type
  - backported fix for incorrect restoring of LDFLAGS
  - backported fix for bug #72443: Generate enabled extension
  - backported fix for bug #65988: Zlib version check fails
  - backported fix for bug #76709: Minimal required zlib library is 1.2.0.4
  - backported fix for bug #74484 MessageFormatter::formatMessage memory corruption
  - backported fix for arginfo for bzcompress
  - backported fix for bug #76747 (Opcache treats path containing "test.pharma.tld" as a phar file)
  - backported fix for bug #76754 (parent private constant in extends class memory leak)
  - backported fix for #68175: RegexIterator pregFlags are NULL instead of 0
  - backported fix for bug #76296 (openssl_pkey_get_public does not respect open_basedir)
  - backported fix for bug #76705 (unusable ssl => peer_fingerprint in stream_context_create())
  - backported fix for bug #76777 and added test
  - backported fix for #76778: array_reduce leaks memory if callback throws exception
  - backported fix for #68825: Exception in DirectoryIterator::getLinkTarget()
  - backported fix for #55146: iconv_mime_decode_headers() skips some headers
  - backported fix for #63839: iconv_mime_decode_headers function is skipping headers
  - backported fix for #60494: iconv_mime_decode does ignore special characters
  - backported fix for #68180: iconv_mime_decode can return extra characters in a header
  - backported fix for bug #76174 (openssl extension fails to build with LibreSSL 2.7)
  - backported fix for bug #76367 (NoRewindIterator segfault 11)
  - backported fix for bug #76383 (array_map on $GLOBALS returns IS_INDIRECT)
  - backported fix for bug #76462 Undefined property: DateInterval::$f
  - backported fix for bug #73342


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.32-3
changelog:
  - backported fix for bug #76800 (foreach inconsistent if array modified during loop)
  - backported fix for bug #76901
  - backported fix for 76480: Use curl_multi_wait() so that timeouts are respected
  - backported fix for #66828: iconv_mime_encode Q-encoding longer than it should be
  - backported fix for bug #76832 ZendOPcache.MemoryBase periodically deleted by the 
  - backported fix for bug #76796
  - backported fix for #75696: posix_getgrnam fails to print details of group
  - backported fix for #74454: Wrong exception being thrown when using ReflectionMethod
  - backported fix for bug #73457
  - backported fix for bug #74764 and add a test case
  - backported fix for bug #75533: array_reduce is slow when $carry is large array
  - backported fix for #76886: Can't build xmlrpc with expat
  - backported fix for #75273: php_zlib_inflate_filter() may not update bytes_consumed


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.32-3
changelog:
  - backported fix for bug #76800 (foreach inconsistent if array modified during loop)
  - backported fix for bug #76901
  - backported fix for 76480: Use curl_multi_wait() so that timeouts are respected
  - backported fix for #66828: iconv_mime_encode Q-encoding longer than it should be
  - backported fix for bug #76832 ZendOPcache.MemoryBase periodically deleted by the
  - backported fix for bug #76796
  - backported fix for #75696: posix_getgrnam fails to print details of group
  - backported fix for #74454: Wrong exception being thrown when using ReflectionMethod
  - backported fix for bug #73457
  - backported fix for bug #74764 and add a test case
  - backported fix for bug #75533: array_reduce is slow when $carry is large array
  - backported fix for #76886: Can't build xmlrpc with expat
  - backported fix for #75273: php_zlib_inflate_filter() may not update bytes_consumed


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-92
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: Heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-96
changelog:
  - Security fixes
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-97
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-99
changelog:
  - Security fixes
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-103
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini
  - ALTPHP-2080: Refactor debian spec


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-112.2
changelog:
  - Security fixes
  - CVE-2015-9253: fix PHP-FPM exhaustion CPU and memory issue causing denial
    of service


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-118
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php70/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-124
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-125
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-134
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. The default www.conf pool now listens on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port. On Debian-like distros the pool group is set to nogroup (no nobody group). Ship an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-135
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-pad
    (aes-*-wrap-pad) ciphers; the output buffer was sized as
    data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap
    output. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of
    upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-137
changelog:
  - CVE-2026-9672: three defects in the GIF LZW decoder of the bundled libgd -
    the code-table reset loop wrote sd->table[1][0] instead of sd->table[1][i]
    so most of table[1] kept stale data, LWZReadByte_() kept decoding past the
    end-of-information code when the trailing data blocks drained cleanly, and
    ReadImage() left its LZW_STATIC_DATA uninitialised on the stack
  - CVE-2026-17543: SQL injection in ext/pgsql - php_pgsql_add_quotes() wrapped
    values in an E'...' literal, in which the backslash left unescaped by
    PQescapeStringConn() (the default standard_conforming_strings=on doubles
    only the quote) escapes the following quote and lets a payload break out;
    pg_convert(), pg_insert(), pg_update(), pg_delete() and pg_select() are
    affected. Now quoted with a plain '...' literal
  - CVE-2026-7260: unbounded recursion in phar_get_link_source() when a
    tar-based phar archive contains a circular symlink chain; resolution is now
    an iterative walk with Floyd cycle detection, returning NULL on a cycle


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-138
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php70/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php70-fpm from alt-php70-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php70/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php70-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php70-php-fpm rather than
    alt-php70-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-66
changelog:
  - ALTPHP-1255: rebuild with removed webp support from php for getting it from alt-ImageMagick
  - ALTPHP-1266: update litespeed to 8.0.1


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.0.33-71
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string
  - Fix build dependencies


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-86
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Eugene Zamriy <eugene@zamriy.info> - 7.0.0-0.alpha.0.2
changelog:
  - Update to the latest phpng snapshot (ce862a25d52850d93e16f784c1953f9a4c50fadc)
  - Remove deprecated mysql.so extension from the spec file
  - Remove unneeded patch fpm-lve-5.4.patch


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 5.1.28-1
changelog:
  - ALTPHP-2491: Update apcu to 5.1.28
  - ALTPHP-2491: Remove obsolete php85-fix.patch entirely (report_memleaks fixed upstream; apc_entry_003.phpt rewritten upstream in 5.1.28 so its base EXPECTF already matches php85); drop %prep removal of tests/bug63224.phpt (removed upstream)
  - ALTPHP-2491: Skip tests/apc_mmap_hugepage_002.phpt (needs reserved hugepages, unavailable in build-system QA)


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 5.1.28-2
changelog:
  - ALTPHP-2491: Skip all tests/apc_mmap_hugepage_*.phpt (005/006 fatal on CL7 3.10 kernel without hugepage support, family needs reserved hugepages unavailable in build-system QA)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 0.21.0-1
changelog:
  - ALTPHP-2575: Update to 0.21.0 version
  - ALTPHP-2575: link with -Wl,-Bsymbolic-functions so the bundled brotli decoder
    is not interposed by the system libbrotlidec (fixes brotli_uncompress()
    returning false on CL8/php85)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-96
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Moved rar to separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-98
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-99
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-100
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-101
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1798: Added dependency to new apcu-bc extension
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-103
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-6
changelog:
  - APCu updated from 5.1.0 to 5.1.2
  - eio 2.0.0RC1 extension added
  - imagick 3.4.0RC3 extension added
  - oci8 2.1.0 extension added
  - pecl_http 3.0.0RC1 extension added
  - propro 2.0.0RC1 extension added
  - raphf 2.0.0RC1 extension added


