# changelog

author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-19.1
changelog:
  - ALTPHP-1501: Update to 7.1.1-19
  - Updated libwebp to 1.3.2
  - Added package with libraries for static linking
  - Build with newer libraries for RHEL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-43.1
changelog:
  - ALTPHP-1896: Update to 7.1.1-43
  - ALTPHP-1920: Update libwebp to 1.5.0
  - ALTPHP-1932: Fix perfomance issues


author: Robert-André Mauchin <zebob.m@gmail.com> - 1.0.0-5.20180925gitd0076f5
changelog:
  - Update to commit d0076f507a6027455540e2e4f25f84ca38803e07
  - Set CONFIG_LOWBITDEPTH to 1
  - Fix #1632658


author: Robert-André Mauchin <zebob.m@gmail.com> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Close: rhbz#1954337
  - Security fix for CVE-2021-30473
  - Fix: rhbz#1961375
  - Fix: rhbz#1961376
  - Security fix for CVE-2021-30475
  - Fix: rhbz#1968017
  - Fix: rhbz#1968018


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.11.0-2
changelog:
  - don't add link to ldap in *.pc file if ldap.pc doesn't exist
  - don't add link to mit-krb5-gssapi in *.pc file if mit-krb5-gssapi.pc.pc doesn't exist


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.19.0-2
changelog:
  - ALTPHP-2119: patch to allow building alt-curlssl11 with OpenSSL 1.1
    (curl 8.19.0 dropped OpenSSL < 3.0 support upstream)
  - Fix OPENSSL_VERSION_STRING -> OPENSSL_VERSION for OpenSSL 1.1 compat
  - Fix doc file references: FAQ -> FAQ.md, TODO -> TODO.md, KNOWN_BUGS -> KNOWN_BUGS.md
  - Disable flaky tests 763, 1501, 1583


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 8.19.0-3
changelog:
  - ALTPHP-2106: pin alt-nghttp2 runtime requirement to the version we built
    against, to avoid undefined-symbol errors when an older alt-nghttp2 is
    installed alongside a freshly built alt-curlssl11


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.19.0-4
changelog:
  - Restore short "OpenSSL/1.1.1w" SSL version string (drop the duplicated
    "OpenSSL " prefix and trailing release date introduced when working
    around OPENSSL_VERSION_STRING for alt-openssl11)


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 1.5.3-1
changelog:
  - EA4D-914: Update to 1.5.3 (libheif 1.23.x requires the dav1d >= 1.0 API)
  - Track libdav1d.so.7 soname


author: Frediano Ziglio <freddy77@angelfire.com>
changelog:
  - remove dependency from freetds-unixodbc
  - fix field name (Copyright instead of License)
  - updated URL


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 57.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow): not applied
    for v57 yet (see TODO.md)
  - Drop SOURCE100/101 dep filters, use alt_default_filter
  - Drop downstream ".cloudlinux.1" release suffix; align Release with
    other ICU lines


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 65.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Run %check as two top-level make calls (source/test + xcheck-local)
    to dodge ICU's broken nested-make jobserver pattern; tests now run
    strictly without "||:"


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 71.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Release bumped to align with other ICU lines


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.1.1-1
changelog:
  - Update to 1.1.1
  - Port spec to CMake (autotools build system removed upstream in 1.1.x)
  - Drop sherlock265/SDL/Qt bits and no-longer-shipped example tools


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 3.14.1-1
changelog:
  - EA4D-913: Update to 3.14.1
  - Port spec to CMake (autotools build system removed upstream in 3.10)
  - Stop shipping static libraries and libtool archives (CMake shared-only build)
  - C++ library is now versioned libgeos.so.3.14; C API soname libgeos_c.so.1
    is unchanged and stays backward compatible


author: Alex71 <nyrk71@gmail.com> 2.1.0-2
changelog:
  - put libhpdf.so in the devel package and libhpdf-2.1.0.so in the main one
  - removed duplicated README and CHANGES from devel package
  - fixed "E: empty-debuginfo-package" with --enable-debug flag in configure
  - removed INSTALL file
  - added demo/ directory in doc (devel only) as doc


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.11.1-4
changelog:
  - ALTPHP-2484: Fix CVE-2026-55200 (transport.c OOB write), CVE-2026-55199
    (EXT_INFO handler DoS), CVE-2025-15661 (sftp_symlink OOB read)


author: Remi Collet <remi@remirepo.net> - 1.3.2-1
changelog:
  - update to 1.3.2
  - drop multilib header hack
  - change URL to https://libzip.org/
  - test suite now ok on all arch


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-8
changelog:
  - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering
    with Hash class internals in policy mechanism


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-10
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits()
    that could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-11
changelog:
  - CVE-2022-32213: fix missing CR validation in header separators to prevent
    HTTP request smuggling via malformed headers
  - CVE-2022-32214: fix Transfer-Encoding header validation to reject invalid
    and repeated chunked encoding values
  - CVE-2022-32215: fix Transfer-Encoding header parsing to prevent smuggling
    attacks via conflicting encoding declarations
  - CVE-2022-35256: fix header overflow calculation to properly detect and
    reject oversized HTTP headers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-13
changelog:
  - CVE-2023-46809: fix a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-14
changelog:
  - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource
    exhaustion during decompression


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-15
changelog:
  - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection
    on abrupt socket close


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 12.22.12-16
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism that could expose uninitialized memory when using vm module with
    timeout options, preventing potential information disclosure


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-17
changelog:
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-2.tuxcare.els6
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that
    could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-4
changelog:
  - CVE-2023-32559: disable process.binding() when policy is enabled,
    update deprecations and errors docs, add new tests ensuring denial behavior,
    include new policy + app test fixtures


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-5
changelog:
  - CVE-2023-30589: fix llhttp parser to properly validate LF after CR
    in HTTP header fields, add lenient flag checks before allowing CR without LF,
    add test file to verify the fix prevents request smuggling attacks


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-11
changelog:
  - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1.1.1p-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free on empty digestAlgorithms)
  - Build on CL8 again: drop ExcludeArch: x86_64 (ELS-2378)


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-8
changelog:
  - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to
    prevent sensitive data leakage


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 16.20.2-12
changelog:
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 16.20.2-13
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism preventing race condition that could expose uninitialized memory


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 16.20.2-16
changelog:
  - Obsolete alt-nodejs16-openssl{,-devel,-libs} < 1.1.1e on el8+ to prevent
    OPENSSL_1_1_1e symbol version mismatch when stale alt OpenSSL in RPATH
    shadows system OpenSSL


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-5
changelog:
  - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch
    blocks to route exceptions through error handlers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.9.10-1
changelog:
  - Update to 6.9.10
  - Drop betaver macro: 6.9.10 has no revised re-release (rev1 was 6.9.5-only)
  - Build with --enable-binary-compatible-posix-api: keep exporting the
    unprefixed POSIX symbols (regcomp/regexec/regfree/regerror + reg_*)
    that 6.9.5 exported; upstream renamed them to onig_posix_* in 6.9.6
    and the soname does not change, so dropping them would be a silent
    ABI break for any POSIX-API consumer


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1598103)
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.0.2u-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free)
  - Guard -Wno-error=incompatible-pointer-types/-implicit-function-declaration
    to gcc >= 6 (rhel >= 8) so the build no longer fails on CL7 gcc 4.8.5


author: Tomas Hoger <thoger@redhat.com> - 7.3-3
changelog:
  - Backport patch from upstream pcre 7.6 to address buffer overflow
    caused by "a character class containing a very large number of
    characters with codepoints greater than 255 (in UTF-8 mode)"
    CVE-2008-0674, #431660
  - Try re-enabling make check again.


author: Lubomir Rintel <lkundrak@v3.sk> - 7.8-1
changelog:
  - Update to 7.8, drop upstreamed patches
  - Fix destination of documentation (#427763)
  - Use buildroot macro consistently
  - Separate the static library, as per current Guidelines
  - Satisfy rpmlint


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> - 0.1-1

changelog:
  - MODLS-732: Elastic-APM funcionality separated
  - MODLS-709: Added APM agent with distributed tracing support
  - MODLS-707: Made aapm agent work asynchronously
  - MODLS-701: Added python APM agent
  - MODLS-678: Initial version of alt-php-apm


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 7.4.21-3
changelog:
  - ALTPHP-1154: Fix libxml requires
  - ALTPHP-1156: Get rid of manipulations with enabling extensions (mysqli.so) in default.ini


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-3
changelog:
  - ALTPHP-1355: fix linksafe for all sub-packages
  - fix rpath for zip extension
  - add alt-php74-imunify-leveldb provides


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.4.33-4
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-161
changelog:
  - Fix for hardened PHP
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-163
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.1.6-169
changelog:
  - Fix for hardened PHP
  - CVE-2022-31629: use stack instead of heap, check correct one var
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.1.6-171
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.1.6-32
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-45
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-47
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Added dependency to new xdebug extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-51
changelog:
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1950: Moved inotify to separate package


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-188
changelog:
  - Fix for Harden PHP
  - CVE-2021-21704: fix errors in pdo_firebird extension
  - CVE-2021-21705: add user name and password validation in filters module


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.2.17-189
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-194
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.2.17-198
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-203
changelog:
  - Security fixes
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-206
changelog:
  - Security fixes
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-207
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    injection


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-208
changelog:
  - Security fixes
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-210
changelog:
  - Security fixes
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-211
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-212
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-214
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-215
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-221
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.2 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-223
changelog:
  - ELS-2362: build litespeed SAPI with devtoolset-7 on CL6 (lsapi uses C11 __atomic builtins requiring gcc >= 4.7)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-225
changelog:
  - CVE-2013-4113: ext/xml heap overflow in xml_parse_into_struct() via deeply
    nested XML - parser->ltags[parser->level-1] was written past the XML_MAXLEVEL
    (255) slot allocation. Backport upstream 7d163e8 (truncate results at depth
    255 and emit "Maximum depth exceeded - Results truncated" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-226
changelog:
  - CVE-2014-3515: SplObjectStorage::unserialize() type confusion in
    ext/spl/spl_observer.c — the unserialized members payload was passed to
    zend_hash_copy() without checking it is an array. Backport the
    spl_observer.c half of upstream a374dfab (reject non-IS_ARRAY members).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-228
changelog:
  - CVE-2016-5385: httpoxy - PHP populated HTTP_PROXY from the untrusted "Proxy"
    request header in CGI/FastCGI environments, letting a remote attacker
    redirect an application's outbound HTTP traffic to an arbitrary proxy
    (_SERVER/_ENV and getenv() now honor HTTP_PROXY only from the real
    local environment; sapi_getenv() never returns HTTP_PROXY)


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.2.17-39
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.
  - ALTPHP-1769: Build for RHEL 9.


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.8.0-3
changelog:
  - Fix build on el10: relax -Werror=incompatible-pointer-types for c-ares 1.34 ares_callback signature change


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-121
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-123
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-129
changelog:
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-131
changelog:
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-132
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-134
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-135
changelog:
  - ALTPHP-2013: Moved APC, ares, bcompiler, bloomy, big_int, bz2_filter, coin_acceptor to separate packages; add runtime requires


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.4.4-20
changelog:
  - ALTPHP-2455: Allow CL10 (el10) build for alt-php53; keep php52/54/55 excluded (not on CL10).
  - ALTPHP-2455: Add -Wno-incompatible-pointer-types for GCC 15 (const mismatch in imagick_file.c).
  - ALTPHP-2455: Link static ImageMagick delegate libs explicitly on el10 from bundled .la dependency_libs (fixes undefined symbols jpeg_resync_to_restart / ZSTD_initCStream / SharpYuvGetConversionMatrix).


author: Eduard Chiganov <echiganov@cloudlinux.com> 2.1.0-1
changelog:
  - ALTPHP-1654: Newer version of memcached for alt-php 74-82.
  - EA4D-454: Create alt-phpXX-pecl-memcached.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.2.8-11
changelog:
  - ALTPHP-2283: Fix test crash from missing require_once files; fix testObject for Redis 7+ listpack.
  - ALTPHP-2283: Add PHP 5.2 early-exit to avoid running tests requiring 5.3+ features.


