# changelog

author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.0.2-1
changelog:
  - Rename and rebase to apache-commons-daemon
  - Get rid of gcj, native conditional compilation
  - Build with maven
  - Update patches to cleanly apply on new version, remove unneeded
  - Clean up whole spec


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.0.5-1
changelog:
  - Update to latest version
  - Use maven 3 to build
  - Versionless jars & javadocs
  - Use apache-commons-parent for BR


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.0.8-1
changelog:
  - Update to latest upstream (1.0.8)
  - Drop s390/ppc patches (upstream seems to already include them)


author: Dennis Gilmore <dennis@ausil.us> - 1.0.10-2
changelog:
  - $supported_os and $JAVA_OS in configure do not always match 
  - on arches that override supported_os to be the arch we can not find headers


author: Java SIG <java-devel@lists.fedoraproject.org> - 1.0.12-2
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Joe Orton <jorton@redhat.com> - 2.2.15-3
changelog:
  - default config tweaks:
   * harden httpd.conf w.r.t. .htaccess restriction (#591293)
   * load mod_substitute, mod_version by default
   * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf
   * add commented list of shipped-but-unloaded modules
   * bump up worker defaults a little
   * drop KeepAliveTimeout to 5 secs per upstream
  - fix LSB compliance in init script (#522074)
  - bundle NOTICE in -tools
  - use init script in logrotate postrotate to pick up PIDFILE
  - drop some old Obsoletes/Conflicts


author: Joe Orton <jorton@redhat.com> - 2.2.17-7
changelog:
  - generate dummy mod_ssl cert with CA:FALSE constraint (#667841)
  - add man page stubs for httpd.event, httpd.worker
  - drop distcache support
  - add STOP_TIMEOUT support to init script


author: Joe Orton <jorton@redhat.com> - 2.2.21-6
changelog:
  - complete conversion to systemd, drop init script (#770311)
  - fix comments in /etc/sysconfig/httpd (#771024)
  - enable PrivateTmp in service file (#781440)
  - set LANG=C in /etc/sysconfig/httpd


author: Joe Orton <jorton@redhat.com> - 2.4.1-1
changelog:
  - update to 2.4.1
  - adopt upstream default httpd.conf (almost verbatim)
  - split all LoadModules to conf.modules.d/*.conf
  - include conf.d/*.conf at end of httpd.conf
  - trim %changelog


author: Joe Orton <jorton@redhat.com> - 2.4.1-2
changelog:
  - clean docroot better
  - ship proxy, ssl directories within /var/cache/httpd
  - default config:
   * unrestricted access to (only) /var/www
   * remove (commented) Mutex, MaxRanges, ScriptSock
   * split autoindex config to conf.d/autoindex.conf
  - ship additional example configs in docdir


author: Joe Orton <jorton@redhat.com> - 2.4.1-3
changelog:
  - add mod_proxy_html subpackage (w/mod_proxy_html + mod_xml2enc)
  - move mod_ldap, mod_authnz_ldap to mod_ldap subpackage


author: Joe Orton <jorton@redhat.com> - 2.4.2-4
changelog:
  - pull from upstream:
    * use TLS close_notify alert for dummy_connection (r1326980+)
    * cleanup symbol exports (r1327036+)


author: Joe Orton <jorton@redhat.com> - 2.4.2-15
changelog:
  - move tmpfiles.d fragment into /usr/lib per new guidelines
  - package /run/httpd not /var/run/httpd
  - set runtimedir to /run/httpd likewise


author: Joe Orton <jorton@redhat.com> - 2.4.2-18
changelog:
  - avoid use of "core" GIF for a "core" directory (#168776)
  - drop use of "syslog.target" in systemd unit file


author: Joe Orton <jorton@redhat.com> - 2.4.3-7
changelog:
  - use systemd scriptlets if available (#850149)
  - don't run posttrans restart if /etc/sysconfig/httpd-disable-posttrans exists


author: Joe Orton <jorton@redhat.com> - 2.4.3-13
changelog:
  - filter mod_*.so auto-provides (thanks to rcollet)
  - pull in syslog logging fix from upstream (r1344712)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-5
changelog:
  - execute systemctl reload as result of apachectl graceful
  - mod_ssl: ignore SNI hints unless required by config
  - mod_cache: forward-port CacheMaxExpire "hard" option
  - mod_ssl: fall back on another module's proxy hook if mod_ssl proxy
    is not configured.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-6
changelog:
  - htpasswd/htdbm: fix hash generation bug (#956344)
  - do not dump vhosts twice in httpd -S output (#928761)
  - mod_cache: fix potential crash caused by uninitialized variable (#954109)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-12
changelog:
  - mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
  - apxs: mention -p option in manpage


author: Joe Orton <jorton@redhat.com> - 2.4.6-13
changelog:
  - mod_ssl: sanity-check use of "SSLCompression" (#1036666)
  - mod_proxy_http: fix brigade memory usage (#1040447)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-17
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1077907)
  - mod_log_config: add security fix for CVE-2014-0098 (#1077907)


author: Jim Perrin <jperrin@centos.org> - 2.4.6-17.el7.centos.1
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - update welcome.conf with proper aliases
  - change symlink for poweredby.png


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-17.el6.cpanel.1
changelog:
  - Added cPanel-specific patches
  - Removed apache user creation, configured to run as nobody
  - Repaired incorrect run directories


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-20.el6.cpanel.1
changelog:
  - Each module now has its own conf.modules.d file
  - conf.modules.d files are created programmatically
  - Simplified ssl, proxy_html, ldap, and session package file lists


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-21.el6.cpanel.1
changelog:
  - Split the MPMs into their own packages
  - mod_heartbeat needs to be loaded after mod_status and mod_watchdog


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.12-10
changelog:
  - Fixed mpm conflicts
  - Removed itk conflict since apache shouldn't be concerned with that..
    only itk should be
  - Removed unused cloudlinux cagefs patch


author: Julian Brown <julian.brown@cpanel.net> - 2.4.16-2
changelog:
  - Added requirements for ea-apache24-mod_proxy and mod_proxy_http
  - so we can support proxy subdomains


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.16-5
changelog:
  - Added /etc/apache2/bin directory for apache-specific utility scripts
  - Added additional macros to /etc/rpm/macros.apache2 so other rpms
    can make use of those paths


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.18-2
changelog:
  - Applied fix for Apache Bug #58854.  This patch should be removed
    once it has made into upstream.


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:2.4.18-2.1.cloudlinux
changelog:
  - httpd2-cagefs_jail.patch and httpd-2.4-suexec-safe.patch applied
  - Epoch bumped to 1
  - dist macro added to Release
  - Dependencies adjusted to use ea-* packages from CloudLinux OS


author: David Nielson <david.nielson@cpanel.net> 2.4.18-3
changelog:
  - Remove conflict on 'webserver' and add conflict on 'httpd-mmn' so
    Nginx can be installed from EPEL.


author: Edwin Buck <e.buck@cpanel.net> - 2.4.23-1
changelog:
  - EA-4872: Updated to verison 2.4.23
  - Added mod_proxy_hcheck (side effect of upstream 2.5 backport into 2.4.23)


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.23-2
changelog:
  - mod_lua can be installed, but is off by default (EA-4825)
  - fixed a few rpmlint warnings complaining about lack of attr macros


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.23-7
changelog:
  - Update apachectl with ulimit calls modifying the open file
    descriptor limit so that Apache will start up (EA-5662)


author: Dan Muey <dan@cpanel.net> - 2.4.23-9
changelog:
  - EA-5557: turn off icon directives by default since the icons are broken under symlink protect
  -          and are used by HTMLTable even when fancy indexinf is off


author: Jacob Perkins <jacob.perkins@cpanel.net> - 2.4.29-1
changelog:
  - Updated to version 2.4.29 via update_pkg.pl (ZC-2981)
  - Removed mod_unique_id patch as it was patched upstream.


author: Cory McIntire <cory@cpanel.net> - 2.4.29-2
changelog:
  - EA-6020: Restarting Apache while using splitlogs can result in "Broken pipe" errors
  - Applying patch provided by Gary Stanley (gary@cpanel.net)


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.29-5
changelog:
  - EA-7127: Ensure the mod_proxy_html and mod_xml2enc modules
    build against ea-libxml2. Additionally, updated the build
    process to avoid modifying the LDFLAGS - as it caused the
    libxml2 dependency to be carried to extensions compiled
    separately.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.29-7
changelog:
  - EA-7159: Use 'elinks' instead of 'links' as a dependency
    to ensure that EA4 does not pull any packages from
    the EPEL repos.