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-10
changelog:
  - update APCu to 5.1.3
  - update pecl_http to 3.0.1
  - update raphf to 2.0.0
  - update propro to 2.0.0
  - update oci8 to 1.1.0
  - update imagick to 3.4.1
  - update timezonedb to 2016.2
  - update xdebug to 2.4.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-13
changelog:
  - inotify 2.0.0 extension added
  - stats 2.0.3 extension added
  - yaml 2.0.0RC8 extension added
  - updated imagick to 3.4.3RC1
  - updated oci8 to 2.1.1
  - added libyaml to requires


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-15
changelog:
  - updated timezonedb from 2016.4 to 2016.6
  - updated redis from 2.2.8 to 3.0.0
  - mailparse 3.0.1 extension added


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-16
changelog:
  - geoip 1.1.1 extension added
  - gnupg 1.4.0 extension added
  - LZF updated from 1.6.3 to 1.6.5
  - oci8 updated from 2.1.1 to 2.1.2


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-17
changelog:
  - dbase updated from 7.0.0-338472 to 7.0.0beta1
  - xdebug updated from 2.4.0 to 2.4.1
  - APCu updated from 5.1.5 to 5.1.7
  - timezonedb updated from 2016.6 to 2016.8
  - yaml updated from 2.0.0RC8 to 2.0.0
  - pdflib 4.0.1 extension added
  - bitset 3.0.0 extension added
  - yaz 1.2.1 extension added


author: Dmitriy Kasyanov <dkasyanvo@cloudlinux.com> 1-18
changelog:
  - mongodb 1.1.9 extension added (CL6, CL7)
  - ssh2 1.0 extension added
  - timezonedb updated from 2016.8 to 2016.9


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-19
changelog:
  - igbinary 2.0.1 extension added
  - oauth 2.0.2 extension added
  - rar 4.0.3 (dev) extension added
  - uploadprogress 1.0.3.1 (dev) extension added
  - mailparse updated from 3.0.1 to 3.0.2
  - redis updated from 3.0.0 to 3.1.0
  - timezonedb updated from 2016.9 to 2016.10
  - xdebug updated from 2.4.1 to 2.5.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-20
changelog:
  - libsodium 1.0.6 extension added
  - imagick updated from 3.4.3RC1 to 3.4.3RC4
  - apcu updated from 5.1.7 to 5.1.8
  - mongodb updated from 1.1.9 to 1.2.4


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-21
changelog:
  - timezonedb updated from 2016.10 to 2017.2
  - memcached updated from 3.0.0dev to 3.0.3
  - zmq 1.1.3 added
  - sqlsrv 4.3.0RC1 added
  - pdo_sqlsrv 4.3.0RC1 added


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-22
changelog:
  - LZF updated to 1.6.6
  - eio updated to 2.0.2
  - igbinary updated to 2.0.4
  - oci8 updated to 2.1.7
  - pdo_sqlsrv updated to 4.3.0
  - redis updated to 3.1.4
  - sqlsrv updated to 4.3.0
  - xdebug updated to 2.5.5
  - yaml updated to 2.0.2


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.81.0-1
changelog:
  - ALTPHP-2450: Update to 1.81.0 version
  - Build with GCC 10 on Ubuntu 20.04 (default GCC 9 ICEs on grpc 1.81.0)
  - Exclude PHP 8.4/8.5 on Ubuntu 16.04 (no alt-php84/85 for Xenial)


author: Eduard Chiganov <echiganov@cloudlinux.com> 3.2.15-1
changelog:
  - EA4D-454: Create alt-phpXX-pecl-igbinary.
  - ALTPHP-1686: Newer version of igbinary for alt-php 70-83.


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.2.16-6
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/40-igbinary.ini
    so igbinary loads outside cagefs/panel. Prefix 40- loads after msgpack (20-).


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 5.3.7-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Merge older-OS test skips into main patch; apply unconditionally.


author: Levon Matshkalyan <levon.matshkalyan@cloudlinux.com> - 5.0.4-3
changelog:
  - ALTPHP-2268: Add Provides/Obsoletes for zts in tideways-zts subpackage to support rename and avoid file conflicts


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 0.13.0-2
changelog:
  - ALTPHP-2282: EL10+ support for PHP <= 7.4:
    - PHP 7.0 still needs pcre1 (its own php_pcre.h #includes "pcre.h");
      use alt-pcre-devel from /opt/alt/pcre/ on EL10+
    - PHP 7.1-7.3 on EL10+ compile cleanly against pcre2-devel
      (pcre1 removed from EL10 base repos)
    - QA_RPATHS=0x0002 to allow /opt/alt/pcre/ rpath under EL10's
      stricter brp-check-rpaths (matches alt-pcre.spec itself)
    - Apply altea-2282-pcre-test-compat.patch: switch the affected
      phpt EXPECT/EXPECTF patterns to %A-anchored EXPECTF so they
      pass on both pcre1 (EL7-9) and pcre2 (EL10+) builds. Covers
      cookies_encryption_warning/*, broken_configuration/encrypt_regexp_cookies_bad_regexp,
      and upload_validation/upload_validation


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.1.0-0.beta.3.2
changelog:
  - ALTPHP-220: remove alt-php71 lines from /etc/cl.selector/selector.conf
  - add libc-client require for IMAP


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.1.0-3
changelog:
  - ALTPHP-292: do not build shared extensions in LSPHP binary
  - ALTPHP-290: add odbc and pdo_odbc extensions


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.1.12-1
changelog:
  - update to 7.1.12
  - ALTPHP-415: Fix MariaDB102 segfault
  - ALTPHP-420: update phpNN.dat files while installing alt-php


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.28-3
changelog:
  - revert:
    - add /etc/cl.selector/symlinks.rules for CL
    - recreate handlers for Plesk/
  - Fix problem with /etc/cl.selector/symlinks.rules


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.1.28-4
changelog:
  - add all extensions in default.ini and disable by default except mysqli.so
  - update plesk php hadlers if add new extensions in default.ini
  - set "serialize_precision = -1" in php.ini


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-92
changelog:
  - ALTPHP-2406: use alt-libicu65 for all OS
  - ALTPHP-2406: fix unversioned alt-libicu rpath on rhel<=8


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.1.33-100
changelog:
  - CVE-2026-14355: fix openssl_encrypt() zend mm heap overflow on AES key-wrap-with-padding (aes-*-wrap-pad) by reserving an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream cbc0489126a7682796aad1e5fb4e51de74af162c)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.1.33-102
changelog:
  - CVE-2026-9672: fix three defects in the bundled libgd GIF LZW decoder (ext/gd/libgd/gd_gif_in.c) - reset sd->table[1][i] instead of sd->table[1][0], stop decoding after the LZW end code, and zero-initialise LZW_STATIC_DATA in ReadImage() (backport of upstream fcd691b377d02285740744bee17c0f298be227d5)
  - CVE-2026-17543: fix SQL injection in ext/pgsql - php_pgsql_add_quotes() emitted E'...' while PQescapeStringConn() only doubles the quote, letting a trailing backslash break out of the literal (backport of upstream ab048bd83b578119cf81b456526d50498421d617)
  - CVE-2026-7260: fix phar circular symlink crash - phar_get_link_source() now follows the link chain with Floyd cycle detection instead of unbounded self-recursion, and phar_get_link_location() restores the path separator it temporarily overwrites (backport of upstream 2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52)