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-160
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-167
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-1713: add ext/curl/php_curl.h to devel sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-173
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-175
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-178
changelog:
  - Security fixes
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-179
changelog:
  - Security fixes
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-185
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.3.29-186
changelog:
  - ALTPHP-2049: Change method of creating php_handlers for plesk.
  - ALTPHP-2060: Rename alt-phpXY-fpm to alt-phpXY-php-fpm.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-189
changelog:
  - ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-190
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php53/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-193
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.3 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.3 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-201
changelog:
  - CVE-2015-4604: fileinfo/libmagic out-of-bounds read in mcopy() FILE_SEARCH/FILE_REGEX
    (clamp offset to nbytes; backport of upstream file(1) f938112c)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-203
changelog:
  - CVE-2016-5385: httpoxy - do not trust client-supplied Proxy header exposed as the HTTP_PROXY environment variable


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-204
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. Adopt the same FPM layout as php70+: a global php-fpm.conf that includes php-fpm.d/*.conf plus a default www.conf pool listening on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port and per-domain pools in php-fpm.d still load. On Debian-like distros the pool group is set to nogroup (no nobody group). Drop the now redundant php-fpm.conf.default/.plesk.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-205
changelog:
  - CVE-2014-1943: fileinfo denial of service (infinite recursion) via a crafted
    indirect-offset magic rule; add FILE_INDIRECT offset==0 guard and bound the
    recursion depth
  - CVE-2013-7345, CVE-2014-3538: fileinfo denial of service (CPU consumption) via
    catastrophic regex backtracking on the awk-rule detector; cap the regex search
    window (CVE-2014-3538 is the complete fix for the incomplete CVE-2013-7345 fix)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-206
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-
    padding ciphers (aes-*-wrap-pad); the output buffer was sized data_len + one
    block but RFC 5649 wrap-pad output can exceed that, so reserve an extra
    EVP_CIPHER_block_size() for EVP_CIPH_WRAP_MODE ciphers


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 3.1.3-3
changelog:
  - Remove failing eio tests (custom_basic, grp_add, open_error, seek) on CL10 due to floating-point related issues in eio environment


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.1.4-1
changelog:
  - ALTPHP-2492: Update to 3.1.4 version
  - php85-fix.patch dropped (fix absorbed upstream in 3.1.4)
  - Exclude (php53/54/55, platform) combos with no base alt-php runtime
  - Skip kernel-flaky tests on newer platforms: fork.phpt (el10); via debian/rules
    the floating eio-env set (custom_basic/grp_add/open_error/seek) + fork on
    ubuntu24 (kernel 6.8, same set already removed on el10/debian13) and fork on
    debian13; eio_write_variation.phpt on php<=53 deb (PHP 5.4+ syntax). All are
    env/test artifacts, not eio functional regressions.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.1.4-2
changelog:
  - ALTPHP-2201: Fix the root cause of the "floating eio environment" test
    failures instead of deleting the affected tests.
    PHP_EIO_RET_IF_FAILED() inspected req->result right after libeio's SEND
    macro had already called eio_submit(), so when a worker thread finished the
    syscall first the extension returned FALSE for a request that had actually
    succeeded (eio_read/eio_open/eio_seek/eio_custom all return non-zero on
    success). eio_grp_add() then got a bool, the group lost a member request and
    the run ended in SIGSEGV. Submission can only fail with a NULL req, so that
    is now the only condition checked (eio-req-result-race.patch).
  - Fix fork.phpt deleting the parent process's file from the forked child while
    the parent's write callback still stats and reads it (fork-test-unlink-race.patch).
  - Restore eio_grp_add/eio_open_error/eio_seek and fork.phpt on el10, debian13
    and ubuntu24_04 - they are no longer removed on any platform.
  - Skip eio_custom_basic.phpt on all platforms: eio_custom() runs userspace PHP
    from a libeio worker thread with no synchronisation, so it races with the main
    thread over the output buffer. Reported upstream.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-155
changelog:
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-157
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-158
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-159
changelog:
  - ALTPHP-1087: Removed non-functional amqp package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-161
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-162
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-164
changelog:
  - ALTPHP-2014: Moved out extensions: crack, doublemetaphone, functional, haru, hidef, huffman, idn, inclued


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 4.3.0-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.1.6-1
changelog:
  - ALTPHP-1935: Support for tideways_xhprof for alt-php84.
  - ALTPHP-1957: Create alt-phpXX-pecl-xhprof-extension.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.4.45-143
changelog:
  - ALTPHP-1531: add provides alt-php-handler-lsphp and alt-php81-handler-lsphp
  - remove changes from ALTPHP-1508


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.4.45-162
changelog:
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.4.45-173
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php54/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-178
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.4 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.4 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-186
changelog:
  - CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with aes-*-wrap-pad by reserving an extra cipher block for RFC 5649 padded key-wrap output


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 0.14.2-1
changelog:
  - ALTPHP-2268: rebuild as PECL brotli extension
  - ALTPHP-2268: rename package to alt-php*-pecl-brotli


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-144
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Updated imagick to 3.7.0


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-150
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-151
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-154
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package
  - ALTPHP-1822: Moved oci8 to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-126
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Expand allowed version list for bison package


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-131
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.5.38-141
changelog:
  - Security fixes
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-153
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php55/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.5.38-155
changelog:
  - ALTPHP-2340: Add Conflicts with zend-guard-loader < 7.0.0-9 to opcache
    subpackage to block co-install with broken old zend-guard-loader versions


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-159
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.5 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.5 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-160
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin
  - Add remaining utf8mb4_0900 collation ids 304-323 to mysqlnd charset table (MySQL 8.0.x/8.4)


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-161
changelog:
  - CLOS-4506: Fix lsphp site-isolation ctor overwriting per-vhost DOCUMENT_ROOT
  - ALTPHP-2448: Gate %postun per-user PHP Selector reset on Elevate upgrade markers


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-164
changelog:
  - CVE-2016-1283: heap buffer overflow in bundled PCRE 8.38 pcre_compile2()
    via a crafted regex with multiple identically named nested groups
    (ELSLANG-50866, ELSLANG-40077, ELSLANG-40080, ELSLANG-40110, ELSLANG-40125)
    - debian/patches/php-5.5-CVE-2016-1283.patch: backport PCRE 8.39 rev 1636 /
      PHP bug #75207 - remove the "else" so the named-group recno scan is always
      performed, over-allocating rather than under-allocating. PHP 5.5 was EOL
      before the bug #75207 backport landed for 5.6/7.0/7.1.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-167
changelog:
  - CVE-2026-14355: heap buffer overflow in openssl_encrypt()/openssl_decrypt()
    with AES key-wrap-with-padding ciphers (aes-*-wrap-pad, RFC 5649) when built
    against OpenSSL 3.x (ELSLANG-59751, ELSLANG-59676, ELSLANG-59675,
    ELSLANG-59687, ELSLANG-59692)
    - debian/patches/php-5.5-CVE-2026-14355.patch: backport upstream
      cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187) - reserve one extra
      EVP_CIPHER_block_size for EVP_CIPH_WRAP_MODE ciphers at the output-buffer
      allocation. 5.5 has no php_openssl_cipher_update() helper, so the fix is
      applied to both inline call sites (openssl_encrypt + openssl_decrypt).


author: Eduard Abdullin <eabdullin@cloudlinux.com> 1-127
changelog:
  - ALTPHP-1195: Updated alt-ImageMagick require to 7.1.0 version
  - ALTPHP-1188: Update imagick to 3.5.1


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-133
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-138
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-108.1
changelog:
  - ALTPHP-2148: Remove erroneous HAVE_UNIX_H from php_config.h
  - ALTPHP-2132: remove php_handler header from /etc/psa/php_versions.d/alt-php*.conf


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-117
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php56/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-122
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.6 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.6 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-129
changelog:
  * Mon Jun 09 2026 Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-129
  - Bump release to include CLOS-4506 and ALTPHP-2448 in RPM tag


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-132
changelog:
  - ALTPHP-2485: ship a default www.conf pool listening on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) so alt-phpXY-fpm starts on non-panel hosts without colliding on 127.0.0.1:9000; php-fpm.conf already includes php-fpm.d/*.conf. group=nogroup on Debian-like distros. Ship an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-133
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding
    (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + one cipher
    block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and
    overflows the heap when built against OpenSSL 3.x. Backport of upstream commit
    cbc0489126 (GH-22187): reserve one extra block for EVP_CIPH_WRAP_MODE ciphers.
    (5.6 has no php_openssl_cipher_update() helper; the fix is applied to the inline
    allocations in both openssl_encrypt() and openssl_decrypt())


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-80
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Constraint max version for bison package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-113
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Moved xdebug to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-116
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.8.1-20
changelog:
  - ALTPHP-2455: Allow CL10 (el10) build for alt-php53; keep php52/54/55 excluded (not on CL10).
  - ALTPHP-2455: Add -Wno-incompatible-pointer-types for GCC 15 (const mismatch in imagick_file.c).


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.8.1-22
changelog:
  - ALTPHP-2352: drop redundant php8.5 smart-string patch on Debian (3.8.1 already includes the fix; patch rejected and broke the deb build)


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 4.2.0-3
changelog:
  - Skip test 065phpt (Directory streams with RecursiveDirectoryIterator).
  PECL RAR dir_readdir returns full paths instead of single path components,
  so RecursiveDirectoryIterator only lists 4 files instead of 10. Proper fix
  belongs in rar_stream.c (php_rar_dir_ops_read).


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-92
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: Heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-96
changelog:
  - Security fixes
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-97
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-99
changelog:
  - Security fixes
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-103
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini
  - ALTPHP-2080: Refactor debian spec


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-112.2
changelog:
  - Security fixes
  - CVE-2015-9253: fix PHP-FPM exhaustion CPU and memory issue causing denial
    of service


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-118
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php70/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-124
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-125
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-134
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. The default www.conf pool now listens on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port. On Debian-like distros the pool group is set to nogroup (no nobody group). Ship an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-135
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-pad
    (aes-*-wrap-pad) ciphers; the output buffer was sized as
    data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap
    output. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of
    upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c)


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.0.33-71
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string
  - Fix build dependencies


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-86
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.0.0-5.dfe1ab17b0
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/geos.ini
    so geos loads outside cagefs/panel.


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 5.1.28-1
changelog:
  - ALTPHP-2491: Update apcu to 5.1.28
  - ALTPHP-2491: Remove obsolete php85-fix.patch entirely (report_memleaks fixed upstream; apc_entry_003.phpt rewritten upstream in 5.1.28 so its base EXPECTF already matches php85); drop %prep removal of tests/bug63224.phpt (removed upstream)
  - ALTPHP-2491: Skip tests/apc_mmap_hugepage_002.phpt (needs reserved hugepages, unavailable in build-system QA)


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 5.1.28-2
changelog:
  - ALTPHP-2491: Skip all tests/apc_mmap_hugepage_*.phpt (005/006 fatal on CL7 3.10 kernel without hugepage support, family needs reserved hugepages unavailable in build-system QA)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-96
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Moved rar to separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-98
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-99
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-100
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-101
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1798: Added dependency to new apcu-bc extension
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-103
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.81.0-1
changelog:
  - ALTPHP-2450: Update to 1.81.0 version
  - Build with GCC 10 on Ubuntu 20.04 (default GCC 9 ICEs on grpc 1.81.0)
  - Exclude PHP 8.4/8.5 on Ubuntu 16.04 (no alt-php84/85 for Xenial)


author: Eduard Chiganov <echiganov@cloudlinux.com> 3.2.15-1
changelog:
  - EA4D-454: Create alt-phpXX-pecl-igbinary.
  - ALTPHP-1686: Newer version of igbinary for alt-php 70-83.


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.2.16-6
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/40-igbinary.ini
    so igbinary loads outside cagefs/panel. Prefix 40- loads after msgpack (20-).


author: Sergey Fokin <sfokin@cloudlinux.com> - 2.2.0-2
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/20-msgpack.ini
    so msgpack loads outside cagefs/panel. Load-order prefix 20- (base dep).


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 5.3.7-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Merge older-OS test skips into main patch; apply unconditionally.


author: Levon Matshkalyan <levon.matshkalyan@cloudlinux.com> - 5.0.4-3
changelog:
  - ALTPHP-2268: Add Provides/Obsoletes for zts in tideways-zts subpackage to support rename and avoid file conflicts


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 0.13.0-2
changelog:
  - ALTPHP-2282: EL10+ support for PHP <= 7.4:
    - PHP 7.0 still needs pcre1 (its own php_pcre.h #includes "pcre.h");
      use alt-pcre-devel from /opt/alt/pcre/ on EL10+
    - PHP 7.1-7.3 on EL10+ compile cleanly against pcre2-devel
      (pcre1 removed from EL10 base repos)
    - QA_RPATHS=0x0002 to allow /opt/alt/pcre/ rpath under EL10's
      stricter brp-check-rpaths (matches alt-pcre.spec itself)
    - Apply altea-2282-pcre-test-compat.patch: switch the affected
      phpt EXPECT/EXPECTF patterns to %A-anchored EXPECTF so they
      pass on both pcre1 (EL7-9) and pcre2 (EL10+) builds. Covers
      cookies_encryption_warning/*, broken_configuration/encrypt_regexp_cookies_bad_regexp,
      and upload_validation/upload_validation


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-92
changelog:
  - ALTPHP-2406: use alt-libicu65 for all OS
  - ALTPHP-2406: fix unversioned alt-libicu rpath on rhel<=8


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.1.33-100
changelog:
  - CVE-2026-14355: fix openssl_encrypt() zend mm heap overflow on AES key-wrap-with-padding (aes-*-wrap-pad) by reserving an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream cbc0489126a7682796aad1e5fb4e51de74af162c)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.1.33-62
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-65
changelog:
  - Security fixes
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.1.33-66
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-70
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-84
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php71/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-83
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - ALTPHP-1507: Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-84
changelog:
  - Moved uploadprogress to separate package
  - Moved newrelic to separate package
  - Added dependency to new scoutapm extension in separate package


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.0.10-1
changelog:
  - ALTPHP-2500: Update to 2.0.10 version; drop php-8.4-fix-php_rand.patch
    and php85-fix.patch (absorbed upstream)


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.3.0-1
changelog:
  - ALTPHP-2508: Update to 2.3.0 version; regenerate php85-fix.patch
    (header and test fixes partially absorbed upstream)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-47
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat
  - Fix #74267: segfault with streams and invalid data


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.2.34-50
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.2.34-52
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.2.34-66
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php72/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.2.34-84
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding
    (aes-*-wrap-pad) ciphers; the output buffer was sized as data_len + one block, which
    under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend
    heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-87
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - alt-ImageMagick is linked statically now
  - Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-90
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Added solr in separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.0.7-2
changelog:
  - ALTPHP-2396: Add explicit Requires: libmcrypt so yum pulls libmcrypt
    from alt-common on CL10 instead of ea-libmcrypt (cPanel) which installs
    outside the system LD path.