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 2.4.33-5.cloudlinux.3
changelog:
  - EA4D-66: Remove %triggerin for ea-apache24-mod_security2 package to avoid apache
    downtime during the update


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 2.4.33-5.cloudlinux.5
changelog:
  - Reverted "EA4D-26: Add patch for extending mod_remoteip to support Host/Port/Protocol mangling natively"


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.33-6
changelog:
  - EA-7468: Ensure dependency resolution picks /usr/bin/perl instead
    of /bin/perl. This helps downstream users of our RPMs as their
    build environments can be simplified.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-2
changelog:
  - EA-7715: Revert mod_ratelimit back to the 2.3.33 version.
    This is to ensure that it emits proper chunks, as there are several
    issues with the 2.3.34 version.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-3
changelog:
  - EA-7802: Restore mod_ratelimit back to the 2.3.34 version. Apply
  upstream fixes for it from trunk.


author: Cory McIntire <cory@cpanel.net> - 2.4.35-1
changelog:
  - EA-7871: Update to v2.4.35, drop v2.4.34
    Remove Patch500: 0017-Apply-mod_ratelimit-fix-from-trunk.patch as it
    was implemented upstream.


author: Cory McIntire <cory@cpanel.net> - 2.4.39-1
changelog:
  - EA-8307: Update to 2.4.39, drop 2.4.38
    CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts
    CVE-2019-0196: mod_http2, read-after-free on a string compare
    CVE-2019-0197: mod_http2, possible crash on late upgrade
    CVE-2019-0215: mod_ssl access control bypass
    CVE-2019-0217: mod_auth_digest access control bypass
    CVE-2019-0220: URL normalization inconsistincies


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.39-3
changelog:
  - CPANEL-27056: Fix bug in condition that allowed for non-user files
    to be served in certain situations when SymlinkProtection was
    enabled.


author: Daniel Muey <dan@cpanel.net> - 2.4.41-5
changelog:
  - ZC-4361: bump release prefix past 4 so these will be newest (4 was added and disappeared due to a faulty revert)


author: Cory McIntire <cory@cpanel.net> - 2.4.46-5
changelog:
  - EA-9463: Resolve Apache startup race conditions
             Enable mod_systemd for further startup enhancements


author: Travis Holloway <t.holloway@cpanel.net> - 2.4.49-2
changelog:
  - EA-10123: Patch apache 2.4.49: Correctly decrement active_daemons also in the case that the child process decides on its own to die because of MaxRequestsPerChild.


author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
  - EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
  	- CVE-2023-31122: mod_macro buffer over-read
  	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
  	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
  - EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
  	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
  	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
  	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
  - EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
  	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
  	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
  	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
  	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
  	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
  	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
  	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
  	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
  - EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
  	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Dan Muey <daniel.muey@webpros.com> - 2.4.64-3
changelog:
  - EA-13041: Rolling “ea-apache24” back to “35b37d6c7295199c5157c68145f220d9fa61ff02”: Apache v2.4.64 broke SNI (rando 421)


author: Cory McIntire <cory@cpanel.net> - 2.4.35-1
changelog:
  - EA-7871: Update to v2.4.35, drop v2.4.34
    Remove Patch500: 0016-Apply-mod_ratelimit-fix-from-trunk.patch as it
    was implemented upstream.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.66-1
changelog:
  - EA-13281: Update ea-apache24 from v2.4.65 to v2.4.66
  	- low: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  	- low: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)
  	- moderate: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVE-2025-59775)
  	- low: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  	- moderate: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Ability to provide which handlers to treat as suexec, and which to treat regularly <commit: 37ad6a8d6dafd9486217f60e369c530c17510ac6>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Fixed issue when mod_hostinglimits intercepts request already in lve (when php is done via cgi) <commit: abccd6a8276eefca2e50dcf03cfb0519fe3b6f26>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - add mode -m 644 to spec file and add php-script to modhostinglimits.conf <commit: 6bf688d72a68442b2886926fba8cb19ba6a10fc7>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Added directories/confgis to make sure mod_hostinglimits compiles under directadmin <commit: 242e320b83b167435f2b2dccb7c4d3ca045e3a42>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - fix spec file's string with liblve to lve-devel. liblve - for future releases <commit: fb10d65ba6364b6ce78e70e3decbf8200b8a0be2>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - moved p_cookie to be taken from request_config, making module MPM Worker safe <commit: fdab876e8fb52f0f3a21f9fa836cc411b9d4a392>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Merge branch 'master' of gitosis@pylesos.interdon.net:mod_hostinglimits <commit: f3b7c8df2280fa81b54c33dc53bf6d46f7cf4caa>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug when p_cookie is not installed process was fall down <commit: 44668ecf8599ee39ab8f21ae632d0e4514f67192>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Add private thread variable p-cookie instead mutex <commit: a3d7f50a59f2f94b463edfdf76f67c4a5235cfd8>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug with User and Group params. I can get it bu using server record <commit: 54be580ac5db55913a32a5cf8fb01981a671ef84>


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-1
changelog:
  - Add new CMakeList and *.cmake files for RPM building
    - [#Feature 189] AllowedHandlers and DenyHandlers directives regex support is added
    - [#Feature 191] DenyHandlers directive support is added
    - Allow to serve content on LVE re-entry(apache 1.3)


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-1
changelog:
  - Add new spec file 3 rpm in 1 spec file
    - Add fix in *.cmake file for building under H-Sphere 3.1


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-2
changelog:
  - Added support for new LVEErrorCode directive
    - Default LVEErrorCode is changed from 503 to 508, default error 508 page is added in module source
    - Bug fix: checking whether we are already in LVE (errno should be EPERM, not -EALREADY)
    - Bug fix: logging "already in LVE" error in module for Apache 1.3


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-8
changelog:
  - Restored leave hendler
  - Removed request pool data storing
  - Disable empty host debugging
  - Added new directive LVESitesDebug
  - Re-entry procedure restored
  - Optimized leave handler
  - Optimized work with child pools
  - Reset errno on module initializtion
  - Repaired lve available check
  - Added support mod_ruid2
  - Added new derctive LVEUser
  - Added support of apache-mpm-itk


author: Alexey Berezhok <alexey_com@ukr.net> 0.8-1
changelog:
  - Added LVERetryAfter: send RetryAfter header
  - Added LVEParseMode: there are three modes of working(CONF, PATH, OWNER)
  - Added LVEPathRegexp: regexp expression for username extracting from path(PATH mode)
  - Added LVEHeaderName: not supported yet
  - Added URL with error description in log


author: Alexey Berezhok <alexey_com@ukr.net> 1.0-5
changelog:
  - Added LVEUids debug
  - Fixed bug with mod_userdir + mod_hostinglimits
  - Renew lve api for apache 1.3


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-15
changelog:
  - suPHP_UserGroup processing
  - fixed cPanel's install script
  - extended debug_enabled mode fix
  - LVE entering removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-17
changelog:
  - Server config merging
  - Default value of lsapi_pgrp_max_idle is changed
  - Handler to Backend dir is moved into the library


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-39
changelog:
  - Added secret file installation
  - Fixed hook for patching cPanel templates
  - sulsphp signs
  - sulsphp parent check


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-42
changelog:
  - Using Apache or apr random function instead of /dev/random
  - Processing internal redirects
  - Spec fixes
  - Fixed installation scripts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-51
changelog:
  - Error 404 in the case of script absense
  - Script owner and permission checks
  - Full support for lsapi_phprc


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-53
changelog:
  - Added lsapi_target_perm config parameter
  - Fixed NULL server-var bug
  - Logging backend fatal error log
  - Fixed DA directory name


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-54
changelog:
  - Added lsapi_uid_gid config parameter
  - Added lsapi_use_default_uid config parameter
  - uid/gid params moved to dir config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-58
changelog:
  - Hook removed
  - Defaults for lsapi_backend_connect_timeout and lsapi_backend_connect_tries changed
  - lsapi_user_group added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-68
changelog:
  - Timeout for backend poll added
  - Backend poll redesign
  - PHP ENV modify_type fix
  - lsapi_hostname_on_debug parameter added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-69
changelog:
  - Delayed invoke mode added
  - read/write/poll backend refined
  - Log messages on error conditions added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-71
changelog:
  - TMPDIR, TEMP and TMP added into safe env var list
  - Dump headers always option is added into config
  - Debug data exchange config option added
  - Dealing with REDIRECT_STATUS added (MODLS-11 fix)
  - Fixed DA install script
  - Resending request if lsphp crash or reset connection added (MODLS-12 fix)
  - Send 503 code in the case of lsphp killing (MODLS-13 fix)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-77
changelog:
  - lsapi_mutex_mech option added
  - send_data simplified
  - cagefs mp fix
  - audit fixes
  - 401 redirect fix
  - 503 response when lsphp is killed
  - REDIRECT_STATUS fix
  - TMPDIR, TEMP and TMP added into safe env var list


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-84
changelog:
  - RPM spec fix
  - Added mod_lsapi rebuild into after_apache_make_install hook
  - 302 Moved Temporarily instead of 302 Found
  - Chrome 302 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-90
changelog:
  - lsapi_do_request redesign
  - lsphp response code used
  - PHP error pages displayed
  - Fatal error log processed correctly
  - Fix 500 Internal server error on 200 Ok page