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.1.33-103
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php71/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php71-fpm from alt-php71-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php71/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php71-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php71-php-fpm rather than
    alt-php71-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.1.33-62
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-65
changelog:
  - Security fixes
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.1.33-66
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-70
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-84
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php71/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.1.12-1
changelog:
  - update to 7.1.12
  - ALTPHP-415: Fix MariaDB102 segfault
  - bug70110: Increase the PCRE JIT stack size to 512K


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-4
changelog:
  - mongodb 1.1.9 extension added
  - ssh2 1.0 extension added
  - timezonedb updated from 2016.6 to 2016.9
  - redis updated from 2.2.8 to 3.0.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-5
changelog:
  - igbinary 2.0.1 extension added
  - mailparse 3.0.2 extension added
  - xdebug 2.5.0 extension added
  - oauth 2.0.2 extension added
  - rar 4.0.3 (dev) extension added
  - uploadprogress 1.0.3.1 (dev) extension added
  - redis updated from 3.0.0 to 3.1.0
  - timezonedb updated from 2016.9 to 2016.10
  - apcu updated from 5.1.5 to 5.1.7
  - yaml updated from 2.0.0RC8 to 2.0.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1-7
changelog:
  - timezonedb updated from 2016.10 to 2017.2
  - memcached updated from 3.0.0dev to 3.0.3
  - zmq 1.1.3 added
  - sqlsrv 4.3.0RC1 added (CL7)
  - pdo_sqlsrv 4.3.0RC1 added (CL7)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-83
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - ALTPHP-1507: Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-84
changelog:
  - Moved uploadprogress to separate package
  - Moved newrelic to separate package
  - Added dependency to new scoutapm extension in separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.2.1-3
changelog:
  - CLOS-5732: disable build-time SSL autodetection so gearman.so does not require
    gearman_client_set_ssl, fixing "undefined symbol" load failure on CloudLinux
    (libgearman is shipped without SSL). Restores the portable behaviour of 2.2.1-1.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.0.10-1
changelog:
  - ALTPHP-2500: Update to 2.0.10 version; drop php-8.4-fix-php_rand.patch
    and php85-fix.patch (absorbed upstream)


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.3.0-1
changelog:
  - ALTPHP-2508: Update to 2.3.0 version; regenerate php85-fix.patch
    (header and test fixes partially absorbed upstream)


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.17.0-1
changelog:
  - Update to 1.17.0
  - Adapt build to upstream's C++ native agent: build ext + libcommon +
    libphpbridge as a single phpize extension via a replacement config.m4,
    sourcing former Conan deps (libcurl, libunwind, boost, zlib) from system
    packages and using an SCL toolset for C++20


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 7.2.0-0.rc.6.2
changelog:
  - ALTPHP-415: Fix MariaDB102 segfault
  - ALTPHP-420: update phpNN.dat files while installing alt-php
  - bug70110: Increase the PCRE JIT stack size to 512K


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.2.17-4
changelog:
  - add all extensions in default.ini and disable by default except mysqli.so
  - update plesk php hadlers if add new extensions in default.ini
  - set "serialize_precision = 17" in php.ini


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.2.21-2
changelog:
  - make php.d.all as symbol link for php.d.all.def
  - rename ini config files for zts modules
  - fix posttrans to non-overwrite /etc/cl.selector/selector.conf


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.2.32-2
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - ALTPHP-961: Update litespeed to 7.7 version


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-22
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-23
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-47
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat
  - Fix #74267: segfault with streams and invalid data


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.2.34-50
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.2.34-52
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.2.34-66
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php72/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.2.34-84
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding
    (aes-*-wrap-pad) ciphers; the output buffer was sized as data_len + one block, which
    under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend
    heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.2.34-86
changelog:
  - CVE-2026-9672: bundled libgd GIF LZW decoder - the table reset cleared
    sd->table[1][0] instead of sd->table[1][i] so stale suffixes leaked between
    images, LWZReadByte_() kept decoding after the LZW end code when the trailing
    data block count was 0, and ReadImage() left LZW_STATIC_DATA uninitialised
  - CVE-2026-17543: SQL injection in ext/pgsql - php_pgsql_add_quotes() wrapped
    PQescapeStringConn() output in an E'...' literal, which lets a trailing
    backslash escape the closing quote while standard_conforming_strings is on.
    Emit a plain '...' literal instead
  - CVE-2026-7260: unbounded recursion in phar_get_link_source() on a circular
    symlink chain (GHSA-vc5h-9ppw-p5f3); replaced by a Floyd cycle-detection walk,
    including the phar_get_link_location() path-separator restore the walk needs


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.2.34-87
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php72/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php72-fpm from alt-php72-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php72/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php72-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php72-php-fpm rather than
    alt-php72-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1-10
changelog:
  - extension memcached updated to 3.0.4
  - extension pdo_sqlsrv updated to 4.3.0
  - extension sqlsrv updated to 4.3.0


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-75
changelog:
  - ALTPHP-1269: Update xdebug to 3.1.4 version
  - Update timezonedb to version 2021.5
  - Update imagick to version 3.6.0
  - Update mongodb to version 1.13.0
  - Update swoole to version 4.8.9


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-87
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - alt-ImageMagick is linked statically now
  - Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-90
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Added solr in separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.0.7-2
changelog:
  - ALTPHP-2396: Add explicit Requires: libmcrypt so yum pulls libmcrypt
    from alt-common on CL10 instead of ea-libmcrypt (cPanel) which installs
    outside the system LD path.


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-23
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-33
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-36
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.3.33-52
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php73/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.3.33-67
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. The default
    www.conf pool now listens on a per-version unix socket
    (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple
    alt-php FPM services no longer collide on the same TCP port. On Debian-like
    distros the pool group is set to nogroup (no nobody group exists there). Ship
    an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on
    non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.3.33-68
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow (zend_mm heap
    corruption) with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers when
    built against OpenSSL 3.x; size the output buffer for RFC 5649 padded wrap


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 7.3.33-70
changelog:
  - CLOS-5732: make the LSAPI prefork SIGCHLD handler async-signal-safe.
    Defer the in-handler lsapi_log() calls (which reach the non-recursive
    glibc tzset lock via localtime_r) to a fixed-size ring buffer drained
    at the top of the parent accept loop, fixing a self-deadlock that
    stalled worker reaping and caused zombie buildup / site outages.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.3.33-72
changelog:
  - CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code
    table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus
    an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an
    end-of-stream code
  - CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted
    values escaped by PQescapeStringConn() inside an E'...' constant, so a
    trailing backslash broke out of the literal (SQL injection); emit a plain
    '...' constant instead
  - CVE-2026-7260: phar_get_link_source() followed tar symlink chains by
    unbounded recursion, so a phar with circular symlinks exhausted the C
    stack; walk the chain iteratively with Floyd cycle detection