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-23
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-33
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-36
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.3.33-52
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php73/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.3.33-67
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. The default
    www.conf pool now listens on a per-version unix socket
    (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple
    alt-php FPM services no longer collide on the same TCP port. On Debian-like
    distros the pool group is set to nogroup (no nobody group exists there). Ship
    an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on
    non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.3.33-68
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow (zend_mm heap
    corruption) with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers when
    built against OpenSSL 3.x; size the output buffer for RFC 5649 padded wrap


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-66
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-28
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-43
changelog:
  - ALTPHP-2168: Add include= to php-fpm.conf
  - ALTPHP-2168: Make the paths in php-fpm.conf and logrotate even


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-49
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php74/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-63
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and add Requires: alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php74-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.4.33-64
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap
    with padding (aes-*-wrap-pad). php_openssl_cipher_update() sized the output
    buffer as data_len + one cipher block, undersizing it for RFC 5649 padded
    wrap output; reserve an extra block for EVP_CIPH_WRAP_MODE ciphers.


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.4.8-2
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - ALTPHP-961: Update litespeed to 7.7 version


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-53
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added dependency to new leveldb extension


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-10
changelog:
  - ALTPHP-2283: Update to 6.3.0 version (fixes testServerInfo on Redis 8 / Valkey; upstream PR phpredis#2656).


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-11
changelog:
  - ALTPHP-2283: Fix test suite failures: add Redis version guards for tests requiring Redis 6.0+/6.2+.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Disable testIgnoreNumbers, testExists, testServerInfo, testPackHelpers (fail on older Redis / PHP 8.5).


author: Dmitriy Popov <dpopov@cloudlinux.com> - 8.0.30-8
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug
    causing password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-11
changelog:
  - Actually apply php-8.0-CVE-2024-3096.patch and php-8.0-CVE-2024-2756.patch
    for Ubuntu < 22.04 and Debian < 11 systems


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 8.0.30-23
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - fix regression in CVE-2024-11234 patch


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-25
changelog:
  - Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.0.30-37
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php80/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-42
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2025-14179: pdo_firebird SQL injection via NUL bytes in quoted strings
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7259: mbstring NULL pointer dereference in php_mb_check_encoding()
    via mb_ereg_search_init() with Oniguruma-only encodings (iso-8859-11, UJIS,
    KOI8-R, ...)
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-52
changelog:
  - ELS-2362: generate Plesk psa handler files only on rhel>=7 to match the
    %files guard (fixes "installed but unpackaged" psa files on EL6/CL6)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-54
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php80-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-55
changelog:
  - CVE-2026-14355: heap buffer overflow in openssl_encrypt() with AES key-wrap
    padding (aes-*-wrap-pad); reserve an extra EVP_CIPHER_block_size() block for
    EVP_CIPH_WRAP_MODE ciphers in php_openssl_cipher_update()


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-28
changelog:
  - ALTPHP-1402: update mailparse to 3.1.4
  - ALTPHP-1408: Redis extension updated to 5.3.7
  - ALTPHP-1507: Swoole extension updated to 5.0.3
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - yaz updated to 1.2.4


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - Fixed requires
  - Brought back yaf and gnupg
  - Updated uploadprogress to 2.0.2
  - Updated vips to 1.0.13
  - Updated gnupg to 1.5.1
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-33
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved redis to separate package
  - Added dependency to new geos ext


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-34
changelog:
  - Moved swoole to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-36
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1754: Moved xmlrpc to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-38
changelog:
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-39
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-40
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.9.3-2
changelog:
  - ALTPHP-2268: Fix building for PHP 8.5 (php_smart_string.h removed)
  - ALTPHP-2268: Fix building for PHP 8.5 (zend_exception_get_default() replaced with zend_ce_exception)
  - ALTPHP-2268: Fix BuildRequires for CL10 (pcre-devel removed, use pcre2-devel only)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php81/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-15
changelog:
  - ALTPHP-2406: use alt-libicu71 for all OS
  - ALTPHP-2406: drop duplicated 71 in PKG_CONFIG_PATH on rhel<=8


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.1.34-23
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php81-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.1.34-24
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with
    padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized
    the output buffer as data_len + one cipher block, undersizing it for RFC 5649
    padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap
    under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of
    upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-19
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.16-1
changelog:
  - update to 8.2.16
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.2.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php82/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.2.31-10
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php82-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-20
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - Updated yaml to 2.2.3
  - Updated igbinary to 3.2.14
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.3-1
changelog:
  - update to 8.3.3
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.3.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php83/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.3.31-11
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php83-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.30-1
changelog:
  - ALTPHP-2281: update to 8.3.30
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Eduard Chiganov <echiganov@cloudlinux.com> - 8.4.0-0.rc3
changelog:
  - ALTPHP-1880: Updated to RC3.
  - ALTPHP-1860: Remove deprecated sid_length and sid_bits settings.
  - Disabled thread safety by default.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.4.18-3
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php84/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.4.22-8
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php84-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.4.17-1
changelog:
  - ALTPHP-2280: Update to 8.4.17 version
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-3
changelog:
  - ALTPHP-1935: Added xhprof in separate package
  - ALTPHP-1946: Added bitset in separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added htscanner in separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added leveldb in separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-4
changelog:
  - ALTPHP-2043: add to requires:
      alt-php84-newrelic
      alt-php84-pecl-gender
      alt-php84-pecl-propro


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 4.2.6-3
changelog:
  - Use PECL version instead of testing one
  - ALTPHP-2063: Add obsoletes for alt-php-pecl-propro on PHP8


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.5.3-4
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php85/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.5.7-7
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php85-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Dmitriy Poleev <dpoleev@cloudlinux.com>, Sergey Kozhekin <skozhekin@cloudlinux.com> 1.5.11-1

changelog:
  - LVES-961: Cloudlinux top from user throws sentry error to output
  - PTCLLIB-155: Move cllib bundled hooks to the path not depending on python version
  - SonarQube python-cllib ger_ev
  - PTCLLIB-154: remove hooks from control panel during downgrade
  - CAG-949: Move dummy hooks to cllib and install plesk&da&cpanel proxies
  - LU-1340: Create public hooks system for 3dparty control panels
  - LU-1367: Run lve-utils rpm tests on real Panels(cPanel/Plesk)
  - LU-1341: Replace using of `too long script` by using of cpapi
  - LVEMAN-1557: Make use of new PassengerAppLogFile directive in our selectors


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Sergey Kozhekin <skozhekin@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Ulugbek Samigjonov <usamigjonov@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>  1.5.12-2

changelog:
  - CAG-945: Cleanup cllib package from no longer used methods
  - CAG-945: Move sync-map hooks to lve-utils
  - CAG-945: Rename new_vendor -> new_owner in modify_user callbacks
  - CAG-945: Rewrite `py/node selector` hooks to new universal hooks system
  - CAG-945: unify is_root_or_exit in order to work with all control panels
  - Fix problems with detecting vendors control panel name under user
  - LU-1368: Cover cPanel with CPAPI tests
  - LU-1389: Do not use rpm -q in passenger and virtualenv detecting
  - LU-1390 Improve panels detection for statistics
  - LU-1552: Fix cpapirebuildcache after adding vendors cpapi proxy
  - LVEMAN-1552: Add debug logging about cpapi calls and their duration
  - LVEMAN-1552: Final implementation of CPAPI based on PoC
  - LVEMAN-1587: Change is_main filter argument value to lowercase
  - PTCCLIB-161: Method `cpapi.userdomains` doesn't work correct on Plesk
  - PTCLLIB-153: Improve plesk hooks install code to log errors to sentry
  - PTCLLIB-153: Move clsentry package to cllib
  - PTCLLIB-153: Use sentry in python-cllib package
  - SonarQube python-cllib add <c-checkers>
  - Temporary revert debug logging about cpapi calls and their duration
  - WEB-1580: Add ability to hide inodes in Plesk and DirectAdmin
  - WEB-1592: Do not show inode accordion if quota unavailable
  - CAG-965: Cleanup package from no longer used methods and hooks
  - CAG-965: Move user creation logic to universal lib
  - CAG-965: Move user_restore logic to universal lib
  - CAG-965: Move cagefs_plesk_hs_deleted and terminate_cagefs_account logic to universal lib


author:
  Stepan Oksanichenko <soksanichenko@cloudlinux.com>, Ulugbek Samigjonov <usamigjonov@cloudlinux.com> 1.6.1-1

changelog:
  - Added using unicode user names as filter in function cpinfo of vendor cpapi plugin.
  - LU-1463: ValueError: invalid literal for int() with base 10: '--help'
  - PTCLLIB-171: Fix backward plugin's methods `_cpinfo` and `list_users`
  - WEB-1593: Use the same names for options in config file as it return cl_config
  - WEB-1594: Use new config file to store php selector status in plesk


author: Stepan Oksanichenko <soksanichenko@cloudlinux.com> 1.6.3-1
changelog:
  - Bump version for master branch 1.6.2-1
  - LU-1463: ValueError: invalid literal for int() with base 10: '--help'. Part II


author: Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.6.4-1
changelog:
  - CAG-965: Change pre delete with post delete admin
  - PTCLLIB-154: disable sentry only for downgrade


author:
  Anton Volkov <avolkov@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.6.5-1

changelog:
  - PTCLLIB-174: Add detailed logging about what happens in hooks
  - PTCLLIB-174: Use logrotate instead of RotatingFileHandler
  - PTCLLIB-174: Fix post_modify_domain hook for case when user and domain changed together
  - PTCLLIB-173: Return json response for universal hooks on cpanel
  - PTCLLIB-177 Install cpanel hooks even if hooks.yaml is missing
  - PTCLLIB-176 Investigate and fix failed hook tests on DA
  - LU-1487: replace alt-python27-MySQL-python with alt-python27-MySQL-meta in all spec files


author: Ulugbek <usamigjonov@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com> 1.6.6-1
changelog:
  - WEB-1658: Admin can not use "User interface settings"
  - PTCLLIB-175: Build alt-python27-cllib package for CL8