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-91
changelog:
  - lsapi_backend_children changed to 80
  - Starter pid log output added
  - sulsphp_log location for DA changed
  - selfstarter mode always enabled
  - Log request_rec on send_request error
  - Some advices to error log added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-98
changelog:
  - Default value for lsapi_use_default_uid changed to On
  - nobody and apache added as exception to sulsphp


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-1
changelog:
  - Add disabling php_* directives processing
  - sulsphp moved into library
  - ACCEPT_NOTIFY mode implemented
  - Deprecated methods removed
  - Connection pool mode implemented
  - lsapi_backend_max_idle and lsapi_backend_max_reqs parameters added
  - Default lsapi_socket_path changed
  - Added build lsphp with custom php sources location
  - Added hook for autobuild lsphp on easyapach rebuild
  - Creation of subdirectories for socket dir added
  - Fix for custom path lsphp build
  - Old mod_lsapi src.rpm generated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-4
changelog:
  - use_suexec option implemented
  - lsapi_check_document_root option implemented
  - Fix mod_lsapi release number in rpm spec
  - Fix path of php source detection on cPanel
  - Fixed php.ini for correct php work on cPanel
  - Precise Requires: tags in rpm specs
  - Fix for compilation flags for sulsphp in CMakeLists


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-12
changelog:
  - lsapi_backend_accept_notify related bug fix
  - mod_lsapi archive for OBS mode added
  - EA4 package scripts added
  - X-Accel-Buffering: no header support added
  - gdb and lsof removed from mod_lsapi rpm deps
  - Default value for lsapi_accept_notify option changed to On


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-15
changelog:
  - MODLS61: Server-Sent Events support added
  - lsapi_paranoid option added
  - MODLS21: Auto value for lsapi_phprc option added
  - MODLS62: lsapi_max_connection option implemented


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-16
changelog:
  - Merging with_connection_pool CRIU branch
  - Fix for OBS
  - MODLS70: X-Powered-By related fix
  - secret file size fix
  - TMP and TEMP env vars added into default config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-17
changelog:
  - backend_accept_notify fix
  - MODLS73: Custom response code support
  - MODLS71: Simpla authorization fix
  - Fixed restore global mod_lsapi after easyapache rebuilding


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-20
changelog:
  - /dev/urandom used to generate secret file
  - Default value for lsapi_backend_children changed to 120
  - Default socket path changed to /var/run/mod_lsapi
  - Creating default socket path on start
  - Coverity issues small fixes
  - Fixes for EA4
  - Add to file /etc/container/php.handler handlers for EA4


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-21
changelog:
  - 'Requires:' tag changed to liblsapi only
  - Added force update after lsphp rebuild
  - MODLS98: /var/run/mod_lsapi directory creation fix
  - MODLS102: TMPDIR var in default config
  - Removed dependency on CageFS
  - MODLS100: cagefs mount point removed
  - MODLS90: lsapi_backend_use_own_log option added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-22
changelog:
  - MODLS-94: Error in case of setup mod_lsapi on CL5 without any panel
  - MODLS-107: REDIRECT_STATUS message supressed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-24
changelog:
  - MODLS-104 lsapi_resend_if_crashed option added
  - MODLS-108: domain name added into lsphp socket name
  - MODLS-109 Fix POST >100K fails when body length is omitted
  - adaptive_mmap() in lscapi_send_request()
  - MODLS-105 lscapi_send_request() refactoring
  - MODLS-106: Fixup for rare backup connection fails


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-26
changelog:
  - MODLS-125: Do not allow to process .php.disabled extensions
  - MODLS-126: switch_mod_lsapi on 7.2 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-27
changelog:
  - MODLS-130: Full info in sulsphp error messages
  - MODLS-132: Fix wrong processing of lsapi.conf by switch_mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-29
changelog:
  - Fixes for switch utility for EA4
  - MODLS-128: switch_lsapi script fix
  - MODLS-153: Add more log info in case of entering jail error
  - MODLS-151: Dependencies from older alt-php packages removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-32
changelog:
  - Fix in script for CL 7.2 version
  - MODLS-155: default value of mutex mechamism changed to posixmem
  - MODLS-156: LSAPIPath option support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-33
changelog:
  - MODLS-169: Don't flood /tmp with send_request() buf artifacts
  - MODLS-170: Config option for alternate tmp directory
  - lscapi_reset_internal_error_state definition moved to lscapi.h


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-9
changelog:
  - MODLS-231: Fix HTTPOXY vulnerability
  - MODLS-232: Removing of mod_ruid2 configs added to EA3 rebuilding hook
  - MODLS-230: connection pool mode switched to on by default
  - poll mask changed in lscapi_is_socket_closed


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.0-10
changelog:
  - MODLS-227: Errors during execute cloudlinux_ea3_to_ea4 with --mod_lsapi 
  - MODLS-226: Lsapi script should have verifying of cagefs install


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-11
changelog:
  - MODLS-234: Fix switch_mod_lsapi for PLESK systems
  - AAP-104: Improve communication between mod_lsapi worker and starter


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-12
changelog:
  - MODLS-240: event mask for poll in waiting output from lsphp changed
  - AAP-110: unnecessary restart of Apache during EA3 build removed
  - MODLS-238: LVE_NO_MAXENTER flag added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-15
changelog:
  - MODLS-252: replacement of native php avoided
  - Filtering of HTTP_AUTHORIZATION and HTTP_PROXY_AUTHORIZATION removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-16
changelog:
  - connection pool mode switched to off by default
  - MODLS-256: fixing of broken lsapi.conf on EA4 added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-17
changelog:
  - MODLS-248: logrotate config for sulsphp_log added
  - MODLS-257: Scriptlet automation --setup and --uninstall added for EA4
  - MODLS-259: Possibility to set PHPRC via SetEnv added
  - MODLS-260: Fix switch_mod_lsapi for CL5


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-18
changelog:
  - MODLS-254: Fix lsphp path in /etc/container/php.handler added
  - MODLS-262: lsapi_per_user option added
  - AAP-106: Fix to standard behavour of PHPRC on EA4 php added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-19
changelog:
  - MODLS-272: Possibility to pass env vars to safe env added
  - MODLS-271: correct /usr/local/bin/lsphp symlink on PLESK
  - MODLS-266: Config option management fixed
  - MODLS-268: rewriting of lsapi config file on EA4 fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-21
changelog:
  - MODLS-261: Dependency from alt-php56 removed from EA4 mod_lsapi rpm
  - MODLS-249: Fix for full logging of backend messages
  - MODLS-276: switch_mod_lsapi bug fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-22
changelog:
  - MODLS-281: Fix crashing Apache on DA servers
  - MODLS-274: user.ini support added to mod_lsapi-1.0
  - MODLS-277: Make sulsphp work with 500+ users in group
  - MODLS-279: mod_lsapi gets disabled after some time post enabling (fcgid mod, cpanel)
  - MODLS-273: Maximum path length for PHPRC increased


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-24
changelog:
  - Fix work in backend_accept_notify Off mode with multiple logs from backend
  - MODLS-275: check-php command ported to 1.0 branch


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-2

changelog:
  - MODLS-269: Make lsphp working with PHP versions selected with MultiPHP on EA4 when SuPHP enabled
  - MODLS-308: LSAPI protocol logging added
  - MODLS-333: Drop criu system service and use something similar internally. CRIU as a system service is not recommended for use
  - MODLS-332: Add some way to trigger images cleanup
  - MODLS-331: Change criu images perms to 0600, as existing 0644 might not be secure enough
  - MODLS-330: Hide all debug and extra messages. Activate them only with specific parameter
  - MODLS-229: Make lsphp wait for dump to end, so it can detect when it's restored from images and cleanup its dead children
  - Added librt for CloudLinux 6


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-3

changelog:
  - MODLS-344: Plesk 17.0.17 version does not read /usr/local/psa/admin/conf/templates/custom/domain/domainVirtualHost.php.
  - MODLS-311: CL7 only. First start of lsphp after reboot takes a lot of time(about 7 seconds longer than suphp). Try to make so-lib cache before first usage of lsphp
  - MODLS-339: Make global flag for signaling of removing all images for CRIU(it can bee needed when php will be updated)
  - MODLS-345: Add creation of dump on lsphp stopping
  - MODLS-359: Check if /etc/container/php.handler updates properly
  - MODLS-364: mod_lsapi with criu don't create criu imgs in directory which is set by lsapi_criu_imgs_dir_path option


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-4
changelog:
  - MODLS-347: Remove LSCAPI_CRIU_SYNC_FD from the output of lsphp (phpinfo). Because it is service info
  - MODLS-367: Detect when CRIU is stopped and lsapi_criu is On and write message to apache log: Start CRIU. Service is stopped.
  - MODLS-193: Support custom php.ini added
  - MODLS-370: Add to CRIU, creation images for different virtual host under one user
  - MODLS-366: Improper option scopes fixed
  - MODLS-376: Fix PHP Selector on Plesk + mod_lsapi
  - MODLS-339: Added description of lsapi_reset_criu_on_apache_restart flag to lsapi.conf file
  - MODLS-378: sulsphp_log permissions changed to default Apache ones