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.3.33-73
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php73/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php73-fpm from alt-php73-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php73/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php73-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php73-php-fpm rather than
    alt-php73-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-47
changelog:
  - ALTPHP-1269: Update xdebug to 3.1.4 version
  - Update timezonedb to version 2021.5
  - Update mongodb to version 1.13.0
  - Update swoole to version 4.8.9
  - Update pdo_sqlsrv to version 5.10.1
  - Update sqlsrv to version 5.10.1
  - Update imagick to version 3.7.0


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-66
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-3
changelog:
  - ALTPHP-1355: fix linksafe for all sub-packages
  - fix rpath for zip extension
  - add alt-php74-imunify-leveldb provides


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-28
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-43
changelog:
  - ALTPHP-2168: Add include= to php-fpm.conf
  - ALTPHP-2168: Make the paths in php-fpm.conf and logrotate even


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-49
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php74/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-63
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and add Requires: alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php74-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.4.33-64
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap
    with padding (aes-*-wrap-pad). php_openssl_cipher_update() sized the output
    buffer as data_len + one cipher block, undersizing it for RFC 5649 padded
    wrap output; reserve an extra block for EVP_CIPH_WRAP_MODE ciphers.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.4.33-68
changelog:
  - CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted
    values escaped by PQescapeStringConn() inside an E'...' constant, so a
    trailing backslash broke out of the literal (SQL injection); emit a plain
    '...' constant instead
  - CVE-2026-7260: phar_get_link_source() followed tar symlink chains by
    unbounded recursion, so a phar with circular symlinks exhausted the C
    stack; walk the chain iteratively with Floyd cycle detection


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 7.4.33-69
changelog:
  - EA4D-840: enable the FFI extension as a shared module; ffi.so ships in
    alt-php74-common with Provides/Obsoletes alt-php74-ffi for migration parity


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-70
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php74-fpm from alt-php74-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php74/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php74-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php74-php-fpm rather than
    alt-php74-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-53
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added dependency to new leveldb extension


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-10
changelog:
  - ALTPHP-2283: Update to 6.3.0 version (fixes testServerInfo on Redis 8 / Valkey; upstream PR phpredis#2656).


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-11
changelog:
  - ALTPHP-2283: Fix test suite failures: add Redis version guards for tests requiring Redis 6.0+/6.2+.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Disable testIgnoreNumbers, testExists, testServerInfo, testPackHelpers (fail on older Redis / PHP 8.5).


author: Ivan Danilov <idanilov@cloudlinux.com> - 8.0.0s-2
changelog:
  - ALTPHP-1026: Fixed directory for scanning ini files
  - ALTPHP-1029: Fixed adding records for alt-php80 in selector.conf
  - ALTPHP-1028: Fixed scripts to make usage of php 8.0 possible for panels
  - ALTPHP-1025: Add lsphp to requires of php-cli package


author: Ivan Danilov <idanilov@cloudlinux.com> - 8.0.0s-3
changelog:
  - ALTPHP-1036: Disable unnecessary config files from alt-php80 in httpd conf directory
  - ALTPHP-1039: Fix of permissions for provided files


author: Dmitriy Popov <dpopov@cloudlinux.com> - 8.0.30-8
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug
    causing password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-11
changelog:
  - Actually apply php-8.0-CVE-2024-3096.patch and php-8.0-CVE-2024-2756.patch
    for Ubuntu < 22.04 and Debian < 11 systems


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 8.0.30-23
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - fix regression in CVE-2024-11234 patch


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-25
changelog:
  - Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.0.30-37
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php80/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-42
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2025-14179: pdo_firebird SQL injection via NUL bytes in quoted strings
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7259: mbstring NULL pointer dereference in php_mb_check_encoding()
    via mb_ereg_search_init() with Oniguruma-only encodings (iso-8859-11, UJIS,
    KOI8-R, ...)
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-52
changelog:
  - ELS-2362: generate Plesk psa handler files only on rhel>=7 to match the
    %files guard (fixes "installed but unpackaged" psa files on EL6/CL6)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-54
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php80-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-55
changelog:
  - CVE-2026-14355: heap buffer overflow in openssl_encrypt() with AES key-wrap
    padding (aes-*-wrap-pad); reserve an extra EVP_CIPHER_block_size() block for
    EVP_CIPH_WRAP_MODE ciphers in php_openssl_cipher_update()


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-58
changelog:
  - CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped
    PQescapeStringConn() output in an E'...' escape-string constant, where a
    trailing backslash escapes the doubling quote and breaks out of the literal;
    emit a plain '...' literal instead
  - CVE-2026-7260: stack exhaustion in ext/phar. phar_get_link_source() followed
    symlink chains by unbounded tail recursion, so a tar-based phar with circular
    symlinks crashed the process; walk the chain iteratively with Floyd cycle
    detection and return NULL on a loop


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.0.30-59
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php80-fpm from alt-php80-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php80/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php80-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php80-php-fpm rather than
    alt-php80-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-24
changelog:
  - update inotify to 3.0.0
  - update timezonedb to 2020.4
  - update xdebug to 3.1.4
  - update yaf to 3.3.5
  - ALTPHP-1313: Updated MongoDB to 1.14.0


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-28
changelog:
  - ALTPHP-1402: update mailparse to 3.1.4
  - ALTPHP-1408: Redis extension updated to 5.3.7
  - yaz updated to 1.2.4


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-28
changelog:
  - ALTPHP-1402: update mailparse to 3.1.4
  - ALTPHP-1408: Redis extension updated to 5.3.7
  - ALTPHP-1507: Swoole extension updated to 5.0.3
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - yaz updated to 1.2.4


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - Fixed requires
  - Brought back yaf and gnupg
  - Updated uploadprogress to 2.0.2
  - Updated vips to 1.0.13
  - Updated gnupg to 1.5.1
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-33
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved redis to separate package
  - Added dependency to new geos ext


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-34
changelog:
  - Moved swoole to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-36
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1754: Moved xmlrpc to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-38
changelog:
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-39
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-40
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.9.3-2
changelog:
  - ALTPHP-2268: Fix building for PHP 8.5 (php_smart_string.h removed)
  - ALTPHP-2268: Fix building for PHP 8.5 (zend_exception_get_default() replaced with zend_ce_exception)
  - ALTPHP-2268: Fix BuildRequires for CL10 (pcre-devel removed, use pcre2-devel only)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php81/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-15
changelog:
  - ALTPHP-2406: use alt-libicu71 for all OS
  - ALTPHP-2406: drop duplicated 71 in PKG_CONFIG_PATH on rhel<=8


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.1.34-23
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php81-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.1.34-24
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with
    padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized
    the output buffer as data_len + one cipher block, undersizing it for RFC 5649
    padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap
    under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of
    upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.1.34-27
changelog:
  - CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped
    values escaped by PQescapeStringConn() in an E'...' escape-string constant,
    but that escaper leaves backslashes untouched when
    standard_conforming_strings is on, so a trailing backslash escaped the
    doubling quote and broke out of the literal. Drop the E prefix so the plain
    '...' form matches what the escaper produces.
  - CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed
    symlink chains by tail recursion with no cycle or depth guard, so a tar phar
    holding circular links exhausted the C stack. Walk the chain iteratively with
    Floyd cycle detection and return NULL on a loop; also restore the '/'
    separator in phar_get_link_location() so the walk stays idempotent.