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Pavel Mogilnikov <pmogilnikov@cloudlinux.com> 1.6.8-1

changelog:
  - LU-1422: DA cpapi.userdomains with admins
  - CAG-1001: Don't copy etc during postwwwacct while restoring account
  - PTCLLIB-179 : (Stage 2) Safe fixes of futurize
  - PTCLLIB-179 : Stage 1 all imports
  - PTCLLIB-179 : Stage 1 of futurize
  - PTCLLIB-179 : Fix unittests behaviour
  - PTCLLIB-179 : fix reload_processes function
  - PTCLLIB-179 : Replace assert(Not)Eqals with assert(Not)Equal
  - Sonar Qube: disable rules related to unused imports and imports ordering


author:
  Aleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, pmogilnikov <pmogilnikov@cloudlinux.com> 2.0.8-3

changelog:
  - CAG-1027: Fix pickle incompatibility between python2 and python3
  - LU-1630 : usage of os.makedirs on py3
  - LU-1646 Fix cl-wizard on cl7h
  - LU-1641: investigate issues with CL8 installation into empty chroot (ISO install)
  - PTCLLIB-195: Fix NoneType Traceback with whmapi call on CPanel 86.0
  - PTCLLIB-183: rewrite pretrans using lua
  - PTCLLIB-193: fix issues with upgrade and downgrade of alt-python-cllib package
  - CAG-1014: Investigate failed test 958-list-mounted-users on DA
  - PTCLLIB-182: Fix hooks installation on cpanel 84+
  - LVEMAN-1636 fix sendmail subprocess error
  - LU-1583 enable pylint py3k for cllib
  - LU-1607 : (python-cllib) add interpolation=None
  - LU-1589: Fix wizard errors on CL8
  - PTCLLIB-191 : Fix unittests
  - LU-1501: Add manual pyc pyo build for cllib
  - LVES-968 make possible to get raw subprocess from run_command
  - PTCLLIB-186: Make db_info optional, as mentioned in docs
  - PTCLLIB-185: Fix admins sync when admin does not have system user
  - PTCLLIB-183: rewrite pretrans using lua
  - PTCLLIB-184 : Fix directadmin cpapi tests
  - add text=True to clcaptain
  - LU-1492: use text=True for subprocess while installing cpanel hooks
  - LU-1492: Write errors in case of bad cpanel configs
  - LU-1492: Make hooks installation work on plesk
  - minor fixes to cllib to work on py3
  - LU-1492: Remove byteify usage from cpapi plugins
  - PTCLLIB-179: use text=True in all subprocess calls
  - LU-1566 add -bb option to cllib
  - PTCLLIB-179: remove multiple imports on single lines
  - PTCLLIB-179 : fix cpapi plugins plesk users encoding
  - PTCLLIB-179 : fix vendors_api
  - PTCLLIB-179 : (Fixes) Stage 2 of futurize
  - PTCLLIB-179 : (Nobuild) Stage 2 of futurize
  - LU-1500: update spec and shebangs for python3
  - PTCLLIB-179 : (Stage 2) Safe fixes of futurize
  - PTCLLIB-179 : Fix unittests behaviour
  - PTCLLIB-179: Use bytes when parsing php_conf config
  - PTCLLIB-179 : fix reload_processes function
  - PTCLLIB-179 : Replace deprecated NoneType
  - PTCLLIB-179 : Replace __builtin__ imports with builtins
  - PTCLLIB-179 : Replace deprecated assertItemsEqual with assertCountEqual
  - PTCLLIB-179 : Replace assert(Not)Eqals with assert(Not)Equal
  - Sonar Qube: disable rules related to unused imports and imports ordering
  - LU-1500: Version up
  - PTCLLIB-175: Build alt-python27-cllib package for CL8
  - LU-1500: Add commented pylint --py3k
  - LU-1500: create master-py3 branch


author:
  dkuropiatnyk <dkuropiatnyk@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, soksanichenko <soksanichenko@cloudlinux.com> 2.1.13-1

changelog:
  - LVES-1009: Add CM plugin for lve-stats2
  - LU-1881: Add a few metrics to CL statistics
  - CMT-221: Add package versions tags to sentry


author:
  Pavel Negrobov <pnegrobov@cloudlinux.com>, soksanichenko <soksanichenko@cloudlinux.com>, dkuropiatnyk <dkuropiatnyk@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 2.2.0-1

changelog:
  - CMT-165: [End-server tools] Adapt CM apache collector to DA
  - CMT-257: Add to cldiag the base checks for CMT. Part II
  - CMT-257: Add to cldiag the base checks for CMT
  - PTCLLIB-217: docroot() is broken on directadmin
  - CMT-417 UnicodeDecodeError: `utf-8` codec can`t decode byte 0xe4 in position 3167: invalid continuation byte


author:
  Pavel Mogilnikov <pmogilnikov@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 2.2.2-1

changelog:
  - CMT-257: Add to cldiag the base checks for CMT. Hot-fix for non-CL+ clients
  - LVEMAN-1695 : Change sentry init function


author:
  Alisher Matkurbanov <amatkurbanov@cloudlinux.com>, Danylo Kuropiatnyk <dkuropiatnyk@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 2.2.7-1

changelog:
  - CMT-494: Reduce amount of sentry errors
  - LU-2020: Add get_weekday function and WEEK_DAYS tuple
  - PTCLLIB-218 : Fix userdomains for DirectAdmin and openlitespeed
  - LU-2016: Do not perform checking patches for "suexec" with LiteSpeed server
  - CMT-257: Add to cldiag the base checks for CMT


author: Danylo Kuropiatnyk <dkuropiatnyk@cloudlinux.com>, Dmitriy Poleev <dpoleev@cloudlinux.com> 2.2.9-1
changelog:
  - WEB-2040: Add config parameters for cl-config: Hide X-Ray for user
  - PTCLLIB-220: CLDIAG doesn't correctly check the services in non-English locales
  - CMT-386: Adapt CM end-server-tools apache collector for Plesk


author:
  Danylo Kuropiatnyk <dkuropiatnyk@cloudlinux.com>, Alisher Matkurbanov <amatkurbanov@cloudlinux.com> 2.2.10-1

changelog:
  - CMT-528: Error while getting Mysql Governor limits: Governor not present in system (CL+CM_Collector)
  - LU-2081: Fix unclosed resource warning


author:
  Alisher Matkurbanov <amatkurbanov@cloudlinux.com>, msozin <msozin@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> 2.1.8-1

changelog:
  - LU-1883: Fix load_fast failure for non-utf8 chars in config
  - LVEMAN-1683: Escape formatting characters (%) inside exception message.
  - CAG-1062: [CL8.2] Mount socket of systemd-journal into CageFS
  - LU-1865: Add activate/deactivate mechanism for Endserver-tools


author: Owen Taylor <otaylor@redhat.com> - 2.20.0-4.el6
changelog:
  - Build without gobject-introspection support, the form of support
    in 2.20 was subsequently removed upstream.
    Resolves: rhbz 555583


author: Adam Jackson <ajax@redhat.com> 2.15.2-4
changelog:
  - Drop the explicit Requires: numpy as per new packaging guidelines.  If
    your app calls gtk.gdk.get_pixels_array() you need to pull numpy in
    yourself.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3.10.13-1
changelog:
  - ALTPYTH-486: Updated to 3.10.12
  - ALTPYTH-478: fixed pam authentication through ssl
  - ALTPYTH-481: Updated to 3.10.13


author: Davit Sargsyan <dsargsyan@cloudlinux.com> - 3.14.3-1
changelog:
  - ALTPYTH-587: Update to Python 3.14.3
  - CVE-2025-15367: fix poplib command injection
  - CVE-2025-15366: Reject control characters in IMAP commands


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 3.3.6-2.1
changelog:
  - rename macros.pybytecompile to macros.alt-python33-pybytecompile
  - group is changed to linksafe
  - add linksafe configuration to /etc/sysctl.conf in pre section


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 3.3.6-2.9
changelog:
  - add locked extensions
  - add condition for build without linksafe
  - conflict with lvemanager < 1.0-9.43


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 3.3.6-2.11
changelog:
  - fix for CVE-2016-1000110 HTTProxy attack
  - fix for CVE-2016-0772 python: smtplib StartTLS stripping attack
    rise an error when STARTTLS fails (upstream patch)
  - fix for CVE-2016-5699 python: http protocol steam injection attack
    disabled HTTP header injections in http.client (upstream patch)


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 3.4.4-1
changelog:
  - update Python to 3.4.4
  - disable patch 202, 204
  - add build conditional macros
  - add path-to-libpl.patch (fix wrong path to LIBPL)


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-5
changelog:
  - testModuleData is failing on arm platform even for python 2.7
  - exclude this test for build of arm


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-6
changelog:
  - additionally testEntrypoint testIn testIntegerFunctions failing on s390/ppc64
  - exclude those tests for build of s390/ppc64


author: Eduard Abdullin <eabudllin@cloudlinux.com> - 3.7.11-4
changelog:
  - ALTPYTH-364: Fix build for old system
  - ALTPYTH-381: Added check for cl solo
  - ALTPYTH-380: Added cloudlinux-linksafe to Requires(post)


author: Julian Sikorski <belegdol@fedoraproject.org> - 11.1.0-1
changelog:
  - Updated to 11.1.0
  - Obsoleted zsh subpackage (upstream ticket #3078)
  - mktap is gone (upstream ticket #5293)
  - Dropped obsolete Group, Buildroot, %clean and %defattr


author: Sergey Fokin <sfokin@cloudlinux.com> 3.8.12-2
changelog:
  - ALTPYTH-413: move -fno-semantic-interposition to CFLAGS_NODIST
  - remove changing gcc to devtoolset-gcc
  - change BuildRequire from gcc-toolset to system gcc for CL8


author: Remi Collet <remi@remirepo.net> - 6.0.9-3
changelog:
  - move configuration in /etc/redis per upstream recommendation
    see https://github.com/redis/redis/issues/8051


author: Remi Collet <remi@remirepo.net> - 6.2.0-1
changelog:
  - Redis 6.2.0 GA - Released Tue Feb 22 14:00:00 IST 2021
  - Upgrade urgency: SECURITY if you use 32bit build of redis,
    MODERATE if you used earlier versions of Redis 6.2, LOW otherwise


author: Remi Collet <remi@remirepo.net> - 6.2.2-1
changelog:
  - Redis 6.2.2 - Released Mon April 19 19:00:00 IST 2021
  - Upgrade urgency: HIGH, if you're using ACL and pub/sub,
    CONFIG REWRITE, or suffering from performance regression.


author: Igor Zubkov <izubkov@cloudlinux.com> 1.9.3-3
changelog:
  - 1.9.3-p550 security and bugfix release
    (https://www.ruby-lang.org/en/news/2014/10/27/ruby-1-9-3-p550-is-released/)
  - CVE-2014-8080: Denial of Service XML Expansion
    (https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/)
  - Changed default settings of ext/openssl related to CVE-2014-3566 AKA POODLE
    (https://www.ruby-lang.org/en/news/2014/10/27/changing-default-settings-of-ext-openssl/)


author: Anatholy Scryabin <ascryabin@cloudlinux.com> 1.9.3-4
changelog:
  - update patchlevel to 551 (fix CVE-2014-8090)
  - initialize rubygems cache in posttrans section (fix ALR-6)
  - bump package rubygems epoch (bugfix version)
  - add BuildRoot for cl5
  - disable doc's BuildArch for cl5
  - disable ca-certification Requires and BR for cl5


author: Anatholy Scryabin <ascryabin@cloudlinux.com> 2.0.0-7
changelog:
  - update patchlevel to 647
  - group is changed to linksafe
  - add linksafe configuration to /etc/sysctl.conf in pre section


author: Anatholy Scryabin <ascryabin@cloudlinux.com> 2.0.0-17
changelog:
  - add locked_extensions
  - add trigers to subpackages of rubygem
  - add condition for build with linksafe
  - conflicts with lvemanager < 1.0-9.43


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3.0.4-161
changelog:
  - ALR-153: Updated to 3.0.4
  - Patch 23 (Fix-stack-buffer-overflow) disabled because fixed in upstream.
  - Broken symlink in ruby-libs deleted.


author: Jan Stanek <jstanek@redhat.com> - 3.7.16.2-1
changelog:
  - update to 3.7.16.2 (http://www.sqlite.org/releaselog/3_7_16_2.html)
  - add support for aarch64 (rerunning autoconf) (#926568)


author: Benjamin Gilbert <bgilbert@backtick.net> - 8.5.6-1
changelog:
  - New release
  - Rename Python packages per policy
  - Update project URLs
  - Rename pygobject3-base dependency to python-gobject-base
  - Switch python3-gobject dependency to python3-gobject-base
  - Add missing arch-specific Python provide
  - Drop Group tags


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.11.8-1
changelog:
  - CLOS-2692: Updated to 10.11.8
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.4.30-4
changelog:
  - CLOS-1955: Adjusted conflicts and obsoletes tags to mysqlclient18-compat
  - CLOS-1955: Added conflicts tags to another version of cl-MariaDB* packages


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.4.34-1
changelog:
  - CLOS-2692: Updated to 10.4.34
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.5.25-1
changelog:
  - CLOS-2692: Updated to 10.5.25
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.6.15-1

changelog:
  - CLOS-1923: Updated to 10.6.15
  - CLOS-1744: Added MySQL Provides tag in cl-MariaDB-meta-client package


author: Timur Averianov <taverianov@cloudlinux.com> - 8.0.43-1
changelog:
  - CLOS-3491: Update cl-MySQL80 to 8.0.43
  - CLOS-3538: Stop patching "mysql.server.sh", the upstream version will be used further on


author: Miroslav Rajcic <miroslav.rajcic@oracle.com> - 8.0.33-1
changelog:
  - Added component_test_server_telemetry_traces, component_test_mysql_thd_store_service test components


author: Gipson Pulla <gipson.pulla@oracle.com> - 8.3.0-1
changelog:
  - Removed the tool pathfix.py wich is deprecated in Python-3.12
  - Some C API removed, so increase the libmysqlclient major version to 23.