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-5
changelog:
  - MODLS-388: destroy_lve symbol lookup bug fixed
  - MODLS-389: starter lock mechanism changed to fcntl
  - MODLS-384: Conflict with ea-apache24 added to mod_lsapi spec
  - MODLS-379: /usr/selector and ea-php locations for lsphp added into csf rules
  - MODLS-374: Cache of spawn_info_t structure sent on every lsphp starting for domain" into mod_lsapi-1.0.criu


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-9
changelog:
  - MODLS-394: starter mutex switched to PTHREAD mech to avoid deadlocks on MPM Event
  - MODLS-340: Corrected CRIU functions
  - MODLS-405: DocRoot special value is added to lsapi_phprc option


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-10
changelog:
  - MODLS-368: Add mod_lsapi handler to EA4 PHP handlers
  - MODLS-399: Fetch litespeed sources over https for beta
  - MODLS-408: Add PHP71 handler
  - MODLS-391: Buffer temporary file completely before passing it to backend PHP process


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-11
changelog:
  - MODLS-401: Add dynamic tuning of lsapi_backend_children parameter
  - MODLS-410: Priority of php_value from httpd.conf lowered to PERDIR


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-12
changelog:
  - MODLS-419: Make script for switching lsapi from old mechanism(--enable-global, --enable-domain) to new mechanism(lsapi via web-interface of cPanel)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-13
changelog:
  - MODLS-423: php_value htaccess flag value changed
  - MODLS-422: Add ability to disable lsapi while it is enabled globally EA3
  - MODLS-424: uninstall does not work properly


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-14
changelog:
  - MODLS-430: Add lsphp handlers to users Plesk panel correctly
  - MODLS-431: lsapi_output_buffering option added
  - MODLS-414: env var for lsphp log prefix added
  - MODLS-417: Backend log changed to own file on EA4
  - MODLS-368: Removed suphp detection
  - Changed method of suphp detection


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-15
changelog:
  - MODLS-436: Add force option to switch_mod_lsapi --setup
  - MODLS-429: switch_mod_lsapi --build-native-lsphp is not executed randomly after upcp on EA3
  - MODLS-433: New mechanism lsapi and web-interface of cPanel. Proposed by cPanel team


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-16
changelog:
  - MODLS-403: Check for Cloudlinux added to liblsapi
  - MODLS-434: Handler value was dropped after update
  - MODLS-435: Conflict with mpm_itk added to EA4 mod_lsapi
  - MODLS-433: New mechanism lsapi and web-interface of cPanel
  - Added /opt/cloudlinux as safe path
  - Fix httpd24 CL7 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-17
changelog:
  - MODLS-443: Hotfix: add setup-light command for cleaning all garbage in htaccess wich bring by previous versions
  - MODLS-442: Configure uninstall/update mod_lsapi with Plesk panel
  - MODLS-440: looking for user.ini in home dir
  - MODLS-400: DA script changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-20
changelog:
  - MODLS-445: CRIU messaging changed
  - MODLS-456: Added handlers for php 7.2 for cPanel EA4 and Plesk


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-21
changelog:
  - MODLS-452: Fix destroying of starter mutex on worker and event MPMs
  - MODLS-457: PWD var added into safe environment as cwd of backend process
  - MODLS-464: Max size of response header package fixed
  - MODLS-463: Add application/x-httpd-ea-php72___lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp and application/x-httpd-ea-php72-lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp
  - MODLS-460: Add ability to set lsapi_backend_children manually


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-22
changelog:
  - MODLS-466: lsapi_backend_semtimedwait option switched on by default
  - MODLS-466: lsapi-cache service improved
  - MODLS-466: lsapi-cache service for CL6 implemented
  - MODLS-468: criu messaging changed
  - MODLS-476: Add corresponding to criu messages into sulsphp_log
  - MODLS-475: Cleanup criu images on dump error
  - AAP-189: ea-apache24-mod_suphp-0.7.2-21 package installation flush php handlers to suphp
  - MODLS-470: Reset all criu images on update criu-lve and alt-phpXY


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-23
changelog:
  - MODLS-479: Make correct output of the totBytesRead and bodyLen values
  - MODLS-478: Prefix lsapi errors with timestamps
  - MODLS-472: unlimit core file size when BACKEND_COREDUMP on


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-24
changelog:
  - MODLS-483: Fix premature mutex destroying on MPM Event
  - MODLS-482: Refactor CRIU patch for PHP
  - MODLS-472: unlimit core file size on CL6


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-25
changelog:
  - MODLS-494: implement ~/mod_lsapi_reset_me flag for removing all CRUI images for all domains of user
  - dependency from alt-libxml2 removed from ea-apache24-mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


changelog: - Initial MAx Cache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> 1.0.0-1


changelog: - Initial MaxCache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1


author: Michael Fleming <mfleming+rpm@enlartenment.com> 1.8.7-4
changelog:
  - Add Requires: httpd-mmn to get the appropriate "module magic" version
    (thanks Ville Skytta)
  - Disabled an overly-agressive rule or two..


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.0-1
changelog:
  - New major release - 2.1.0
  - Fix CVE-2007-1359 with a local rule courtesy of Ivan Ristic
  - Addition of core ruleset
  - (Build)Requires libxml2 and pcre added.


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.0-3
changelog:
  - Automagically configure correct library path for libxml2 library.
  - Add LoadModule for mod_unique_id as the logging wants this at runtime


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.1-1
changelog:
  - New upstream release
  - Drop ASCIIZ rule (fixed upstream)
  - Re-enable protocol violation/anomalies rules now that REQUEST_FILENAME
    is fixed upstream.


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.5.6-1
changelog:
  - Update to upstream 2.5.6
  - Remove references to mlogc, it no longer ships in the main tarball.
  - Link correctly vs. libxml2 and lua (bz# 445839)
  - Remove bogus LoadFile directives as they're no longer needed.


author: Michael Fleming <mfleming+rpm@thatfleminggent.com> - 2.5.12-1
changelog:
  - Update to latest upstream release
  - SECURITY: Fix potential rules bypass and denial of service (bz#563576)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-1
changelog:
  - Update to 2.7.1
  - Remove libxml2 build patch (upstreamed)
  - Update spec since upstream moved to github


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-3
changelog:
  - Add some missing directives RHBZ #569360
  - Fix multipart/invalid part ruleset bypass issue (CVE-2012-4528)
    (RHBZ #867424, #867773, #867774)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-5
changelog:
  - Use conditional for loading mod_unique_id (rhbz #879264)
  - Fix syntax errors on httpd 2.4.x by using IncludeOptional (rhbz #879264, comment #2)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.3-2
changelog:
  - Fix NULL pointer dereference (DoS, crash) (CVE-2013-2765) (RHBZ #967615)
  - Fix a possible memory leak.


author: Darren Mobley <darren@cpanel.net> - 2.8.0-1
changelog:
  - Changed name of ea-httpd rpm dependancy to ea-apache2-config
  - Fixed previous changelog entry claiming version was updated to 2.9.0


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.9.0-6
changelog:
  - Added explicit lua and xml2 Requires statements (EA-4433)
  - Remove mpm_itk and mod_ruid2 conflicts (EA-4433)
  - Added more comments to explain portions of spec file (EA-4433)
  - Arrest control of modsec2.conf so we can ensure proper Apache logging type (EA-4433)
  - Arrest control of conf.modules.d/800-mod_security2.conf (EA-4433)
  - RPM now creates logs/modsec_audit dir for concurrent logging (EA-4433)
  - Added comments to configuration files to help guide administrator (EA-4433)
  - Use module name, not file name in configuration file (EA-4654)


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.9.0-12
changelog:
  - Enforce apr-util dependency (EA-5720)
  - Ensure dependent libraries are the same arch type (EA-5720)


author: Jacob Perkins <jacob.perkins@cpanel.net> - 2.9.2-1
changelog:
  - EA-6312: Update ModSec to 2.9.2
  - Removed RuleProcessingFailedExpand patch as it was fixed upstream


author: Tim Mullin <tim@cpanel.net> - 2.9.3-18
changelog:
  - EA-10239: Increase compiler optimization level to help mitigate performance loss from large rulesets


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.8-1
changelog:
  - EA-12853: Update ea-apache24-mod_security2 from v2.9.7 to v2.9.8
  - Remove 2 patches that were added upstream.
  	- 0003-Import-some-memory-leak-fixes-for-Mod-Security-2.9.x.patch
  	- 0004-Allow-Lua-5.4.patch
  - Add new patch for re.c to allow it to build on Ubuntu
  - Add new patch for tests on Ubuntu 20


author: Dan Muey <daniel.muey@webpros.com> - 2.9.9-1
changelog:
  - EA-12885: Update ea-apache24-mod_security2 from v2.9.8 to v2.9.9
  - Possible DoS vulnerability: CVE-2025-47947


author: Dan Muey <daniel.muey@webpros.com> - 2.9.10-1
changelog:
  - ZC-12886: Update ea-apache24-mod_security2 from v2.9.9 to v2.9.10
  - DoS vulnerability: CVE-2025-48866