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.1.34-28
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php81/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php81-fpm from alt-php81-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php81/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php81-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php81-php-fpm rather than
    alt-php81-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-6
changelog:
  - ALTPHP-1281: Sqlsrv and pdosqlsrv extensions updated to 5.10.1
  - Imagick updated to 3.7.0
  - Oci8 updated to 3.2.1


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-7
changelog:
  - ALTPHP-1313: Updated MongoDB to 1.14.0
  - enable building newrelic
  - add propro 2.1.0
  - add solr 2.5.1
  - add yaz 1.2.3
  - update amqp to 1.11.0
  - update grpc to 1.36.0
  - update newrelic to 10.0.0.312
  - update xdebug to 3.1.4
  - update yaf to 3.3.5


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-19
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.5-2
changelog:
  - ALTPHP-1487: add opcache.jit_buffer_size=100M as default value to opcache.ini
  - rebuild without ffi for rhel < 7
  - add provides and obsoletes for alt-php-internal-sqlite3


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.16-1
changelog:
  - update to 8.2.16
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.2.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php82/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.2.31-10
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php82-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.2.32-5
changelog:
  - CVE-2026-7260: ext/phar - replace the self-recursion in phar_get_link_source()
    with Floyd cycle detection so circular symlinks in a tar/phar archive no longer
    exhaust the stack; phar_get_link_location() now restores the path separator it
    NUL-terminates in place
  - CVE-2026-17543: ext/pgsql - php_pgsql_add_quotes() no longer emits the E''
    escape-string form, which let a backslash break out of the literal and inject
    SQL when standard_conforming_strings is on


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.2.33-1
changelog:
  - Update to 8.2.33
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control
  - Drop the CVE-2026-7260 and CVE-2026-17543 backports: both fixes are present in
    upstream 8.2.33 (phar_get_link_source() already uses Floyd cycle detection;
    php_pgsql_add_quotes() already emits '' rather than E''), so the patches no
    longer apply and are no longer needed


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.33-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php82-fpm from alt-php82-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php82/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php82-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php82-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-20
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - Updated yaml to 2.2.3
  - Updated igbinary to 3.2.14
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.3-1
changelog:
  - update to 8.3.3
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.3.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php83/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.3.31-11
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php83-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.3.33-1
changelog:
  - Update to 8.3.33
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.33-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php83-fpm from alt-php83-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php83/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php83-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php83-php-fpm rather than
    alt-php83-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.30-1
changelog:
  - ALTPHP-2281: update to 8.3.30
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Eduard Chiganov <echiganov@cloudlinux.com> - 8.4.0-0.rc3
changelog:
  - ALTPHP-1880: Updated to RC3.
  - ALTPHP-1860: Remove deprecated sid_length and sid_bits settings.
  - Disabled thread safety by default.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.4.18-3
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php84/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.4.22-8
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php84-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.4.24-1
changelog:
  - Update to 8.4.24
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.4.24-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php84-fpm from alt-php84-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php84/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php84-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php84-php-fpm rather than
    alt-php84-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.4.17-1
changelog:
  - ALTPHP-2280: Update to 8.4.17 version
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-3
changelog:
  - ALTPHP-1935: Added xhprof in separate package
  - ALTPHP-1946: Added bitset in separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added htscanner in separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added leveldb in separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-4
changelog:
  - ALTPHP-2043: add to requires:
      alt-php84-newrelic
      alt-php84-pecl-gender
      alt-php84-pecl-propro


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 4.2.6-3
changelog:
  - Use PECL version instead of testing one
  - ALTPHP-2063: Add obsoletes for alt-php-pecl-propro on PHP8


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.5.3-4
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php85/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.5.7-7
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php85-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.5.9-1
changelog:
  - Update to 8.5.9
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.5.9-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php85-fpm from alt-php85-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php85/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php85-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php85-php-fpm rather than
    alt-php85-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author:
  Alexander Grynchuk <agrynchuk@cloudlinux.com>, Sergei Chernikov <schernikov@cloudlinux.com>, Stas Django <pythonpowerd@gmail.com> 1.2-39

changelog:
  - PTCLLIB-86 - Fix TypeError when trying to get user domains on DA
  - LU-364 Few Mysql governor api calls now returns 0 on success
  - PTCLLIB-83 Plugin detection results now cached only for third-party plugins Replace dangerous exec() with import_module() for plugin loading
  - PTCLLIB-85: Fix ValueError when retrieving user io limit and it is less than 1mb/s


author:
  Alexander Grynchuk <agrynchuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.2-42.1

changelog:
  - LVES-714: Make cllib compatibility with lve 1.5
  - LVES-645: Add to cpapi new feature for obtain users of a reseller (part 2)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.2-42.2
changelog:
  - LVES-707: Make function reseller_users working from a reseller account in DirectAdmin
  - PTCLLIB-88: Correct handling /etc/container/mysql-governor.xml with reseller rights


author: Anton Volkov <avolkov@cloudlinux.com> - 1.2-43
changelog:
  - LVEMAN-1091: Investigate selectorctl high memory consumption
  - LVES-728: Optimize plugins. lvestat.LVEStat
  - LVES-717 - Add is_reseller function to cllib (cpapi)
  - LVES-707 - Make function reseller_users working from a reseller account in DirectAdmin
  - PTCLLIB-88 - Correct handling /etc/container/mysql-governor.xml with reseller rights
  - LVES-714 Make cllib compatibility with lve 1.5
  - LVES-645 - Add to cpapi new feature for obtain users of a reseller (part 2)
  - LU-365: Print mysql-io limit in Kbytes per second in cllimits utility


author:
  Konstantin Vaskovtsov <derkonstantin@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Stas Django <pythonpowerd@gmail.com> 1.2-47

changelog:
  - PTCLLIB-91: Add DB access params extract for ISP5 to ispmanager.py
  - LU-402 Small workaround for old Governor to prevent dropping to defaults when setting 1MB limits
  - LU-402 Fixed: Incorrect value of mysql-io after set to 1MB Now we pass IO limits to dbctl as bytes if Governor support this
  - LVEMAN-1102: optimize selectorctl --update-interpreter


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Stas Django <pythonpowerd@gmail.com> 1.2-49

changelog:
  - LU-411: Process dbctl stderr messages in cloudlinux-limits
  - LVES-751: Add nginx support for DirectAdmin cpapi
  - LVEMAN-1107 Call "lvectl sync-map" in cPanel acct hooks and indirectly via cron