author: Miroslav Rajcic <miroslav.rajcic@oracle.com> - 8.4.0-1
changelog:
  - mysql_stmt_bind_param C API removed, so increase the libmysqlclient major version to 24.
  - Removed mysqlpump, mysql_upgrade, zlib_decompress and lz4_decompress binaries


author: Timur Averianov <taverianov@cloudlinux.com> - 8.4.6-1
changelog:
  - CLOS-3529: Update cl-MySQL 8.4 to 8.4.6
  - CLOS-3538: Stop patching "mysql.server.sh", the upstream version will be used further on


author: Tomislav Plavcic <tomislav.plavcic@percona.com>
changelog:
  - Fixed yum update fails and complains about duplicate pid (#1454917)
  - Percona Server fails to install on centos 7 if mariadb-devel package installed (#1499721)


author: Robert Scheck <robert@fedoraproject.org> - 0.98.3-1
changelog:
  - Upgrade to 0.98.3 and updated daily.cvd (#1095614)
  - Avoid automatic path detection breakage regarding curl
  - Added build requirement to openssl-devel for hasing code
  - Added clamsubmit to main package


author: Robert Scheck <robert@fedoraproject.org> - 0.98.4-1
changelog:
  - Upgrade to 0.98.4 and updated daily.cvd (#1111811)
  - Add build requirement to libxml2 for DMG, OpenIOC and XAR


author: Robert Scheck <robert@fedoraproject.org> - 0.99-2
changelog:
  - Require openssl-devel for clamav-devel
  - Change clamav-milter unit for upstream changes (#1287795)


author: Robert Scheck <robert@fedoraproject.org> - 0.99-4
changelog:
  - Link using %{?__global_ldflags} for hardened builds (#1321173)
  - Build using -std=gnu++98 (#1307378, thanks to Yaakov Selkowitz)


author: Robert Scheck <robert@fedoraproject.org> - 0.99.1-1
changelog:
  - Upgrade to 0.99.1 and updated main.cvd and daily.cvd (#1314115)
  - Complain about antivirus_use_jit rather clamd_use_jit (#1295473)


author: Orion Poplawski <orion@cora.nwra.com> - 0.99.2-1
changelog:
  - Update to 0.99.2
  - Drop cliopts patch fixed upstream, use upstream's "--forground" option name
  - Fix main.cvd (fedora #1325482, epel #1325717)
  - Own bytecode.cld (#1176252) and mirrors.dat, ship bytecode.cvd
  - Update daily.cvd
  - Fixup Requires(pre) usage (#1319151)


author: Igor Savenko <bliss@cloudlinux.com> 0.1-13
changelog:
  - CLEN-51: cloudlinux-file-change-collector crashes when database is locked.
    Rivals are terminated now if permitted in config


author: Igor Savenko <bliss@cloudlinux.com> 0.2-3
changelog:
  - CLEN-67: cloudlinux-file-change-collector could not flush events list when encounters exception on line parsing


author: Igor Savenko <bliss@cloudlinux.com> 0.2-5
changelog:
  - Bugfix: Make cloudlinux-file-change-collector PID file non-world writeable
  - Bugfix: fixed log write sentence


author: Antonio Trande <sagitter@fedoraproject.org> - 3.14.6-1
changelog:
  - Update to cmake-3.14.6 (rhbz#1746146, rhbz#1746104)
  - Do not use system jsoncpp
  - Split off appdata file as external source file


author: Neal Gompa <ngompa13@gmail.com> - 3.17.3-3
changelog:
  - Backport support for out-of-source builds controlled by __cmake3_in_source_build macro
  - Backport cmake3_build and cmake3_install macros
  - Backport ctest3 macro


author: Serhii Kokhan <skokhan@cloudlinux.com> - 3.13-7
changelog:
  - CLOS-1655: Release bump to align CL7 criu-lve with mod_lsapi dependency
    tightening (libcriu.so SONAME guard)


author: Serhii Kokhan <skokhan@cloudlinux.com> - 3.13-10
changelog:
  - MAXWS-1086: Rename C library/headers/pkgconfig to the criu-lve namespace to coexist with criu-libs


author: Sergey Kokhan <skokhan@cloudlinux.com> - 3.9-1
changelog:
  - MODLS-528: Fixed error on restore "Too big FD number to restore"
  - MODLS-516: Open out of jail vma files before entering jail
  - Updated to CRIU version 3.9


author: Sergey Kokhan <skokhan@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 3.9-2
changelog:
  - MODLS-564: Remove errors that were logged by criu in apache error_log
  - MODLS-575: Fixed bug when restored lsphp masters spawn children with PIDs lower than last_pid


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-13
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-14
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 2.1.0-15.tuxcare.els1
changelog:
  - CVE-2022-23990: lib: prevent integer overflow in function doProlog
  - CVE-2022-43680: fix overeager DTD destruction in
    XML_ExternalEntityParserCreate


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.1.0-15.tuxcare.els2
changelog:
  - CVE-2024-45490: Reject negative length for XML_ParseBuffer in xmlparse.c
  - CVE-2024-45491: Detect integer overflow in dtdCopy on 32-bit platforms
  - CVE-2024-45492: Detect integer overflow in nextScaffoldPart on 32-bit platforms


author: Jindrich Novy <jnovy@redhat.com> - 0.4.1-3
changelog:
  - temporarily remove s390x arch from supported arches due to
    missing renameat2 syscall
  - Related: #1721151


author: Jindrich Novy <jnovy@redhat.com> - 0.7.2-5
changelog:
  - upstream patch when applied to the 0.7.2 source code is applied to the wrong function,
    new patch fixes it
  - Resolves: #1805013


author: Jindrich Novy <jnovy@redhat.com> - 0.7.2-6
changelog:
  - fix "Pushing container image built with rootless podman fails with: "file integrity checksum failed""
  - Resolves: #1810498


author: Dave Dykstra <dwd@fedoraproject.org> - 3.4.2-4
changelog:
  - Bump release number in order to larger than a rebuild of fuse package
    done before separation pull request was merged.


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-96
changelog:
  - CLOS-2058: Fixed performance issue related to governor package limits synchronization
  - CLOS-2077: Fixed KeyError exception for dbgovernor set_path_environ function


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-99
changelog:
  - CLOS-2049: Governor dropin removed
  - CLOS-2170: Add additional safeguards for detecting MySQL AUTO version with DirectAdmin
  - CLOS-2173: Added mysqlclient21 installation for clMariaDB
  - CLOS-2117: mysql-version-list option added
  - MariaDB 10.11 support temporarily removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-102
changelog:
  - CLOS-2215: bad_users_list ownership fixed
  - CLOS-1759: dbgovernor_map mysql charset changed to utf8mb
  - CLOS-1730: Timeouts added to avoid repetive log messages


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-105
changelog:
  - CLOS-2322: Fixed DB limits not applying to users after a MySQL Governor service restart
  - CLOS-2418: MySQL 8.0 community edition repo url changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-106
changelog:
  - CLOS-2373: Backup confirmation added to governor script

  - CLOS-2322: Fixed DB limits not applying to users after a MySQL Governor service restart
  - CLOS-2418: MySQL 8.0 community edition repo url changed


author: Dmitry Shibut <dshibut@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-107
changelog:
  - CLOS-2319: EOLed cl-MariaDB 10.3 removal result to server down
  - CLOS-2471: Fixed wizzard installation


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-109
changelog:
  - CLOS-2572: LVE busy in MySQL processes issue fixed
  - CLOS-2506: Fixed MySQL community downloads URL


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-110
changelog:
  - CLOS-2322: Fixed issue with not applying limits after Governor service restart
  - CLOS-2535: Governor threads logging added


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism
  - CLOS-2594, CLOS-2641: Implemented logging from MySQL and uniform logging


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-114

changelog:
  - CLOS-2719: Re-enabled watchdog monitoring utility with adjusted logic and interval
  - CLOS-2711: Added extended logging rotation
  - CLOS-2780: Fixed governor restarts
  - CLOS-2596: Do not install missing MariaDB-compat package in case of CL9
  - CLOS-2735: Changed semaphore retry logic to timed wait


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-115
changelog:
  - CLOS-2947: Fix watchdog cron job to stop it from emitting emails
  - CLOS-2885: Prevent sentry_demon from logging zero counters to logs
  - CLOS-2817: Fix Sentry reporting
  - CLOS-2581: Add mysql backup script


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-114

changelog:
  - CLOS-2719: Re-enabled watchdog monitoring utility with adjusted logic and interval
  - CLOS-2711: Added extended logging rotation
  - CLOS-2780: Fixed governor restarts
  - CLOS-2596: Do not install missing MariaDB-compat package in case of CL9
  - CLOS-2735: Reduced probability of Governor limits being not applied (changed semaphore retry logic to timed wait in bad_list protection)


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-115

changelog:
  - CLOS-2947: Fix watchdog cron job to stop it from emitting emails
  - CLOS-2885: Prevent sentry_demon from logging zero counters to logs
  - CLOS-2817: Fix Sentry reporting
  - CLOS-2581: Add mysql backup script


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-116
changelog:
  - CLOS-2840: Reduce probability of Governor limits being not applied; prevented Governor hang-up after MySQL/MariaDB or Governor service abrupt termination (replaced semaphore-protected bad_list with lockless one)
  - CLOS-2942: Fix resource usage estimation, reduces probability of Governor limits applied incorrectly
  - CLOS-2873: Fix "/etc/container/dbuser-map" application
  - CLOS-2899: Fix "dbctl --lve-mode=" in case of initial LVE mode "off"


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-117
changelog:
  - Revert changes from 1.2-116 to create a temporary fallback point for 1.2-118
  - Backport fix for unclean handling of SIGTERM in sentry_daemon.py (CLOS-2954)


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-119
changelog:
  - CLOS-2954: Remove prompt when handling SIGTERM in sentry_daemon.py, it was sometimes leading to "BrokenPipe" error
  - CLOS-2968, CLOS-2794: Improve error reporting


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-122
changelog:
  - CLOS-2999: Fix MySQL version logging
  - CLOS-3051: Improve MySQL connections management to avoid crashes
  - CLOS-3051: Improve error reporting
  - CLOS-3015: Add MariaDB 11.4 support


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-124
changelog:
  - CLOS-3196: Fix service dependencies - stopping/starting subordinate 'governor_sentry_daemon.service' by cPanel upgrade scripts was bringing 'db_governor.service' down


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-125
changelog:
  - CLOS-2663, CLOS-3257: Improve error reporting
  - CLOS-3257: Fix crash during statistics collection for LVE-Stats


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-127
changelog:
  - CLOS-3342: Fix outdated limitations in the scenario of several new DB users showed up in sequence fast, and then no new users seen for long
  - CLOS-3361: Fix MariaDB installation on machines with unknown "mysql" DNF module
  - CLOS-3354: Improve error reporting


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-131
changelog:
  - CLOS-2945: Improve error reporting
  - CLOS-3340: Fix restriction causes reported to LVE-stats
  - CLOS-3340: Fix "dbctl restrict <user>" in period-based mode - it was decreasing restriction level
  - CLOS-3340: Fix "dbctl --lve-mode=..." - max. connection count limitation was not removed after restriction reset
  - CLOS-3340: Speed up "dbctl restrict <user>" and "dbctl unrestrict <user>" on machines with many users
  - CLOS-3340: Reduce resource consumption in period-based mode combined with max. connection count limitation
  - CLOS-3340: Reduce resource consumption by duplicate "dbctl unrestrict <user>"
  - CLOS-3340: Fix "penalty period" configuration in period-based mode - setting it to zero didn't turn it off, but still produced a 1 sec penalty period
  - CLOS-3340: Fix "dbgovernor-restrict.log" - remove redundant and misleading items
  - CLOS-3340: Fix "dbctl restrict <user>" - it could restrict administrative DB account
  - CLOS-3418: Fix outdated limitations


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 1.2-132
changelog:
  - CLOS-3217: Fix "dbtop" and "dbctl" - reports could be inconsistent under high load
  - CLOS-3217: Speed up "dbtop" and "dbctl"


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 1.2-133
changelog:
  - CLOS-3027: Strengthen string copy operations
  - CLOS-3027: Support long DB user names, up to 80 characters
  - CLOS-3027: Change shared memory structure to consume less memory


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-134
changelog:
  - CLOS-3514: Reduce overhead in the scenario when a new DB user shows up in the middle of already high load
  - CLOS-3317: Fix invalid Linux user names reported to LVE-stats in cases of advanced authentication, like LDAP


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.2-136
changelog:
  - CLOS-3521: Fix mysql installation on Ubuntu
  - CLOS-3570: Do not install mysqlclient18 & mysqlclient21 on CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Mikalai Voina <mvoina@cloudlinux.com> 1.2-142

changelog:
  - CLOS-4122: Security hardening and improved memory safety
  - CLOS-4097: Optimized per-user MariaDB connection limits handling


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Mikalai Voina <mvoina@cloudlinux.com> 1.2-142

changelog:
  - CLOS-4122: Optimized memory management and safety
  - CLOS-4097: Optimized per-user MariaDB connection limits handling