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.11-1
changelog:
  - EA-12994: Update ea-apache24-mod_security2 from v2.9.10 to v2.9.11
  - prevent segmentation fault if the XML node is empty: CVE-2025-52891


author: Dan Muey <daniel.muey@webpros.com> - 2.9.12-1
changelog:
  - EA-13061: Update ea-apache24-mod_security2 from v2.9.11 to v2.9.12
  - fix: Improper error handling CVE 2025-54571


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.7.2-12.3.cloudlinux
changelog:
  - suphp-0.7.1-cagefs.patch replaced with suphp-0.7.2-cagefs.am.patch
  - Dependencies adjusted to use ea-* packages from CloudLinux OS
  - Epoch bumped to 1
  - Vendor removed
  - dist macro added to Release


author: Tim Mullin <tim@cpanel.net> - 0.7.2-25
changelog:
  - EA-7525: Fixed 0008-Support-phprc_paths-section-in-suphp.conf.patch, targetMode used before initialized


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 0.7.2-25.cloudlinux.1
changelog:
  - EA4D-97: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea- and alt-php


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.7.2-30.cloudlinux.1
changelog:
  - EA4D-323: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea-php* and alt-php*


author: Joe Orton <jorton@redhat.com> 0.9.3-7
changelog:
  - use AI_ADDRCONFIG in getaddrinfo() support (#73350)
  - include a working libtool script rather than relying on
   /usr/bin/libtool (#97695)


author: Joe Orton <jorton@redhat.com> 0.9.4-6
changelog:
  - define apr_off_t as int/long/... to prevent it changing
    with _FILE_OFFSET_BITS on 32-bit platforms


author: Joe Orton <jorton@redhat.com> 0.9.4-10
changelog:
  - fix configure check for mmap of /dev/zero
  - just put -D_GNU_SOURCE in CPPFLAGS not _{BSD,SVID,XOPEN}_SOURCE


author: Joe Orton <jorton@redhat.com> 0.9.4-13
changelog:
  - entirely remove 2Gb file size limit from apr_file_copy();
    fixes "svnadmin hotcopy" on repos with >2Gb strings table
  - work around getnameinfo bugs with v4-mapped addresses
  - fix apr_time_exp_get() for dates in 2038 (Philip Martin)


author: Joe Orton <jorton@redhat.com> 0.9.4-14
changelog:
  - enable posixsem and process-shared pthread mutex support, but
    ensure that sysvsem remains the default mechanism


author: Joe Orton <jorton@redhat.com> 0.9.4-15
changelog:
  - add support for setuid/setgid/sticky bits (André Malo)
  - add apr_threadattr_{guardsize,stacksize}_set() (latter by Jeff Trawick)


author: Joe Orton <jorton@redhat.com> 0.9.4-22
changelog:
  - backport fixes from HEAD:
   * correct implementation of nested mutexes
   * support for POSIX semaphores on LP64 platforms


author: Joe Orton <jorton@redhat.com> 0.9.6-5
changelog:
  - add from 0.9.x branch:
   * fix for apr_{uid,gid}_* error handling (r239592)
   * fix for apr_file_ write flushing (r267192)
  - add backport for use of readdir64_r (r265032, r265681, r265684)


author: Joe Orton <jorton@redhat.com> 0.9.6-6
changelog:
  - don't override CFLAGS at build time
  - allow setting TCP_NODELAY and TCP_CORK concurrently
  - use _exit() not exit() in child if exec*() fails (upstream #30913)


author: Joe Orton <jorton@redhat.com> 1.2.2-2
changelog:
  - avoid linking against -lrt
  - don't print -L${libdir} in --libs output
  - don't export -lcrypt/-luuid in .la file


author: Joe Orton <jorton@redhat.com> 1.2.8-6
changelog:
  - merge review (#225253): drop .a archive; drop use of CC/CXX,
    use BuildRequires; drop old Conflicts; URL reference for Source


author: Bojan Smojver <bojan@rexursive.com> 1.2.12-1
changelog:
  - bump up to 1.2.12
  - add dist
  - remove a comment from apr-1.2.7-psprintfpi.patch (applied upstream)


author: Joe Orton <jorton@redhat.com> - 1.4.2-3
changelog:
  - work around alising issue in ring macros (upstream PR 50190)
  - fix buildconf with newer libtool (#670621)


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.5.2-1.1.cloudlinux
changelog:
  - apr-1.4.2.1_cloudlinux_apr.patch was replaced with apr-1.4.2.2.lve.patch
  - Epoch bumped to 1
  - dist macro added to Release


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Joe Orton <jorton@redhat.com> 0.9.3-3
changelog:
  - make devel package conflict with old subversion-devel
  - run the less crufty parts of the test suite


author: Joe Orton <jorton@redhat.com> 0.9.3-5
changelog:
  - fix to try linking against -ldb first (#90917)
  - depend on openldap, gdbm, db4, expat appropriately.


author: Joe Orton <jorton@redhat.com> 1.2.8-3
changelog:
  - build DBD drivers as DSOs (w/Bojan Smojver, #192922)
  - split out pgsql driver into -pgsql subpackage


author: Joe Orton <jorton@redhat.com> 1.2.8-9
changelog:
  - add rewrite of expat autoconf code (upstream r493791)
  - fix build for new glibc open()-as-macro
  - split out sqlite subpackage


author: Bojan Smojver <bojan@rexursive.com> 1.2.10-1
changelog:
  - bump up to 1.2.10
  - pick up newly checked in MySQL DBD driver directly from ASF
  - remove dbdopen patch (fixed upstream)
  - remove xmlns patch (fixed upstream)
  - remove autoexpat patch (fixed upstream)


author: Bojan Smojver <bojan@rexursive.com> - 1.2.12-1
changelog:
  - bump up to 1.2.12
  - drop MySQL DBD driver, shipped upstream
  - adjust various patches to apply
  - rework tests in %check (1.2.x got tests from trunk)


author: Bojan Smojver <bojan@rexursive.com> - 1.3.2-3
changelog:
  - revert build dependencies, change from -2 didn't help
  - add apr-util-1.3.2-pgsql.patch (remove pgsql_LIBS during detection)


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.5.2-9.1.cloudlinux
changelog:
  - Epoch bumped to 1
  - dist macro added to Release
  - Dependencies adjusted to use ea-apr from CloudLinux OS


author: Tim Mullin <tim@cpanel.net> - 1.6.3-1
changelog:
  - EA-11199: Update apr-util from v1.6.1 to v1.6.3
  - CVE-2022-25147
      Integer Overflow or Wraparound vulnerability in apr_base64 functions
      of Apache Portable Runtime Utility (APR-util) allows an attacker to
      write beyond bounds of a buffer.


author: Dan Muey <dan@cpanel.net> - 1.20.0-4
changelog:
  - EA-6638: bump release prefix to make the EA4 one newer than the typo'd-release-prefix in EA4-experimental


author: Cory McIntire <cory@cpanel.net> - 1.57.0-1
changelog:
  - EA-11729: Update ea-nghttp2 from v1.56.0 to v1.57.0
  - CVE-2023-44487 - The HTTP/2 protocol allows a denial of service (server resource consumption)


author: Cory McIntire <cory@cpanel.net> - 1.61.0-1
changelog:
  - EA-12069: Update ea-nghttp2 from v1.60.0 to v1.61.0
  - CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage


author: Rex Dieter <rdieter@fedoraproject.org> - 0.99.0-20.20091203
changelog:
  - 20091203 snapshot
  - spec housecleaning
  - Tidy erroniously removes whitespace, causing mangled text (#481350)


author: Daniel Veillard <veillard@redhat.com> 2.6.27-1
changelog:
  - upstream release 2.6.27 see http://xmlsoft.org/news.html
  - very large amount of bug fixes reported upstream


author: Daniel Veillard <veillard@redhat.com> 2.7.0-1.fc10
changelog:
  - upstream release of 2.7.0
  - switch to XML 1.0 5th edition
  - switch to RFC 3986 for URI parsing
  - better entity handling
  - option to remove hardcoded limitations in the parser
  - more testing
  - a new API to allocate entity nodes
  - and lot of fixes and clanups


author: Daniel Veillard <veillard@redhat.com> 2.7.2-1.fc10
changelog:
  - new release 2.7.2
  - Fixes the known problems in 2.7.1
  - increase the set of options when saving documents


author: Daniel Veillard <veillard@redhat.com> - 2.7.3-1
changelog:
  - new release 2.7.3
  - limit default max size of text nodes
  - special parser mode for PHP
  - bug fixes and more compiler checks


author: Daniel Veillard <veillard@redhat.com> - 2.7.4-1
changelog:
  - upstream release 2.7.4
  - symbol versioning of libxml2 shared libs
  - very large number of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.7-1
changelog:
  - Upstream release of 2.7.7
  - fix serious trouble with zlib >= 1.2.4
  - xmllint new option --xpath
  - various HTML parser improvements
  - includes a number of nug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.8-1
changelog:
  - Upstream release of 2.7.8
  - various bug fixes, including potential crashes
  - new non-destructive formatting option
  - date parsing updated to RFC 5646