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com> 1.2-50

changelog:
  - LVES-758: Add support collecting resellers statistics
  - LVEMAN-1119: Fix error in DA GUI: sudo: no tty present and no askpass program specified


author:
  Anton Volkov <avolkov@cloudlinux.com>, Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Alexander Grynchuk <agrynchuk@cloudlinux.com> 1.2-45

changelog:
  - LVEMAN-1091: Investigate selectorctl high memory consumption
  - LVES-728: Optimize plugins. lvestat.LVEStat
  - LVES-717 - Add is_reseller function to cllib (cpapi)
  - LVES-707 - Make function reseller_users working from a reseller account in DirectAdmin
  - PTCLLIB-88 - Correct handling /etc/container/mysql-governor.xml with reseller rights
  - LVES-714 Make cllib compatibility with lve 1.5
  - LVES-645 - Add to cpapi new feature for obtain users of a reseller (part 2)
  - LU-365: Print mysql-io limit in Kbytes per second in cllimits utility


author: Anton Volkov <avolkov@cloudlinux.com> - 1.2-76
changelog:
  - PTCLLIB-102: Optimize function time execute `clcommon.utils.grep`
  - LVEMAN-1179: Add human-readable errors on conf check failure
  - LVES-748: Drop LVE 4 compatibility


author:
  Pavel Negrobov <pnegrobov@cloudlinux.com>, schernikov <schernikov@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.2-78

changelog:
  - PTCLLIB-102: Optimize function time execute `clcommon.utils.grep`
  - LVEMAN-1179: Add human-readable errors on conf check failure
  - LVES-748: Drop LVE 4 compatibility


author: Anton Volkov <avolkov@cloudlinux.com> - 1.2-81
changelog:
  - PTCLLIB-103: Fix cpinfo behavior on plesk
  - PTCLLIB-106: UnboundLocalError in apache config parser


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Konstantin Vaskovtsov <derkonstantin@cloudlinux.com> 1.2-82.2

changelog:
  - PTCLLIB-103: Fix cpinfo behavior on plesk
  - PTCLLIB-106: UnboundLocalError in apache config parser


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Konstantin Vaskovtsov <derkonstantin@cloudlinux.com> 1.2-82

changelog:
[cell repeats an earlier one in this file: 100 characters]


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.4-1

changelog:
  - PTCLLIB-112: Fix traceback in safely_resolve_username_and_doc_root if user is absent
  - LVES-844: Implement resellers limits to lvectl for DA
  - PTCLLIB-109: Fix cpapi behavior on DirectAdmin
  - PTCLLIB-105: Main domain must be first in 'userdomains' result (plesk)
  - LVES-818: Implement reseller limits to lvectl for Plesk
  - LU-618: ensure that NodeJS application is workable after changing version or modules. Part II
  - LVES-873: Fix memory leak
  - LU-618: ensure that NodeJS application is workable after changing version or modules
  - PTCLLIB-111 Fix missing files on filesystem that are listed in %files section
  - PTCLLIB-108: add lvectl delete to prekill hook in panel_hooks_lib.py
  - LVES-770: cloudlinux-top doesn't work on plesk with reseller
  - LU-598: Fix traceback after run "lvectl sync-map" on no-panel Cloudlinux server
  - LU-448: Implement resellers method on plesk


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Egor Zvorykin <ezvorykin@cloudlinux.com> 1.4-2

changelog:
  - CAG-797: mount NodeJS Selector config directory into CageFS
  - CAG-796: use hidepid=2 when mounting /proc
  - LU-631: Keep reseller lve-id to avoid issues with statistics on Plesk
  - LVEMAN-1216: update node-selector.json file safely
  - LVEMAN-1210: recreate CRIU images when changing PHP version, extensions or options


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Egor Zvorykin <ezvorykin@cloudlinux.com> 1.4-4

changelog:
  - LVEMAN-1216: update node-selector.json file safely, part IV
  - LVEMAN-1253: Investigate problem with access to `/usr/local/directadmin/conf/directadmin.conf` file under user
  - PTCLLIB-110: Drop users information cache, take info directly from panel


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, schernikov <schernikov@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.4-5

changelog:
  - PTCLLIB-110: Drop users information cache, take info directly from panel
  - LU-697: Fix cloudlinux-selector output if user's main domain was changed
  - LVES-885 - Hide DA admin accounts in cloudlinux-top|statistics


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com> 1.4-8

changelog:
  - PTCLLIB-117: Rework DA cpapi plugin accoding to DA improvements
  - PTCLLIB-116: method for unmount dir in cagefs.mp
  - LU-735: Add ability to use additional domains in DirectAdmin for create NodeJS applications
  - LU-737: remount_proc.py should not ignore fs.proc_super_gid in /etc/sysctl.d/* files
  - LU-732: Fix subdomains in hook for changing main domain


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Vladislav Yakushenko <vyakushenko@cloudlinux.com> 1.4-9

changelog:
  - PTCLLIB-119: show human-readable exception when mysql-governor config is malformed
  - LU-725: Prettify unicode returned with "app_uri" key for NodeJS selector


author:
  Stanislav Sergiienko <ssergiienko@cloudlinux.com>, Vladislav Yakushenko <vyakushenko@cloudlinux.com> 1.4-10

changelog:
  - LU-775: Ignore stderr when calling whmapi1 & uapi
  - LU-762: Fix cPanel postmodifyacct: No such file or directory: '/var/lve/tmp/USERNAME'


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Konstantin Vaskovtsov <derkonstantin@cloudlinux.com> 1.4-11

changelog:
  - LVES-907: Fix displaying of "N/A" instead of domain on Plesk.
  - Move mail_helper from lve-stats 2
  - LU-771: Prettify unicode returned with "Application startup file" key for NodeJS selector


author:
  Konstantin Vaskovtsov <derkonstantin@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.4-12

changelog:
  - PTCLLIB-125: cllib utils.grep() works incorrectly and give wrong results in many places (e.g. DA package confusion)
  - LU-633: notify users when admin has changed version for their applications part 2: move mail helper from lve-stats2 to python-cllib add basic config for logging


author:
  Anton Volkov <avolkov@cloudlinux.com>, Konstantin Vaskovtsov <derkonstantin@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.4-13

changelog:
  - PTCLLIB-128: lvectl sync-map crashing when empty string present in user conf. skip broken and empty lines in config
  - LU-753: our code should process /etc/sysctl.d/* files along with /etc/sysctl.conf


author:
  Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.4-14.1

changelog:
  - LU-863: implement collecting system information for CL Usage
  - LU-866: add drop_privileges contextmanager to allow temporary drop privileges
  - LU-853: Make an exclude for /var/cpanel/users/system. Part II. (merged)
  - PTCLLIB-131: Remove get_governor_version error messages from stdout
  - LU-853: Make an exclude for /var/cpanel/users/system


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Egor Zvorykin <ezvorykin@cloudlinux.com>, Konstantin Vaskovtsov <derkonstantin@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.4-14.2

changelog:
  - LVEMAN-1360: Implement method that return list of domains that are affected by our php selector (cPanel)
  - LVEMAN-1362: Implement method that return list of domains that are affected by our php selector (Plesk)
  - LVEMAN-1363: Implement method that return list of domains that are affected by our php selector (DirectAdmin)
  - LU-938: Fix tests/utils with new cPanel 76


author:
  Pavel Negrobov <pnegrobov@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.2-72

changelog:
  - LU-535: Fix functions reseller_users from cpapi and reseller_uids from lveapi
  - PTCLLIB-100: cloudlinux-limits should recognize cPanel reseller with name shoter then 3 symbols