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Nika Keshelava <nkeshelava@cloudlinux.com> 1.2-143

changelog:
  - CLOS-3496: Fixed MySQL Governor speed limit does not align with user package when upgraded/downgraded/reset


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-144
changelog:
  - CLOS-4042: Fix MySQL/MariaDB installation on CL10 when libaio (or numactl) is published with the x86_64_v2 baseline arch tag


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-145
changelog:
  - CLOS-4339: Maintenance update.
  - CLOS-4414: Fix DB usage graphs not displaying in cPanel user interface.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-41
changelog:
  - mod_cache: merge r->err_headers_out into r->headers when the response
    is cached for the first time (#1264989)
  - mod_ssl: Do not send SSL warning when SNI hostname is not found as per
    RFC 6066 (#1298148)
  - mod_proxy_fcgi: Ignore body data from backend for 304 responses (#1263038)
  - fix apache user creation when apache group already exists (#1299889)
  - fix apache user creation when USERGROUPS_ENAB is set to 'no' (#1288757)
  - mod_proxy: fix slow response time for reponses with error status code
    when using ProxyErrorOverride (#1283653)
  - mod_ldap: Respect LDAPConnectionPoolTTL for authn connections (#1300149)
  - mod_ssl: use "localhost" in the dummy SSL cert for long FQDNs (#1240495)
  - rotatelogs: improve support for localtime (#1244545)
  - ab: fix read failure when targeting SSL server (#1255331)
  - mod_log_debug: fix LogMessage example in documentation (#1279465)
  - mod_authz_dbd, mod_authn_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
    of DB lookup entries independently of the selected DB engine (#1287844)
  - mod_ssl: fix hardware crypto support with custom DH parms (#1291865)
  - mod_proxy_fcgi: fix SCRIPT_FILENAME when a balancer is used (#1302797)


author: Joe Orton <jorton@redhat.com> - 2.4.6-45.3
changelog:
  - prefork: fix delay completing graceful restart (#1327624)
  - mod_ldap: fix authz regression, failing to rebind (#1415257)


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
  - Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.4
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
  - Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
    corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
  - Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 2.4.6-99.1.cloudlinux.1
changelog:
  - CVE-2023-38709: Faulty input validation in the core of Apache allows
    malicious or exploitable backend/content generators to split HTTP responses
  - CVE-2024-24795: HTTP Response splitting in multiple modules allows an
    attacker that can inject malicious response headers into backend applications
    to cause an HTTP desynchronization attack


author: Kamil Dudka <kdudka@redhat.com> 7.46.0-1
changelog:
  - disable silent builds (suggested by Paul Howarth)
  - use default port numbers when running the upstream test-suite
  - install zsh completion script
  - new upstream release


author: Joe Orton <jorton@redhat.com> - 2.4.25-5
changelog:
  - mod_proxy_fcgi: revert to pre-2.4.23 SCRIPT_FILENAME mangling (#1414037)
  - mod_proxy: fix regression in per-dir ProxyPass (#1417482)


author: Joe Orton <jorton@redhat.com> - 2.4.25-9
changelog:
  - link only httpd, not support/* against -lselinux -lsystemd (#1433474)
  - don't enable SO_REUSEPORT in default configuration (#1432249)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.27-7
changelog:
  - Related: #1487164 - apache user is not created during httpd
    installation when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.34-5
changelog:
  - Resolves: #1640722 - mod_md is missing in httpd24-httpd
  - Resolves: #1635838 - CVE-2018-11763 httpd24-httpd: httpd:
    DoS for HTTP/2 connections by continuous SETTINGS


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.34-7
changelog:
  - Resolves: #1646937 - Unable to start httpd
  - Resolves: #1638711 - comments should be allowed at the end of Allow from
    statements


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-7.1
changelog:
  - Resolves: #1695428 - CVE-2019-0211 httpd24-httpd: httpd: privilege escalation
    from modules scripts


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


author: Joe Orton <jorton@redhat.com> - 2.9.2-7
changelog:
  - Requires(pre): httpd-filesystem to ensure apache user exists
  - enable mlogc everywhere, use buildcond to disable


author: Denis Kirjanov <dkirjanov@cloudlnux.com> - 1.5-74
changelog:
  - CLKRN-1061: introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty()
  - CLKRN-1061: CVE-2022-32250: CVE-2022-1966: netfilter: nf_tables: disallow non-stateful expression in sets earlier
  - CLKRN-1061: perf: Fix sys_perf_event_open() race against self
  - CLKRN-1061: RDMA/cma: Do not change route.addr.src_addr.ss_family
  - CLKRN-1061: xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
  - CLKRN-1061: Bluetooth: use correct lock to prevent UAF of hdev object
  - CLKRN-1061: Bluetooth: fix use-after-free error in lock_sock_nested()
  - CLKRN-1061: media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
  - CLKRN-1061: CVE-2021-3564: Bluetooth: fix the erroneous flush_work() order
  - CLKRN-1061: CVE-2020-0465: HID: core: Sanitize event code and type when mapping input
  - CLKRN-1061: [media] firewire: don't break long lines
  - CLKRN-1061: [media] firewire: firedtv-avc: potential buffer overflow
  - CLKRN-1061: perf/core: Fix a memory leak in perf_event_parse_addr_filter()
  - CLKRN-1061: net_sched: cls_route: remove the right filter from hashtable
  - CLKRN-1061: bluetooth: eliminate the potential race condition when removing the HCI controller
  - CLKRN-1061: CVE-2021-29650: netfilter: x_tables: Use correct memory barriers.
  - CLKRN-1061: CVE-2020-8648: vt: selection, close sel_buffer race
  - CLKRN-1061: CVE-2021-29154:  bpf, x86: Validate computation of branch displacements for x86-64
  - CLKRN-1061: CVE-2020-14331: Fix for missing check in vgacon scrollback handling
  - CLKRN-1061: net-sysfs: Call dev_hold always in rx_queue_add_kobject
  - CLKRN-1061: net-sysfs: Call dev_hold always in netdev_queue_add_kobject
  - CLKRN-1061: net-sysfs: call dev_hold if kobject_init_and_add success
  - CLKRN-1061: Bluetooth: A2MP: Fix not initializing all members
  - CLKRN-1061: Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
  - CLKRN-1061: [usb] USB: core: Fix races in character device registration and deregistraion
  - CLKRN-1061: [usb] usb: cdc-acm: make sure a refcount is taken early enough
  - CLKRN-1061: [usb] USB: adutux: fix use-after-free on disconnect
  - CLKRN-1061: [fs] ext4: fix support for inode sizes > 1024 bytes
  - CLKRN-1061: [fs] ext4: forbid i_extra_isize not divisible by 4
  - CLKRN-1061: [fs] ext4: validate the debug_want_extra_isize mount option at parse time
  - CLKRN-1061: CVE-2019-19062: [crypto] crypto: user - fix memory leak in crypto_report
  - CLKRN-1061: [media] media: v4l: event: Prevent freeing event subscriptions while accessed
  - CLKRN-1061: [wireless] rtlwifi: prevent memory leak in rtl_usb_probe
  - CLKRN-1061: [wireless] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable
  - CLKRN-1061: CVE-2019-19524: [input] Input: ff-memless - kill timer in destroy()
  - CLKRN-1061: CVE-2017-18551: [i2c] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
  - CLKRN-1061: [fs] ext4: work around deleting a file with i_nlink == 0 safely
  - CLKRN-1061: [netdrv] can: peak_usb: fix slab info leak
  - CLKRN-1061: [fs] fs/proc/proc_sysctl.c: Fix a NULL pointer dereference
  - CLKRN-1061: [media] media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap
  - CLKRN-1061: [scsi] scsi: libsas: delete sas port if expander discover failed
  - CLKRN-1061: CVE-2019-15917: [bluetooth] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
  - CLKRN-1061: [netdrv] fjes: Handle workqueue allocation failure
  - CLKRN-1061: [scsi] scsi: qla2xxx: fix a potential NULL pointer dereference
  - CLKRN-1061: CVE-2019-17053: [net] ieee802154: enforce CAP_NET_RAW for raw sockets
  - CLKRN-1061: CVE-2019-16994: [net] sit: fix memory leak in sit_init_net()
  - CLKRN-1061: CVE-2019-17055: [isdn] mISDN: enforce CAP_NET_RAW for raw sockets
  - CLKRN-1061: CVE-2019-18808: [crypto] crypto: ccp - Release all allocated memory if sha type is invalid
  - CLKRN-1061: [fs] nfs: Correct an nfs page array calculation error
  - CLKRN-1061: [security] selinux: properly handle multiple messages in selinux_netlink_send()
  - CLKRN-1061: [scsi] scsi: sg: add sg_remove_request in sg_write
  - CLKRN-1061: CVE-2020-12826: [fs] signal: Extend exec_id to 64bits
  - CLKRN-1061: CVE-2020-10732: [fs] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
  - CLKRN-1061: CVE-2020-10942: [vhost] vhost: Check docket sk_family instead of call getname
  - CLKRN-1061: [input] Input: add safety guards to input_set_keycode()
  - CLKRN-1061: [x86] kvm: x86: clear stale x86_emulate_ctxt->intercept value
  - CLKRN-1061: [x86] kvm: vmx: check descriptor table exits on instruction emulation
  - CLKRN-1061: [x86] kvm: nvmx: Check IO instruction VM-exit conditions
  - CLKRN-1061: [x86] kvm: nvmx: Refactor IO bitmap checks into helper function
  - CLKRN-1061: [x86] kvm: nvmx: Don't emulate instructions in guest mode
  - CLRKN-1061: [net] ipv6: constify ip6_dst_lookup_{flow|tail}() sock arguments
  - CLKRN-1061: CVE-2020-8649: CVE-2020-8647 [video] vgacon: Fix a UAF in vgacon_invert_region
  - CLKRN-1061: [wireless] mwifiex: Fix mem leak in mwifiex_tm_cmd
  - CLKRN-1061: [block] floppy: check FDC index for errors before assigning it
  - CLKRN-1061: mac80211: drop robust management frames from unknown TA
  - CLKRN-1061: mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
  - CLKRN-1061: mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
  - CLKRN-1061: HID: hiddev: avoid opening a disconnected device
  - CLKRN-1061: CVE-2020-10757: mm: Fix mremap not considering huge pmd devmap
  - CLKRN-1061: vfio-pci: Invalidate mmaps and block MMIO access on disabled memory
  - CLKRN-1061: [scsi] scsi: qedi: remove memset/memcpy to nfunc and use func instead
  - CLKRN-1061: blktrace: Protect q->blk_trace with RCU
  - CLKRN-1061: netlabel: cope with NULL catmap
  - CLKRN-1061: CVE-2019-16746: [net] nl80211: validate beacon head
  - CLKRN-1061: [net] mac80211: Do not send Layer 2 Update frame before authorization
  - CLKRN-1061: cfg80211: Use const more consistently in for_each_element macros
  - CLKRN-1061: ieee80211: fix for_each_element_extid()
  - CLKRN-1061: cfg80211: add and use strongly typed element iteration macros
  - CLKRN-1061: CVE-2019-3901: [kernel] perf/core: Fix perf_event_open() vs. execve() race
  - CLKRN-1061: binfmt_elf: switch to new creds when switching to new mm
  - CLKRN-1061: CVE-2019-10638: [net] inet: switch IP ID generator to siphash
  - CLKRN-1061: CVE-2019-10638: [lib] siphash: add cryptographically secure PRF
  - CLKRN-1061: CVE-2019-10638: [fs] dcache: allow word-at-a-time name hashing with big-endian CPUs
  - CLKRN-1061: CVE-2019-15221: [sound] ALSA: line6: Fix memory leak at line6_init_pcm() error path
  - CLKRN-1061: CVE-2019-15221: [sound] ALSA: line6: Fix write on zero-sized buffer
  - CLKRN-1061: CVE-2019-14283: [block] floppy: fix out-of-bounds read in copy_buffer
  - CLKRN-1061: CVE-2019-10207: [bluetooth] Bluetooth: hci_uart: check for missing tty operations


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-76
changelog:
  - CLKRN-1076: substituted ipset allocating memory to kvzalloc
  - CLKRN-1083: CVE-2022-2588: net_sched: cls_route: remove from list when handle is 0


author: Denis Kirjanov <dkirjanov@cloudlnux.com>> - 1.5-77
changelog:
  - CLKRN-1061: fget: check that the fd still exists after getting a ref to it
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: KVM: x86/speculation: Disable Fill buffer clear within guests
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/srbds: Update SRBDS mitigation selection
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: cpu/speculation: Add prototype for cpu_show_srbds()
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Enable CPU Fill buffer         clearing on idle
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug


author: Denis Kirjanov <dkirjanov@cloudlnux.com>> - 1.5-79
changelog:
  - KRNTSTNG-292: Fix oom_kill counter in CL7
  - CLKRN-1013: Move CL7 XFS to Centos 7/OpenVZ current implementation