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-0rc1
changelog:
  - upstream release candidate 1 of 2.9.0
  - introduce a small API change, but ABI compatible, see
    https://mail.gnome.org/archives/xml/2012-August/msg00005.html
    patches for php, gcc/libjava and evolution-data-connector are upstream
    Grab me in cases of problems veillard@redhat.com
  - many bug fixes including security aspects and small improvements


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-1
changelog:
  - upstream release of 2.9.0
  - A few new API entry points
  - More resilient push parser mode
  - A lot of portability improvement
  - Faster XPath evaluation
  - a lot of bug fixes and smaller improvement


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-2
changelog:
  - remaining cleanups from merge bug rhbz#226079
  - do not put the docs in the main package, only in -devel rhbz#864731


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Till Maas <opensource@till.name> - 2.9.2-4
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.9.2-8
changelog:
  - Remove executable permissions from documentation.  Complies with packaging
    guidelines and solves issue of libxml2-python3 package depending on python2


author: Daniel Veillard <veillard@redhat.com> - 2.9.2-1
changelog:
  - upstream release of 2.9.3
  - Fixes for CVE-2015-8035, CVE-2015-7942, CVE-2015-7941, CVE-2015-1819
    CVE-2015-7497, CVE-2015-7498, CVE-2015-5312, CVE-2015-7499, CVE-2015-7500
    and CVE-2015-8242
  - many other bug fixes


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Dan Muey <dan@cpanel.net> - 2.9.7-1
changelog:
  - EA-7043: Update from v2.9.4 to v2.9.7
  - fixed %setup so that we do not need to modify tarball (EA-6094)
  - remove unreferenced 2.9.4-remove-pyverify_fd patch


author: Cory McIntire <cory@cpanel.net> - 2.10.3-1
changelog:
  - EA-11205: Update ea-libxml2 from v2.9.7 to v2.10.3
  - [CVE-2022-23308] Use-after-free of ID and IDREF attributes
  - [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
  - [CVE-2022-2309] Reset nsNr in xmlCtxtReset
  - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE


author: Cory McIntire <cory@cpanel.net> - 2.10.4-1
changelog:
  - EA-11352: Update ea-libxml2 from v2.10.3 to v2.10.4
  - [CVE-2023-29469] Hashing of empty dict strings isn't deterministic
  - [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType


author: Cory McIntire <cory@cpanel.net> - 2.11.1-1
changelog:
  - EA-11388: Update ea-libxml2 from v2.10.4 to v2.11.1
      - Security Fixes
      - Fix use-after-free in xmlParseContentInternal() (David Kilzer)
      - xmllint: Fix use-after-free with --maxmem
      - parser: Fix OOB read when formatting error message
      - entities: Rework entity amplification checks


author: Cory McIntire <cory@cpanel.net> - 2.11.5-2
changelog:
  - EA-11822: Rolling “ea-libxml2” back to “04c4b9a40fbd4c0f07e1b66ab71f24a66aa7f90d”: libxml2 upstream updated to 2.12 and changed a lot of .h files, apache/php need patches


author: Cory McIntire <cory@cpanel.net> - 2.12.6-1
changelog:
  - EA-12022: Update ea-libxml2 from v2.12.4 to v2.12.6
  - [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking


author: Cory McIntire <cory@cpanel.net> - 2.12.6-2
changelog:
  - EA-12252: Rolling “ea-libxml2” back to “0e1f4ea2052c4cb2643ebd9d51394223643c6fc2”: breaks scl-phps


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
  - EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.6-1
changelog:
  - EA-12713: Update ea-libxml2 from v2.13.5 to v2.13.6
    - [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements
    - [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.8-1
changelog:
  - EA-12821: Update ea-libxml2 from v2.13.6 to v2.13.8
  - [CVE-2025-32415] schemas: Fix heap buffer overflow in xmlSchemaIDCFillNodeTables
  - [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)


author: Cory McIntire <cory@cpanel.net> - 1.10-2
changelog:
  - EA-12397: Rolling “ea-libzip” back to “a55dc085a3c6d8ccc95613a7f6acf4589fe405c2”: Version issues in happening in PHP compliations with this update


author: Jack Hayhurst <jakdept@gmail.com> - 1.4.35-4
changelog:
  - Change config install location in spec file to match init files
  - modified from github PR #1, also fixed changelog versions


author: Andy Baugh <thomas.baugh@cpanel.net> - 1.5.12-2
changelog:
  - CPANEL-26786: Add "provides" entry for memcached, as we actually conflict
    with the base package due to installing to the same place (but it is the
    same software package ultimately, so may as well have it act as an
    alternative instead of conflicting).


author: Daniel Muey <dan@cpanel.net> - 1.0.1-4
changelog:
  - ZC-7769: factor in that `active_configs` still has the vendor info even if the vendor is disabled per `active_configs`


author: Dan Muey <dan@cpanel.net> - 1.0.3-2
changelog:
  - ZC-10395: Build/manage `modules/ngx_http_modsecurity_module.so` and nginx modsec hooks in this pkg


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - spec file cleanup (thanks to Yury V. Zaytsev)
  - log dir permitions fixed
  - logrotate creates new logfiles with nginx owner
  - "upgrade" argument to init-script added (based on fedora one)


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - 1.0.11
  - init script enhancements (thanks to Gena Makhomed)
  - one second sleep during upgrade replaced with 0.1 sec usleep


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - 1.5.12
  - spec cleanup
  - openssl version dependence added
  - upgrade() function in the init script improved
  - warning added when binary upgrade returns non-zero exit code


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - common configure args are now in macros
  - xslt, image-filter and geoip dynamic modules added
  - 1.9.12


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.9.13
  - Added perl and njs dynamic modules
  - Fixed Requires section for dynamic modules on CentOS7/RHEL7


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.3.
  - njs updated to 0.1.0.
  - njs stream dynamic module added to nginx-module-njs package.
  - geoip stream dynamic module added to nginx-module-geoip package.


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.9
  - Extended hardening build flags.
  - Added check-reload target to init script / systemd service.


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.13
  - CentOS7/RHEL7: made upgrade loops/timeouts configurable via
    /etc/sysconfig/nginx.
  - Bumped upgrade defaults to five loops one second each.


author: Dan Muey <dan@cpanel.net> - 1.15.9-2
changelog:
  - ZC-4868: Add cPanel specific configurations
  - ZC-4867: start nginx (specfile already stops it if needed)
  -          fix hard coded `nginx` user in log ownership
  -          Add `Provides` and `Conflicts` for upstream
  - ZC-4867: Move Apache to alternate port and back again
  - ZC-4869: Add support for proxying to apache,
  -          add mailman and DCV (.well-known) proxies
  - ZC-4870/ZC-4871: tie into chkservd and restartsrv system
  - ZC-4897: Account for current apache port settings that are above the root-only range
  - ZC-4898: Do not move apache if it is already configured for nonstandard ports
  - ZC-4869: do `proxy_set_header` for `Host` and `X-Real-IP` anywhere we `proxy_pass`
  - ZC-4869: alias img-sys for mailman images


author: Daniel Muey <dan@cpanel.net> - 1.16.0-2
changelog:
  - ZC-5014: Add cPanel Password Protected Directory support
  - ZC-5151: Add CGI and Server-Parsed support via proxy


author: Daniel Muey <dan@cpanel.net> - 1.17.3-6
changelog:
  - ZC-5574: Ensure ngx_http_pipelog_module processes are cleaned up
  -   Work around https://github.com/pandax381/ngx_http_pipelog_module/issues/7


author: Dan Muey <dan@cpanel.net> - 1.19.1-3
changelog:
  - ZC-6985: fix `undefined status from Cpanel::ServiceManager::Services::Nginx for Server Status`
  -    probably other issues as well


author: Daniel Muey <dan@cpanel.net> - 1.19.3-2
changelog:
  - ZC-7669: Add universal hook to hard restart nginx for any transaction involving any nginc related package


author: Julian Brown <julian.brown@cpanel.net> - 1.19.7-3
changelog:
  - ZC-8436: Hooks for suspend/unsuspend acct, changing ip, and refactor clear-cache for API
  - ZC-8433: handle localhost/127.0.0.1/machines's hostname consistently
  - ZC-8194: Add cloudflare config
  - ZC-8510: do bandwidth notices and exceeding


author: Travis Holloway <t.holloway@cpanel.net> - 1.19.8-5
changelog:
  - EA-9672: Decrease delay to rebuild config when creating new domains
  - EA-9673: Honor proxysubdomains tweak setting when rebuilding config


author: Travis Holloway <t.holloway@cpanel.net> - 1.19.9-1
changelog:
  - EA-9683: Update ea-nginx from v1.19.8 to v1.19.9
  - EA-9682: Create hook to rebuild config for tweak settings changes in WHM


author: Cory McIntire <cory@cpanel.net> - 1.21.0-1
changelog:
  - EA-9798: Update ea-nginx from v1.20.0 to v1.21.0
  - EA-9791: Add alarm to request to determine if a domain is using CloudFlare


author: Travis Holloway <t.holloway@cpanel.net> = 1.21.0-8
changelog:
  - EA-9879: Make timeout on request to determine if a domain is using CloudFlare threadsafe
  - EA-9880: Move Accounts::Modify and Accounts::Remove from rebuild_user action to rebuild_all action


author: Daniel Muey <dan@cpanel.net> - 1.21.0-12
changelog:
  - ZC-9005: Do not hide Upgrade header when proxying websockets under main service subdomains
  - ZC-9018: rebuild all users; reporting any issues at the end
  - ZC-9020: Add cache related methods to adminbin