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Egor Zvorykin <ezvorykin@cloudlinux.com>, Konstantin Vaskovtsov <derkonstantin@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, schernikov <schernikov@cloudlinux.com> 1.5-1

changelog:
  - LU-1110: Fix fail during  collecting php domains statistics on da
  - LU-1070 Detect LiteSpeed in Wizard
  - LU-1023 Replace hardcoded list of php/python/ruby/nodejs interpreters and use groups for installation
  - PTCLLIB-143: Use full path for sysctl call in cldiag
  - LVEMAN-1374: Functional tests for PHP selector domains statistics (Plesk)
  - LVES-880 Fix issue with Username = N/A for reseller with disabled reseller limits on the Statistics tab
  - LVES-927: Fix issue with sending of localized templates for admin/reseller
  - LU-610: Add ability to integrate reseller limits to any control panel


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, dkulazhenko <dkulazhenko@cloudlinux.com> 1.5.1-1

changelog:
  - LU-1132: Fix conditions for python and ruby selector to be enabled on dashboard
  - LU-1151: Fix mysql restrict functionality via cloudlinux-limits utility
  - PTCLLIB-146: Fix error message when governor is down


author: alutsiuk <alutsiuk@cloudlinux.com> 1.5.3-1
changelog:
  - LU-1148: Fix PHP handler data collection for cloudlinux-summary when binaries are broken
  - LU-1196 cldiag "Check fs.enforce_symlinksifowner" failed with internal error


author: dkulazhenko <dkulazhenko@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 1.5.4-1
changelog:
  - LU-1198: Fix json errors when getting remote available groups info (part-2)
  - LU-1134 Fix CPAPIExternalProgramFailed exception in cloudlinux statistics when PHP is not installed
  - LU-1198: Fix json errors when getting remote available groups info


author: Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com> 1.5.6-1
changelog:
  - PTCLLIB-150: implement get_admin_locale method for panels other than cPanel
  - LVES-956: html notifications are not sent when locale is not en_US


author: Simba <dpoleev@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 1.5.8-1
changelog:
  - LVEMAN-1497 Automatically generate requirements file with extensions upon importing legacy apps
  - WEB-1515: Ignore not utf-8 characters in /etc/cl.selector/php.conf


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Simba <dpoleev@cloudlinux.com> 1.5.9-1

changelog:
  - WEB-1498: Show INODES in resource usage
  - LU-1334: Users were missing in LVE manager users tab
  - LU-1324: handle postmodifyacct_main for python selector


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Dmitriy Poleev <dpoleev@cloudlinux.com>, Sergey Kozhekin <skozhekin@cloudlinux.com> 1.5.11-1

changelog:
  - LVES-961: Cloudlinux top from user throws sentry error to output
  - PTCLLIB-155: Move cllib bundled hooks to the path not depending on python version
  - SonarQube python-cllib ger_ev
  - PTCLLIB-154: remove hooks from control panel during downgrade
  - CAG-949: Move dummy hooks to cllib and install plesk&da&cpanel proxies
  - LU-1340: Create public hooks system for 3dparty control panels
  - LU-1367: Run lve-utils rpm tests on real Panels(cPanel/Plesk)
  - LU-1341: Replace using of `too long script` by using of cpapi
  - LVEMAN-1557: Make use of new PassengerAppLogFile directive in our selectors


author: Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.5.12-1
changelog:
  - PTCLLIB-153: Move sentry to python-cllib package
  - PTCLLIB-153: Use sentry in python-cllib package


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.5.13-1

changelog:
  - PTCLLIB-172: Fix postrestoreacct_main in prod candidate
  - LU-1463: ValueError: invalid literal for int() with base 10: '--help'


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Sergey Kozhekin <skozhekin@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Ulugbek Samigjonov <usamigjonov@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>  1.5.12-2

changelog:
  - CAG-945: Cleanup cllib package from no longer used methods
  - CAG-945: Move sync-map hooks to lve-utils
  - CAG-945: Rename new_vendor -> new_owner in modify_user callbacks
  - CAG-945: Rewrite `py/node selector` hooks to new universal hooks system
  - CAG-945: unify is_root_or_exit in order to work with all control panels
  - Fix problems with detecting vendors control panel name under user
  - LU-1368: Cover cPanel with CPAPI tests
  - LU-1389: Do not use rpm -q in passenger and virtualenv detecting
  - LU-1390 Improve panels detection for statistics
  - LU-1552: Fix cpapirebuildcache after adding vendors cpapi proxy
  - LVEMAN-1552: Add debug logging about cpapi calls and their duration
  - LVEMAN-1552: Final implementation of CPAPI based on PoC
  - LVEMAN-1587: Change is_main filter argument value to lowercase
  - PTCCLIB-161: Method `cpapi.userdomains` doesn't work correct on Plesk
  - PTCLLIB-153: Improve plesk hooks install code to log errors to sentry
  - PTCLLIB-153: Move clsentry package to cllib
  - PTCLLIB-153: Use sentry in python-cllib package
  - SonarQube python-cllib add <c-checkers>
  - Temporary revert debug logging about cpapi calls and their duration
  - WEB-1580: Add ability to hide inodes in Plesk and DirectAdmin
  - WEB-1592: Do not show inode accordion if quota unavailable
  - CAG-965: Cleanup package from no longer used methods and hooks
  - CAG-965: Move user creation logic to universal lib
  - CAG-965: Move user_restore logic to universal lib
  - CAG-965: Move cagefs_plesk_hs_deleted and terminate_cagefs_account logic to universal lib


author:
  Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Ulugbek Samigjonov <usamigjonov@cloudlinux.com> 1.6.1-1

changelog:
  - Added using unicode user names as filter in function cpinfo of vendor cpapi plugin.
  - LU-1463: ValueError: invalid literal for int() with base 10: '--help'
  - PTCLLIB-171: Fix backward plugin's methods `_cpinfo` and `list_users`
  - WEB-1593: Use the same names for options in config file as it return cl_config
  - WEB-1594: Use new config file to store php selector status in plesk


author: Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.6.3-1
changelog:
  - Bump version for master branch 1.6.2-1
  - LU-1463: ValueError: invalid literal for int() with base 10: '--help'. Part II


author: Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.6.4-1
changelog:
  - CAG-965: Change pre delete with post delete admin
  - PTCLLIB-154: disable sentry only for downgrade


author:
  Anton Volkov <avolkov@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.6.5-1

changelog:
  - PTCLLIB-174: Add detailed logging about what happens in hooks
  - PTCLLIB-174: Use logrotate instead of RotatingFileHandler
  - PTCLLIB-174: Fix post_modify_domain hook for case when user and domain changed together
  - PTCLLIB-173: Return json response for universal hooks on cpanel
  - PTCLLIB-177 Install cpanel hooks even if hooks.yaml is missing
  - PTCLLIB-176 Investigate and fix failed hook tests on DA
  - LU-1487: replace alt-python27-MySQL-python with alt-python27-MySQL-meta in all spec files


author: Ulugbek <usamigjonov@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com> 1.6.6-1
changelog:
  - WEB-1658: Admin can not use "User interface settings"
  - PTCLLIB-175: Build alt-python27-cllib package for CL8