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-80
changelog:
  - CLKRN-1077: disable kmem accounting due to memory leak
  - CVE: mm/rmap: Fix anon_vma->degree ambiguity leading to  double-reuse
  - CVE: mm: rmap: explicitly reset vma->anon_vma in unlink_anon_vmas()
  - CVE: CVE-2022-4378: proc: proc_skip_spaces() shouldn't think it is working on C strings
  - CVE: CVE-2022-4378: proc: avoid integer type confusion in get_proc_long
  - CVE: CVE-2022-2964: net: usb: ax88179_178a: Fix packet receiving
  - CVE: CVE-2022-2964: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
  - CVE: CVE-2022-2964: net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32
  - CVE: CVE-2022-2964: ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
  - CVE: CVE-2022-2964: net: usb: ax88179_178a: fix packet alignment padding


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-81
changelog:
  - KMODLVE-589: avoid crashes in os_set_dac_override()
  - CLKRN-1093: allow freezable sleep in kmodlve


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-82
changelog:
  - CVE: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
  - CVE: usb: mon: make mmapped memory read only
  - CLKRN-1176: added patch to fix ttypushback vulnerability
  - KMODLVE-596: fix cgroup stat parsing


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-83
changelog:
  - CLKRN-1406: revert some changes related to prod_net_disable2 - made the behaviour obliged
  - CLKRN-1399: improved fs.enforce_symlinksifowner option to close the SecureLink creating vulnerability


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-84
changelog:
  - CLKRN-1532: (CVE-2024-1086) netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - CLKRN-1203: switch back to using rh_reserved for tag links
  - CLKRN-1411: use monotonic clock for iolimits


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-86
changelog:
  - CLKRN-1723: Implement namespace check in __ptrace_may_access
  - [ELSCVE-33860] Squashfs: sanity check symbolic link size by Phillip Lougher
  - [ELSCVE-33999] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb by Pavel Skripkin
  - [ELSCVE-34184] ALSA: pcm: Fix races among concurrent prealloc proc writes by Takashi Iwai
  - [ELSCVE-34184] ALSA: pcm: Add debug print on memory allocation failure by Amadeusz Sławiński
  - [ELSCVE-34184] ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls by Takashi Iwai
  - [ELSCVE-34184] ALSA: pcm: Fix races among concurrent read/write and buffer changes by Takashi Iwai
  - [ELSCVE-34184] ALSA: pcm: Fix races among concurrent hw_params and hw_free calls by Takashi Iwai
  - [ELSCVE-34009] af_key: Do not call xfrm_probe_algs in parallel by Herbert Xu
  - [ELSCVE-34009] af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register by Haimin Zhang
  - [ELSCVE-34035] tcp: Fix data races around icsk->icsk_af_ops. by Kuniyuki Iwashima
  - [ELSCVE-34076] igmp: Add ip_mc_list lock in ip_check_mc_rcu by Liu Jian
  - [ELSCVE-34078] x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit by Wander Lairson Costa
  - [ELSCVE-34078] x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK by Wander Lairson Costa
  - [ELSCVE-34078] x86/elf: Add table to document READ_IMPLIES_EXEC by Wander Lairson Costa
  - [ELSCVE-34080] ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE by Jann Horn
  - [ELSCVE-34092] wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() by Johannes Berg
  - [ELSCVE-34097] wifi: cfg80211: fix BSS refcounting bugs by Johannes Berg
  - [ELSCVE-34097] cfg80211: hold bss_lock while updating nontrans_list by Rameshkumar Sundaram
  - [ELSCVE-34097] cfg80211: save multi-bssid properties by Sara Sharon
  - [ELSCVE-34097] cfg80211: use for_each_element() for multi-bssid parsing by Johannes Berg
  - [ELSCVE-34097] cfg80211: Scan results to also report the per chain signal strength by Sunil Dutt
  - [ELSCVE-34097] cfg80211: Move Multiple BSS info to struct cfg80211_bss to be visible by Sara Sharon
  - [ELSCVE-34097] cfg80211: Properly track transmitting and non-transmitting BSS by Sara Sharon
  - [ELSCVE-34097] cfg80211: Parsing of Multiple BSSID information in scanning by Peng Xu
  - [ELSCVE-34147] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() by Takashi Iwai
  - [ELSCVE-34216] openvswitch: fix OOB access in reserve_sfa_size() by Paolo Valerio
  - [ELSCVE-34216] openvswitch: fix the incorrect flow action alloc size by zhangliping
  - [ELSCVE-34231] net/packet: fix slab-out-of-bounds access in packet_recvmsg() by Eric Dumazet
  - [ELSCVE-34231] packet: in recvmsg msg_name return at least sizeof sockaddr_ll by Willem de Bruijn
  - [ELSCVE-34266] can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path by Hangyu Hua
  - [ELSCVE-34275] net/sched: cls_u32: fix netns refcount changes in u32_change() by Eric Dumazet
  - [ELSCVE-34275] net: sched: cls_u32: get rid of unused argument of u32_destroy_key() by Al Viro
  - [ELSCVE-34277] netfilter: nf_queue: do not allow packet truncation below transport header offset by Florian Westphal
  - [ELSCVE-33443] net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free by valis
  - [ELSCVE-33442] net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free by valis
  - [ELSCVE-33441] net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free by valis
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free by M A Ramdhan
  - [ELSCVE-33436] net/sched: cls_u32: Fix reference counter leak leading to overflow by Lee Jones
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval by Florian Westphal
  - netfilter: nf_tables: skip deactivated anonymous sets during lookups by Florian Westphal
  - [ELSCVE-25393] netfilter: nf_tables: do not allow SET_ID to refer to another table by Florian Westphal
  - netfilter: nf_tables: deactivate anonymous set from preparation phase by Florian Westphal
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg by Davide Caratti
  - RDMA/i40iw: Prevent zero-length STAG registration by Kamal Heib
  - [ELSCVE-34145] vt: vt_ioctl: fix race in VT_RESIZEX by Eric Dumazet
  - [ELSCVE-34145] VT_RESIZEX: get rid of field-by-field copyin by Al Viro
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() by David Marlin
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() by David Marlin
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve by Davide Caratti
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve by Davide Caratti
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). by Guillaume Nault
  - igb: set max size RX buffer when store bad packet is enabled by Radoslaw Tyl
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() by valis
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm by Luiz Augusto von Dentz
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM by Luiz Augusto von Dentz
  - [ELSCVE-30788] wifi: mac80211: Avoid address calculations via out of bounds array indexing by Kenton Groombridge
  - [ELSCVE-29571] fuse: fix pipe buffer lifetime for direct_io by Miklos Szeredi
  - [ELSCVE-28406] net: fix __dst_negative_advice() race by Eric Dumazet


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-88
changelog:
  - CLKRN-1963: CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers and posix_cpu_timer_del


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-89
changelog:
  - CVE-2026-43499: rtmutex: use waiter::task instead of current in remove_waiter() (backport 3bfdc63936dd)


author: Fridolin Pokorny <fpokorny@redhat.com> - 458-3
changelog:
  - Expanded lessecho usage (#948597)
  - Added lessfilter info to man (#948597)
  - Expanded lesskey usage (#948597)
  - Added --old-bot to help (#948597)


author: Jozef Mlich <jmlich@redhat.com> - 458-5
changelog:
  - fixing regression in 72dfd3f63594e1d4c9416180a95c47ae583934c6
    incorrect parsing of commandline arguments
  - Resolves #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-8
changelog:
  - changes introduced in less-458-old-bot-in-help.patch
    wasn't compiled in. It is necessary to use mkhelp tool.
    Resolves: #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-9
changelog:
  - The --use-backslash option documented in the man page
    was missing from online help for less.
    Resolves: #1109090


author: Remi Collet <remi@remirepo.net> - 1.0.16-1
changelog:
  - update to 1.0.16
  - soname bump to 23 (libsodium13 compat package exists)
  - manage update from libsodium23 (3rd party repository)
  - Add static library subpackage
  - fix license management


author: Matej Muzila <mmuzila@redhat.com> - 1:5.5.40-1
changelog:
  - Rebase to 5.5.40
    Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464
    CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
    CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564
    Resolves: #1160549


author: Matej Muzila <mmuzila@redhat.com> - 1:5.5.41-1
changelog:
  - Rebase to 5.5.41
    Also fixes: CVE-2014-6568 CVE-2015-0374 CVE-2015-0381 CVE-2015-0382
    CVE-2015-0391 CVE-2015-0411 CVE-2015-0432
    Resolves: #1186110


author: Jakub Dorňák <jdornak@redhat.com> - 1:5.5.44-3
changelog:
  - MDEV-8827 Duplicate key with auto increment
    fix innodb auto-increment handling three bugs:
      1. innobase_next_autoinc treated the case of current<offset incorrectly
      2. ha_innobase::get_auto_increment didn't recalculate current when increment changed
      3. ha_innobase::get_auto_increment didn't pass offset down to innobase_next_autoinc
    Resolves: #1300621


author: Jakub Dorňák <jdornak@redhat.com> - 1:5.5.47-1
changelog:
  - Rebase to 5.5.47
    Also fixes: CVE-2015-4792 CVE-2015-4802 CVE-2015-4815 CVE-2015-4816
    CVE-2015-4819 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836 CVE-2015-4858
    CVE-2015-4861 CVE-2015-4870 CVE-2015-4879 CVE-2015-4913 CVE-2015-7744
    CVE-2016-0505 CVE-2016-0546 CVE-2016-0596 CVE-2016-0597 CVE-2016-0598
    CVE-2016-0600 CVE-2016-0606 CVE-2016-0608 CVE-2016-0609 CVE-2016-0616
    CVE-2016-2047
    Resolves: #1304515


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.8
changelog:
  - Update Intel CPU microcode to microcode-20210216 release (#1905111):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a08 up
      to 0x2006a0a;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003003
      up to 0x4003006;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003003 up to 0x5003006.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.9
changelog:
  - Update Intel CPU microcode to microcode-20210525 release, addresses
    CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513
    (#1962659, #1962709, #1962729, #1962675):
    - Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
    - Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
    - Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
    - Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
      at revision 0xb00000f;
    - Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
      at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
    - Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
    - Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
    - Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
    - Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
    - Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
    - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
      intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up
      to 0xb00003e;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up
      to 0x2006b06;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up
      to 0xea;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xde up to 0xea;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up
      to 0xea;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x44 up to 0x46;
    - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up
      to 0x19;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159
      up to 0x100015b;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006
      up to 0x4003102;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003006 up to 0x5003102;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e
      up to 0x7002302;
    - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
      0x7000019 up to 0x700001b;
    - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000017
      up to 0xf000019;
    - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
      0xe00000f up to 0xe000012;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x40 up
      to 0x44;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x1e up
      to 0x20;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x2e up
      to 0x34;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x34 up
      to 0x36;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x18 up
      to 0x1a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa0
      up to 0xa6;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x28 up
      to 0x2a;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xe0 up
      to 0xea;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xe0
      up to 0xea;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xe0
      up to 0xec;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe0
      up to 0xe8;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode from revision
      0xe0 up to 0xea.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.10
changelog:
  - Make intel-06-2d-07, intel-06-4e-03, intel-06-4f-01, intel-06-55-04,
    intel-06-5e-03, intel-06-8c-01, intel-06-8e-9e-0x-0xca,
    and intel-06-8e-9e-0x-dell caveats dependent on intel caveat.
  - Enable 06-8c-01 microcode update by default.
  - Enable 06-5e-03 microcode update by default (#1897684).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.12
changelog:
  - Update Intel CPU microcode to microcode-20220204 release, addresses
    CVE-2021-0127, CVE-2021-0145, CVE-2021-33120 (#2051547, #2049549, #2049566):
    - Removal of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
    - Removal of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
      at revision 0xb00000f;
    - Removal of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
      at revision 0xb00000f;
    - Removal of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xea up to 0xec;
    - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
      intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb00003e up
      to 0xb000040;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006b06 up
      to 0x2006c0a;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xea up to 0xec;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x88 up to 0x9a;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x46 up to 0x49;
    - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x19 up
      to 0x1a;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015b
      up to 0x100015c;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003102
      up to 0x400320a;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003102 up to 0x500320a;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002302
      up to 0x7002402;
    - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
      0x700001b up to 0x700001c;
    - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000019
      up to 0xf00001a;
    - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
      0xe000012 up to 0xe000014;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x44 up
      to 0x46;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x20 up
      to 0x24;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x34 up
      to 0x36;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0002a0
      up to 0xd000331;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x36 up
      to 0x38;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1a up
      to 0x1c;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa6
      up to 0xa8;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2a up
      to 0x2d;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x16 up
      to 0x22;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x2c up
      to 0x3c;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xea
      up to 0xec;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
      0xea up to 0xec;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
      revision 0xea up to 0xec;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xea up
      to 0xec;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xea up to 0xec;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x11 up
      to 0x15;
    - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x1d up
      to 0x2400001f;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
      revision 0xea up to 0xec;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xea up to 0xec;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xea
      up to 0xec;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
      0xea up to 0xec;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0xea up to 0xec;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xea up
      to 0xec;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xea
      up to 0xec;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xec
      up to 0xee;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe8
      up to 0xea;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xea up to 0xec;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x40 up
      to 0x50.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.14
changelog:
  - Update Intel CPU microcode to microcode-20220510 release, addresses
    CVE-2022-0005, CVE-2022-21131, CVE-2022-21136, CVE-2022-21151 (#2090246,
      - Addition of 06-97-02/0x03 (ADL-HX C0) microcode at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      at revision 0x1f;
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
      intel-ucode/06-97-05) at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      at revision 0x1f;
    - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode at
      revision 0x41c;
    - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) at revision 0x41c;
    - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) at revision 0x41c;
    - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode at revision 0x41c;
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
      intel-ucode/06-bf-02) at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
      at revision 0x1f;
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
      intel-ucode/06-bf-05) at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
      at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode at revision 0x1f;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xec up to 0xf0;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006c0a up
      to 0x2006d05;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xec up to 0xf0;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x9a up to 0xa4;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xec up to 0xf0;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xec up
      to 0xf0;
    - Update of 06-37-09/0x0f (VLV D0) microcode from revision 0x90c up
      to 0x90d;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015c
      up to 0x100015d;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400320a
      up to 0x4003302;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x500320a up to 0x5003302;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002402
      up to 0x7002501;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x46 up
      to 0x48;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x24 up
      to 0x28;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x36 up
      to 0x38;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000331
      up to 0xd000363;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1c up
      to 0x1e;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa8
      up to 0xb0;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2d up
      to 0x31;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x22 up
      to 0x26;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3c up
      to 0x3e;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x15 up
      to 0x16;
    - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x2400001f
      up to 0x24000023;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xec up
      to 0xf0;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xec
      up to 0xf0;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xee
      up to 0xf0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xea
      up to 0xf0;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xec up to 0xf0;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x50 up
      to 0x53.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.15
changelog:
  - Update Intel CPU microcode to microcode-20220510 release, addresses
    CVE-2022-21233 (#2119080):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006d05 up
      to 0x2006e05;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015d
      up to 0x100015e;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000363
      up to 0xd000375;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3a up
      to 0x3c;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1e up
      to 0x20;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb0
      up to 0xb2;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x26 up
      to 0x28;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3e up
      to 0x40;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode from revision
      0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x1f up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x1f up to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x1f up to 0x22;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode from revision 0x1f
      up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x1f up to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x1f up to 0x22;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x41c up to 0x421;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x41c up to 0x421;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x41c up to 0x421;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x41c
      up to 0x421;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x53 up
      to 0x54;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode from revision 0x1f up
      to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x1f up to 0x22;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x1f up to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode from revision 0x1f up
      to 0x22.