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.0-15
changelog:
  - EA-9944: Remove noreplace from nginx.conf and ea-nginx.conf
  - EA-9945: Ensure clean '/etc/nginx' directory on new installs


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.0-16
changelog:
  - EA-9946: Add syntax validation check to configuration script
  - EA-9967: Ensure 'modsec_vendor_configs' is left in place on new installs


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.1-5
changelog:
  - EA-9954: Add logic for server_names_hash_max_size and server_names_hash_bucket_size to syntax checker


author: Dan Muey <dan@cpanel.net> - 1.21.3-2
changelog:
  - ZC-9260: Move standalone includes to seperate folder && bring in server includes on reverse proxy and standalone
  - ZC-9261: Allow include to prefix `proxy_cache_key` based on any criteria


author: Dan Muey <dan@cpanel.net> - 1.21.4-6
changelog:
  - ZC-9343: Change worker_processes to auto
  - ZC-9343: Allow setting `worker_processes` via /etc/nginx/ea-nginx/settings.json
  - ZC-9343: When writing settings.json make it human readable
  - ZC-7303: Support IP based requests (ZC-9586: only use an IP once)
  - ZC-9384: Use mycpanel.pem if its there


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.5-2
changelog:
  - EA-10283: Only perform regex check for WordPress login for domains that have at least one WordPress site installed


author: Dan Muey <dan@cpanel.net> - 1.21.5-5
changelog:
  - ZC-9700: Do not use predictable cPanel-localhost header
  - ZC-9700: ensure random value is regenerated if missing or older than 30 minutes; ensure users can not see the value
  - EA-10464: Avoid redirect to https for service subdomain DCV validation


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-2
changelog:
  - EA-10503: Update standalone config to ensure 404 for non-existent php files
  - EA-10285: Have 'ea-nginx config --all' update user configs in parallel


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-5
changelog:
  - EA-10493: The server_name directive needs the public/external IP on systems configured to use a NAT


author: Dan Muey <dan@cpanel.net> - 1.21.6-11
changelog:
  - ZC-9698: Proxy robots.txt (and favicon) since it can be dynamic (e.g. wordpress + .htaccess)
  - ZC-9844: Add flag file to use micro caching as the cache defaults


author: Dan Muey <dan@cpanel.net> - 1.21.6-13
changelog:
  - ZC-9931: Ensure that a pre-existing cache.json/settings.json is respected when ea-nginx is installed
  - ZC-9371: enable keepalive support
  - ZC-9939: optimize proxy sub-domain configuration
  - ZC-9952: Allow setting `worker_shutdown_timeout` via /etc/nginx/ea-nginx/settings.json
  - EA-10673: Increase `proxy_headers_hash_bucket_size` to 128 in cpanel-proxy-xt.conf


author: Dan Muey <dan@cpanel.net> - 1.22.0-2
changelog:
  - ZC-9940: Change worker_processes default back to 1
  - ZC-9940: Have worker_shutdown_timeout default to 10 seconds


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-3
changelog:
  - EA-10892: Avoid configuring shared IPs in multiple server blocks when configuring nginx asynchronously


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-4
changelog:
  - EA-10671: Calculate 'server_names_hash_bucket_size' and 'server_names_hash_max_size' at config time
  - EA-10913: Update ea-nginx.conf when adding/updating a config file for a single user


author: Tim Mullin <tim@cpanel.net> - 1.23.2-2
changelog:
  - EA-10999: Update logic to check if service is listening on ports 80 or 443
  - EA-10985: Drop logrotate configuration for domain logs since cpanellogd handles the rotation


author: Tim Mullin <tim@cpanel.net> - 1.23.2-4
changelog:
  - EA-11004: Fix Passenger restart failures after reboot
  - EA-10670: Add better guards against bad userdata to configuration script


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-5
changelog:
  - EA-10769: Allow custom config files to be moved across partitions when ea-nginx is installed
  - EA-11025: If user generated config is detected as bad after configuration, remove the config file to avoid taking all sites down


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-7
changelog:
  - EA-11048: Move '/var/log/nginx' to a backup location during uninstall
  - EA-11069: Increase open files limit for master and worker processes
  - EA-10574: Remove deprecated configure option --with-ipv6
  - EA-10874: Remove fallback logic in scripts::ea_nginx::_get_application_paths()


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-8
changelog:
  - EA-11078: Fix uninitialized value warning for non-user requests when the USER_ID touch file exists
  - EA-11093: Increase nginx buffer when calculating server_names_hash_bucket_size
  - EA-10891: Refactor logging initialization to be its own sub


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.23.3-3
changelog:
  - ZC-10317: Update ngx_http_pipelog_module to v1.0.3
  - ZC-10484: Remove SIGKILL from various nginx files
  - ZC-10517: Address Ubuntu creating addiotional splitlog processes
  - ZC-10593: Close out fd's during reload/shutdown
  - EA-11088: Account for mail subdomains of addon and parked domains when configuring the server_name directive
  - EA-11121: Add ipv6 subdomain to server_name directive when account has an ipv6 address assigned
  - EA-10890: Refactor _render_and_append() to use more data from global config data


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.3-7
changelog:
  - EA-11269: Reduce frequency of nginx restarts during cpanellogd's domain log processing when piped logging is enabled


author: 2023 Danila Vershinin <dvershinin@cloudlinux.com> - 1:1.23.4-2.cloudlinux.1
changelog:
  - AP2NGX-4 updated patch allowing more contexts for a number of NGINX directives
  - AP2NGX-14 added patch that allows customizing root locations in server blocks


author: Travis Holloway <t.holloway@cpanel.net> - 1.24.0-2
changelog:
  - EA-11131: Ensure userdata reflects apache port changes when ea-nginx is removed
  - EA-11132: Ensure '/var/log/nginx.uninstall' does not exist before moving active log files there


author: Cory McIntire <cory@cpanel.net> - 1.25.1-1
changelog:
  - EA-11496: Update ea-nginx from v1.25.0 to v1.25.1
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.25.1-1.cloudlinux.1
changelog:
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Dan Muey <dan@cpanel.net> - 1.25.1-4
changelog:
  - ZC-11149: support touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.25.3-1.cloudlinux.1
changelog:
  - AP2NGX-70: Add support of lsapi Virtual Hosts to ea-nginx
  - AP2NGX-77: Fixed invalid number of arguments in the "client_max_body_size" directive


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.25.4-1.cloudlinux.1
changelog:
  - AP2NGX-81: Fix regression issus introduced by AP2NGX-70
  - AP2NGX-81: Correct lsapi_handler value for lsapi virtual hosts
  - AP2NGX-81: Increase timeout during transition from Apache to NGINX to improve reliability


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
  - ZC-11679: Account for circumstance where wwwacct.conf is missing
  - ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
  - EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
  - *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
    Thanks to Nils Bars.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.6
changelog:
  - AP2NGX-221: Reorder redirects to ensure proxy_pass by Apache2Nginx is in effect
  - removed WAFCL patch


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.7
changelog:
  - AP2NGX-226: Include environment variable for extra server identification to PHP scripts
  - AP2NGX-236: Ensure consistent index directive defaults between Apache, PHP-FPM and LSAPI and index_error_code directive


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
  - EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
  - Security: insufficient check in virtual servers handling with TLSv1.3
    SNI allowed to reuse SSL sessions in a different virtual server, to
    bypass client SSL certificates verification (CVE-2025-23419)


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.3-2.cloudlinux.3
changelog:
  - MAXWS-180: Update nginx mod-lsapi configuration directives and set lsapi_check_script off for better performance


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-2.cloudlinux.4
changelog:
  - MAXWS-267: Add autoindex_ignore configuration directive
  - MAXWS-419: Prevent unnecessary reloads and .htaccess conversion for MAx Web Server


author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-4.cloudlinux.2

changelog:
  - MAXWS-410: File listing is enabled by MAx Web Server converter by default
  - MAXWS-502: Add support for autoindex_ignore_reset configuration directive


author:
  Sergey Kokhan <skokhan@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-5.cloudlinux.4

changelog:
  - MAXWS-556: Add optional SSL environment variables fpm/lsapi conf files
  - MAXWS-539: Use global file lock before calling apache2nginx in cpanel hooks