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Pavel Mogilnikov <pmogilnikov@cloudlinux.com> 1.6.8-1

changelog:
  - LU-1422: DA cpapi.userdomains with admins
  - CAG-1001: Don't copy etc during postwwwacct while restoring account
  - PTCLLIB-179 : (Stage 2) Safe fixes of futurize
  - PTCLLIB-179 : Stage 1 all imports
  - PTCLLIB-179 : Stage 1 of futurize
  - PTCLLIB-179 : Fix unittests behaviour
  - PTCLLIB-179 : fix reload_processes function
  - PTCLLIB-179 : Replace assert(Not)Eqals with assert(Not)Equal
  - Sonar Qube: disable rules related to unused imports and imports ordering


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com> 1.6.9-2

changelog:
  - LU-1589: Fix wizard errors on CL8
  - Add manual pyc pyo build for cl8
  - PTCLLIB-186: Make db_info optional, as mentioned in docs
  - PTCLLIB-185: Fix admins sync when admin does not have system user
  - PTCLLIB-183: rewrite pretrans using lua


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.6.11-1

changelog:
  - LU-1646 Fix cl-wizard on cl7h
  - PTCLLIB-195: Fix NoneType Traceback with whmapi call on CPanel 86.0
  - LU-1641: investigate issues with CL8 installation into empty chroot (ISO install)
  - PTCLLIB-183: rewrite pretrans using lua
  - PTCLLIB-193: fix issues with upgrade and downgrade of alt-python-cllib package
  - Fixed context manager `secureio.disable_quota`


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, pmogilnikov <pmogilnikov@cloudlinux.com> 2.0.8-3

changelog:
  - CAG-1027: Fix pickle incompatibility between python2 and python3
  - LU-1630 : usage of os.makedirs on py3
  - LU-1646 Fix cl-wizard on cl7h
  - LU-1641: investigate issues with CL8 installation into empty chroot (ISO install)
  - PTCLLIB-195: Fix NoneType Traceback with whmapi call on CPanel 86.0
  - PTCLLIB-183: rewrite pretrans using lua
  - PTCLLIB-193: fix issues with upgrade and downgrade of alt-python-cllib package
  - CAG-1014: Investigate failed test 958-list-mounted-users on DA
  - PTCLLIB-182: Fix hooks installation on cpanel 84+
  - LVEMAN-1636 fix sendmail subprocess error
  - LU-1583 enable pylint py3k for cllib
  - LU-1607 : (python-cllib) add interpolation=None
  - LU-1589: Fix wizard errors on CL8
  - PTCLLIB-191 : Fix unittests
  - LU-1501: Add manual pyc pyo build for cllib
  - LVES-968 make possible to get raw subprocess from run_command
  - PTCLLIB-186: Make db_info optional, as mentioned in docs
  - PTCLLIB-185: Fix admins sync when admin does not have system user
  - PTCLLIB-183: rewrite pretrans using lua
  - PTCLLIB-184 : Fix directadmin cpapi tests
  - add text=True to clcaptain
  - LU-1492: use text=True for subprocess while installing cpanel hooks
  - LU-1492: Write errors in case of bad cpanel configs
  - LU-1492: Make hooks installation work on plesk
  - minor fixes to cllib to work on py3
  - LU-1492: Remove byteify usage from cpapi plugins
  - PTCLLIB-179: use text=True in all subprocess calls
  - LU-1566 add -bb option to cllib
  - PTCLLIB-179: remove multiple imports on single lines
  - PTCLLIB-179 : fix cpapi plugins plesk users encoding
  - PTCLLIB-179 : fix vendors_api
  - PTCLLIB-179 : (Fixes) Stage 2 of futurize
  - PTCLLIB-179 : (Nobuild) Stage 2 of futurize
  - LU-1500: update spec and shebangs for python3
  - PTCLLIB-179 : (Stage 2) Safe fixes of futurize
  - PTCLLIB-179 : Fix unittests behaviour
  - PTCLLIB-179: Use bytes when parsing php_conf config
  - PTCLLIB-179 : fix reload_processes function
  - PTCLLIB-179 : Replace deprecated NoneType
  - PTCLLIB-179 : Replace __builtin__ imports with builtins
  - PTCLLIB-179 : Replace deprecated assertItemsEqual with assertCountEqual
  - PTCLLIB-179 : Replace assert(Not)Eqals with assert(Not)Equal
  - Sonar Qube: disable rules related to unused imports and imports ordering
  - LU-1500: Version up
  - PTCLLIB-175: Build alt-python27-cllib package for CL8
  - LU-1500: Add commented pylint --py3k
  - LU-1500: create master-py3 branch


author: alutsiuk <alutsiuk@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 2.0.8-5.1
changelog:
  - PTCLLIB-208: Bug in cagefs7 at ispmanager_create_user_wrapper_detect_php_ver function in /usr/share/cagefs/cagefs_ispmanager_lib.py
  - LU-1718 Make configparser less strict and ignore duplicated options in configs


author:
  Dmitriy Poleev <dpoleev@cloudlinux.com>, msozin <msozin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 2.0.11-1

changelog:
  - WEB-1823: PHP Selector small fixes
  - PTCLLIB-192: Implement new folder-based hooks installation mechanism on DA
  - PTCLLIB-199 Investigate why pre_delete_hooks fails on cpanel
  - WEB-1783: Implement logic about disable Domain tab for user


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 2.1.1-1

changelog:
  - PTCLLIB-208: Bug in cagefs7 at ispmanager_create_user_wrapper_detect_php_ver function in /usr/share/cagefs/cagefs_ispmanager_lib.py
  - LU-1718 Make configparser less strict and ignore duplicated options in configs
  - LU-1693: Configure sonarcube for all our projects
  - LVES-991: HTTP requests are not included into the Snapshots saved by SnapshotSaver
  - LU-1372: Add ability for vendor to list supported CL components
  - LU-1693: Configure sonarcube for all our projects
  - LU-1283: create dependency for lve-utils package
  - LU-1684: Add possibility to install lsapi via wizard on DirectAdmin from beta. Part II
  - Add text=True to subprocess in vendors_api.parser


author: alutsiuk <alutsiuk@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com> 2.1.2-1
changelog:
  - PTCLLIB-209: fix error in pretrans scriplet while installing CL7.8 from ISO image
  - LVES-996 Add method for getting aliases on Plesk and DA


author: alutsiuk <alutsiuk@cloudlinux.com> 2.1.4-1
changelog:
  - LU-1792: The new version of the lve-utils package is not compatible with the old version of cPanel
  - PTCLLIB-211: [Sentry] Subprocess in get_rpm_db_errors doesn`t have text=True


author: Stepan Oksanichenko <soksanichenko@cloudlinux.com> 2.1.5-1
changelog:
  - PTCLLIB-212: [Sentry] Fix `IndexError: string index out of range` in function of serialazing EVR
  - PTCLLIB-213: Add method `get_supported_cl_features` for ISP cpapi plugin


author: alutsiuk <alutsiuk@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com> 2.1.7-1
changelog:
  - CMT-126 fix systemid xml parsing
  - PTCLLIB-216: fix spec - alt-python27-cllib does not build in CL8