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Björn Esser <besser82@fedoraproject.org> - 1.9.0-5
changelog:
  - Add conditional for bootstrapping new architectures
  - Use %set_build_flags macro to export buildflags, if available


author: Fedora Release Engineering <releng@fedoraproject.org> - 16.02-13
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - https://fedoraproject.org/wiki/Changes/Remove_GCC_from_BuildRoot


author: Remi Collet <rcollet@redhat.com> - 5.4.16-27
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.4.16-29
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.4.16-33
changelog:
  - core: use after free vulnerability in unserialize()
    CVE-2014-8142 and CVE-2015-0231
  - core: fix use-after-free in unserialize CVE-2015-2787
  - core: fix NUL byte injection in file name argument of
    move_uploaded_file() CVE-2015-2348
  - date: use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - exif: free called on unitialized pointer CVE-2015-0232
  - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
  - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
  - fix memory corruption in fileinfo module on big endian
    machines #1082624
  - fix segfault in pdo_odbc on x86_64 #1159892
  - fix segfault in gmp allocator #1154760


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4025, CVE-2015-4026, #1213407
  - fileinfo: fix denial of service when processing a crafted
    file #1213442
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: fix type confusion through unserialize #1222538
  - apache2handler: fix pipelined request executed in deinitialized
    interpreter under httpd 2.4 CVE-2015-3330


author: alutsiuk <alutsiuk@cloudlinux.com>, rtulchii <rtulchii@cloudlinux.com> 2.0.2-40.cloudlinux
changelog:
  - RHNCTL-43 implement link_server logic
  - CLKRN-917: added installing dracut-squash on 7 hybrid for KMODLVE-467


author: alutsiuk <alutsiuk@cloudlinux.com> 2.0.2-41.cloudlinux
changelog:
  - RHNCTL-47 implement linking status for cl-link-to-cln utility
  - RHNCLT-46: Remove deprecated CLN api calls (hardware, packages, virtinfo)
  - RHNCTL-48 Add linkable property to output of cl-link-to-cln --linking-status


author: Georgy Lepsaya <glepsaya@cloudlinux.com> 2.0.2-54.cloudlinux
changelog:
  - CLOS-3961: Migrate CL7 to no-auth SWNG mirrors, obsolete yum-rhn-plugin
  - CLOS-4381: normal-to-hybrid: retry yum on transient failures and abort on persistent failure


author: rpm@fthiessen.de
changelog:
  - Updated to 0.2.0, notable changes:
    * New version scheme
    * Update ncurses so it will compile on GCC 5
    * Don't use GCC 5 inside the Docker container,
      because older kernels are still not ready
    * Support CPU hotplug
    * Fix improper access to socket structure during accept()
    * Docker image now includes the RUN label to make it easier to
      run sysdig on Atomic Linux
    * New events: semop, semctl, ppoll
    * Port numbers will be automatically converted to service names
      unless -N is specified


author: rpm@fthiessen.de
changelog:
  - Updated to 0.4.0, notable changes:
    * Support ia32 emulation on 64bit kernels
    * HTTP chisels now support UNIX sockets (e.g. Docker API)
    * New events: mount, umount
    * Support Docker containers when running in a different cgroup
      root layout
    * csysdig view actions: press F7 or F8 while inside a csysdig
      view to see what actions are supported


author: mpluskal@suse.com
changelog:
  - Update to 0.5.1
    * Fix connection to HTTPS Kubernetes API servers
    * Properly compile bundled OpenSSL
    * Fix sysdig-probe build on Linux 4.3
    * Minor bugfixes
  - Changes for 0.5.0:
    * Full Kubernetes support!
    * Add a convenient USE_BUNDLED_DEPS CMake option to
      enable/disable all bundled dependencies at once.
    * New build/runtime dependencies: libb64, libcurl, openssl.
  - Add GH_496_fix.patch
  - Update dependencies and not use anything bundled


author: mpluskal@suse.com
changelog:
  - Update to 0.6.0
    * Full support to Kubernetes, even when saving events to a trace
      file
    * semget system event
    * access system event
    * Automatically build sysdig-probe for boot2docker releases
    * Properly filter process table serialization in a trace file
      when a process filter is used
    * Some csysdig actions now ask the user for confirmation
    * various bugfixes
    * drop GH_496_fix.patch


author: aspiers@suse.com
changelog:
  - Fix whitespace issues in .spec and .changes files
  - Remove duplicate %{_datadir} directory from %files


author: aspiers@suse.com
changelog:
  - Fix .spec file bug which was causing Frankenstein kernel modules:
    https://github.com/draios/sysdig/issues/496#issuecomment-165929462


author: mpluskal@suse.com
changelog:
  - Update to 0.7.1
    * Fix sysdig-probe compilation for kernel < 3.4.0
    * Fix compilation on OSX
  - Changes for 0.7.0
    * Fix sysdig-probe for kernel 4.4
    * Fix a remotely possible deadlock during ioctl calls
    * Fix Kubernetes support when data returned from the API server
      is particularly big
    * Minor bugfixes
    * Spectrogram views in csysdig: spectro_all (System call latency
      spectrogram) and spectro_file (File I/O latency spectrogram)
    * Ability to authenticate to a Kubernetes API server using a
      certificate, via -K <file_name> or --k8s-api-cert=<file_name>.
      Can also be specified via the environment variable
      SYSDIG_K8S_API_CERT
    * Ability to sort columns in csysdig views using the keyboard
    * --filter-proclist: apply the filter to the process table
    * -M: add the possibility to stop collecting after X seconds
      evt.latency.quantized: 10-base log of the delta between an
      exit event and the correspondent enter event evt.latency.human:
      delta between an exit event and the correspondent enter event,
      as a human readable string (e.g. 10.3ms)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-15
changelog:
  - login: fix label on /run/nologin (#1264073)
  - udev-rules: prandom character device node permissions (#1264112)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-16
changelog:
  - login: fix gcc warning, include missing header file (#1264073)
  - shutdown: make sure /run/nologin has correct label (#1264073)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-17
changelog:
  - sd-event: fix prepare priority queue comparison function (#1266479)
  - units: run ldconfig also when cache is unpopulated (#1265539)
  - selinux: fix regression of systemctl subcommands when absolute unit file paths are specified (#1185120)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19
changelog:
  - udev: make naming for virtio devices opt-in (#1269216)
  - tmpfiles.d: don't clean SAP sockets either (#1186044)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.2
changelog:
  - device: rework how we enter tentative state (#1283579)
  - core: Do not bind a mount unit to a device, if it was from mountinfo (#1283579)
  - logind: set RemoveIPC=no by default (#1284588)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.3
changelog:
  - sysv-generator: follow symlinks in /etc/rc.d/init.d (#1288005)
  - man: RemoveIPC is set to no on rhel (#1284588)


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.146-16
changelog:
  - VDO start command now does index memory checking
  - Module target is now "vdo" instead of "dedupe"
  - VDO remove with no device no longer puts a spurious file in /dev
  - ANsible module no longer fails on modification operations
  - Resolves: rhbz#1510567
  - Resolves: rhbz#1530358
  - Resolves: rhbz#1535597
  - Resolves: rhbz#1536214


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.24-1
changelog:
  - Rebased to 6.1.1 branch from github
  - Resolves: rhbz#1576701
  - Removed obsolete nagios module.
  - Modified spec files to use systemd macros
  - Resolves: rhbz#1531111
  - Updated the vdo.8 man page
  - Resolves: rhbz#1547786
  - Improved some error messages


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.84-1
changelog:
  - Improved and corrected man pages.
  - Improved error handling in vdo script when stopping volumes in use.
  - Resolves: rhbz#1511106
  - Modified the vdo script to return more specific error exit codes.
  - Resolves: rhbz#1543954
  - Improved detection of existing formats when creating new volumes.
  - Resolves: rhbz#1557464
  - Improved VDO Ansible testing playbooks.
  - Fixed compilation errors on newer versions of GCC.
  - Removed the --physical-size option to vdoformat since VDO now always uses
    the entire device on which it resides.
  - Modified vdo script to use /dev/disk/by-id to describe the location of
    VDO volumes when possible.
  - Fixed a bug where VDO would always be created with a dense index even
    when a sparse index was requested.
  - Resolves: rhbz#1570156
  - Modified the vdo script to accept decimal points or commas when
    specifying the --indexMem option.
  - Resolves: rhbz#1552146
  - Changed vdo script to not accept --vdoSlabSize=0 as a way of specifying
    the default since it was confusing. The default can be obtained by merely
    omitting the parameter entirely.
  - Resolves: rhbz#1564181
  - Modified the vdo script to require the --force option to remove a VDO
    whose underlying device is not present.
  - Resolves: rhbz#1535476


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.99-2
changelog:
  - Modified the vdo script to not allow creation of a VDO device on top of
    an already running VDO device.
  - Resolves: rhbz#1572640
  - Made the ordering of the output of vdo list stable.
  - Resolves: rhbz#1589363
  - Added the proper dist tag
  - Resolves: rhbz#1588043


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.111-3
changelog:
  - Added support for issuing fullness warnings via dmeventd
  - rhbz#1519307
  - Provided missing error code to text translation for vdoDumpConfig.
  - Resolves: rhbz#1595129
  - Improved error reporting when using pvcreate in the vdo script to check
    for pre-existing devices when creating a VDO volume.
  - Resolves: rhbz#1557464


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.120-3
changelog:
  - Improved error messages in the vdo script when failing to stop a device.
  - Resolves: rhbz#1511106
  - Improved man pages.
  - Resolves: rhbz#1572640
  - Modified vdo script to ignore (but preserve) unrecognised parameters in
    the vdo config file so that config files are compatible across versions.
  - Resolves: rhbz#1604060
  - Updated Ansible module to change block map cache size on existing volumes
  - Resolves: rhbz#1541170


author: Nicolas Chauvet <kwizart@gmail.com> - 1.42-2
changelog:
  - Fix for UsrMove - rfbz#2360
  - Fix Conflict with ipset - rfbz#2201
  - Add Requires ipset >= 6.11 - rfbz#2226