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 3:1.26.3-5.cloudlinux.6
changelog:
  - MAXWS-521: Exclude cpanel-password-protected-dirs.tt from the server.conf.tt template when apache2nginx is enabled


author: Dan Muey <daniel.muey@webpros.com> - 1.26.3-6
changelog:
  * Mon Jun 02 2025 Dan Muey <daniel.muey@webpros.com> - 1.26.3-6
  - ZC-12882: Re-order traffic log IPs format to match actual use


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 1.26.3-15.cloudlinux.1

changelog:
  - MAXWS-756: Remove lsapi_check_script directive from cpanel-lsapi.conf
  - MAXWS-793: Bump conflict version for max_webserver


author: Dan Muey <daniel.muey@webpros.com> - 1.29.1-1
changelog:
  - EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  - [CVE-2025-53859] A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> alutsiuk <alutsiuk@cloudlinux.com> - 3:1.29.1-1.cloudlinux

changelog:
  - MAXWS-821: Fixed ea-nginx build after merge of nginx-1.29.1 version
  - MAXWS-793: Bump conflict version for max_webserver
  - MAXWS-756: Remove lsapi_check_script directive from cpanel-lsapi.conf
  - MAXWS-673: Implemented varmatch block based on precompiled action handlers


author: Dan Muey <daniel.muey@webpros.com> - 1.29.1-1
changelog:
  - EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  - CVE-2025-53859: A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.29.1-1.cloudlinux.1
changelog:
  - MAXWS-821: Evaluate varmatch block for access directives in the access phase
  - MAXWS-828: Added return and return_status_code directives support in varmatch block
  - MAXWS-849: Added remove_type directive support in nginx
  - MAXWS-851: Normalize varmatch regex with base= to match filenames
  - MAXWS-828: Fixed error_page usage in varmatch if defined in global context
  - MAXWS-861: Fixed regex normalization and matching under varmatch subdirs
  - MAXWS-889: Re-evaluate varmatch rules against the resolved index file URI


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.5-1
changelog:
  - EA-13333: Update ea-nginx from v1.29.4 to v1.29.5
  - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).


author: Jack Hayhurst <jack@deleteos.com> - 0.2
changelog:
  - added ea-php71-php-memcahe branched off of php54

  - Fixed package name, entire RPM is now working.


author: Cory McIntire <cory@cpanel.net> - 7.3.3-1
changelog:
  - Updated to version 7.3.3 via update_pkg.pl (EA-8275)
  - Added patch for phpize to handle autotools on C6


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.5-2.cloudlinux.1
changelog:
  - Apply mod_lsapi_mode patch
  - Update userini_homedir.patch, log.patch, use_reject.patch to latest versions


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.20-2.cloudlinux.1
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-4.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.2
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-5.cloudlinux.1
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-10.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 1:7.3.33-15.cloudlinux.3
changelog:
  - EA4D-746: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-9.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Cory McIntire <cory.mcintire@webpros.com> - 7.4.33-15
changelog:
  - ZC-12614: Rolling “ea-php74” back to “2ae8a0c01d69dbc710734ff516c17a19a479fa13”: was not meant to be merged


author: Remi Collet <remi@fedoraproject.org> - 2.2.5-3
changelog:
  - add numerical prefix to extension configuration file (php 5.6)
  - add comment about session configuration


author: Remi Collet <remi@fedoraproject.org> - 3.1.0-1
changelog:
  - update to 3.1.0
  - open https://github.com/phpredis/phpredis/issues/1052 max version
  - open https://github.com/phpredis/phpredis/issues/1053 segfault
  - open https://github.com/phpredis/phpredis/issues/1054 warnings
  - open https://github.com/phpredis/phpredis/issues/1055 reflection
  - open https://github.com/phpredis/phpredis/issues/1056 32bits tests


author: Remi Collet <remi@fedoraproject.org> - 3.1.0-2
changelog:
  - test build for open upcoming 3.1.1
  - open https://github.com/phpredis/phpredis/issues/1060 broken impl
    with https://github.com/phpredis/phpredis/pull/1064
  - reed https://github.com/phpredis/phpredis/issues/1062 session php 7.1
    with https://github.com/phpredis/phpredis/pull/1063


author: Remi Collet <remi@remirepo.net> - 3.1.4~RC2-1
changelog:
  - update to 3.1.4RC2 (beta)
  - open https://github.com/phpredis/phpredis/issues/1236
    unwanted noise (warning) not even using the extension


author: Remi Collet <remi@remirepo.net> - 4.0.0~RC1-1
changelog:
  - update to 4.0.0RC1
  - rename to php-pecl-redis4
  - enable lzf support
  - update configuration for new options


author: Remi Collet <remi@remirepo.net> - 4.0.0~RC1-3
changelog:
  - add patch to skip online test from
    https://github.com/phpredis/phpredis/pull/1304
  - exclude s390x arch reported as
    https://github.com/phpredis/phpredis/issues/1305


author: Remi Collet <remi@remirepo.net> - 4.1.0~RC1-1
changelog:
  - update to 4.1.0RC1 (alpha)
  - open https://github.com/phpredis/phpredis/pull/1365
    use PHP_BINARY instead of php and allow override
  - report https://github.com/phpredis/phpredis/issues/1364
    missing files in pecl archive
  - add new redis.session.lock* options in provided configuration


author: Remi Collet <remi@remirepo.net> - 4.1.0~RC1-2
changelog:
  - test build with 7.3
  - open https://github.com/phpredis/phpredis/pull/1366
    Fix: Warning: time() expects exactly 0 parameters, 1 given ...


author: Remi Collet <remi@remirepo.net> - 4.2.0~RC2-1
changelog:
  - update to 4.2.0RC2 (beta)
  - open https://github.com/phpredis/phpredis/issues/1437 32-bit failed test


author: Remi Collet <remi@remirepo.net> - 4.3.0~RC1-1
changelog:
  - update to 4.3.0RC1 (alpha)
    no change sincy 4.2.1RC1, only version change according to semver
    see https://github.com/phpredis/phpredis/issues/1517


author: Remi Collet <remi@remirepo.net> - 5.0.0~RC1-1
changelog:
  - update to 5.0.0RC1
  - rename to php-pecl-redis5
  - raise dependency on PHP 7
  - enable msgpack support
  - enable json support
  - update configuration for new options
  - open https://github.com/phpredis/phpredis/pull/1578
    fix extension dependencies and report about json serializer


author: Remi Collet <remi@remirepo.net> - 5.1.0~RC1-1
changelog:
  - update to 5.1.0RC1
  - enable ZSTD compression support
  - open https://github.com/phpredis/phpredis/pull/1648


author: Remi Collet <remi@remirepo.net> - 5.3.0~RC1-1
changelog:
  - update to 5.3.0RC1
  - enable lz4 compression support
  - drop patch merged upstream
  - add upstream patch to fix lz4 library name
  - add new option in provided configuration file


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


author: Eduard Abdullin <eabdullin@cloudlinux.con> - 8.0.0-2.cloudlinux.1
changelog:
  - Fix patch 0007 with cloudlinux-php-fpm patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 8.0.3-2.cloudlinux.1
changelog:
  - remove 0005-Ensure-that-php.d-is-not-scanned-when-PHPRC-is-set.patch for EA4D-265
  - Update litespeed log patch for litespeed-7.9


author: Cory McIntire <cory@cpanel.net> - 8.0.25-1
changelog:
  - EA-11020: Update ea-php80 from v8.0.24 to v8.0.25
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.0.27-1
changelog:
  - EA-11137: Update ea-php80 from v8.0.26 to v8.0.27
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.0.28-1
changelog:
  - EA-11227: Update ea-php80 from v8.0.27 to v8.0.28
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.1.8-1
changelog:
  - EA-10821: Update ea-php81 from v8.1.7 to v8.1.8
  - (Heap buffer overflow in finfo_buffer). (CVE-2022-31627)


author: Cory McIntire <cory@cpanel.net> - 8.1.12-1
changelog:
  - EA-11021: Update ea-php81 from v8.1.11 to v8.1.12
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.1.14-1
changelog:
  - EA-11133: Update ea-php81 from v8.1.13 to v8.1.14
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.1.16-1
changelog:
  - EA-11244: Update ea-php81 from v8.1.15 to v8.1.16
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.2.1-1
changelog:
  - EA-11136: Update ea-php82 from v8.2.0 to v8.2.1
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.2.3-1
changelog:
  - EA-11226: Update ea-php82 from v8.2.2 to v8.2.3
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
    Adjusted release to -6 due to OBS build issues of the gems


author: Cory McIntire <cory@cpanel.net> - 2.7.8-1
changelog:
  - EA-11327: Update ea-ruby27 from v2.7.7 to v2.7.8
    CVE-2023-28755: ReDoS vulnerability in URI
    CVE-2023-28756: ReDoS vulnerability in Time


