# changelog

author: Anton Bobrov <abobrov@cloudlinux.com> 2.0-1
changelog:
  - AlmaCare and AlmaCare Cybersecurity integration
  - KPT-2210: write audit log patch management operations invoked via CLI
  - KPT-2572: proxy for almacare repos
  - KPT-2537: testing feed channel to get more fresh patchsets
  - KPT-2607: show recent enabled patchset name in audit log for patchset management operations
  - KPT-2621: remove max servers count limit for a key
  - KPT-2668: enable standalone check-ins processing by default
  - KPT-2674: API: support server deletion by server_id


author: Anton Bobrov <abobrov@cloudlinux.com> 2.2-1
changelog:
  - KPT-2494: audit: content security policy compliance for admin UI pages
  - KPT-2673: "Disable LDAP" button doesn't reset LDAP configuration
  - KPT-2742, KPT-2760, KPT-2761: audit: update 3rd party dependencies to latest versions
  - KPT-2808: ldap strict_check URI setting works only after eportal restart


author: Anton Bobrov <abobrov@cloudlinux.com> 2.3-2
changelog:
  - KPT-2773: support update delay and sticky patchsets from kcarectl request
  - KPT-2855: rework selinux policies, deprecate kcare-eportal-selinux package
  - KPT-2931: counter links on the dashboard navigates to server list without active filter
  - KPT-2935: /install-kernelcare sets incorrect source for Debian repos


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.4-2
changelog:
  - KPT-2823 use python interpreter 3.8 for el7
  - KPT-2890 Make readonly user aware that he is read-only
  - KPT-2918 update sqlalchemy up to 2.x
  - KPT-2919 update the rest of python libs
  - KPT-2961 add distributions column to UI
  - KPT-3045 /set-kernelcare-repo script doesn't work for Ubuntu/ARM repos
  - KPT-3059 eportal: selinux policies break checkin processing with nginx 1.14
  - KPT-3075 update urllib3


author: Anton Bobrov <abobrov@cloudlinux.com> 2.5-3
changelog:
  - KPT-2514: provide more descriptive SSO errors
  - KPT-2888, KPT-2719: switch to the new public.list API
  - KPT-2967: tuxctl integration
  - KPT-3017: fetch and apply signatures bundle
  - KPT-3062: kcare-eportal-selinux is not removed automatically
  - KPT-3082: selinux policy is broken during upgrade
  - KPT-3170: fix kernelcare agent doctor uploads
  - KPT-3180: rebrand almacare into tuxcare ESU
  - security updates for 3rd party libraries


author: Anton Bobrov <abobrov@cloudlinux.com> 2.6-1
changelog:
  - KPT-2819: fix links to social media
  - KPT-3013: doctor script
  - KPT-3121: use /var/lib/eportal as default data location
  - KPT-3184: userspace usage on dashboard
  - KPT-3203: fix patchset management via API
  - KPT-3288: regular libs update
  - KPT-3321: standby replication


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.7-3
changelog:
  - KPT-2612: merge patch data databases
  - KPT-2998: send agents anomalies
  - KPT-3444: update copyrights


author: Anton Bobrov <abobrov@cloudlinux.com> 2.8-1
changelog:
  - Business Units feature (preview)
  - KPT-3490: make AUTH_RESTRICTED_INDEX enabled by default
  - KPT-3486: cleanup patch state with feed removal


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.9-2
changelog:
  - KPT-3366: add a note on `/admin/patch-source/` page to be more clear about filters.
  - KPT-3372: OAuth2 logout flow could require id_token_hint parameter for some providers.
  - KPT-3535, KPT-3471, KPT-3412: doctor fixes.
  - KPT-3558: Update link to tuxcare-release RPM in install-tuxcare.
  - KPT-3581: implement per BU counters on /admin/kckey/ page.
  - KPT-3591: replication monitoring and cluster management CLI improvements.
  - KPT-3592: CLI to get and restore full backups.
  - KPT-3595: register hosts with a valid access token.
  - KPT-3596: session cookie should be secure by default.
  - KPT-3598: update idna lib for eportal.
  - KPT-3623: login into BU via OAuth2 SSO.
  - KPT-3630: data export/import from admin UI.
  - KPT-3632: add filtering capability to /admin/api/servers by server_id.


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.10-1
changelog:
  - KPT-3685: fix wrong filtering parameters on feed page
  - KPT-3694: fix download missing patchsets doesn't work in cache mode
  - KPT-3722: fix patches page for a BU account
  - KPT-3739: backup and restore fixes
  - KPT-3741: fix duplicated sqlite files
  - KPT-3757: minor UI/UX changes, fix redirect after login
  - KPT-3811: use new tuxcare-release rpm
  - KPT-3815: update python libs
  - KPT-3862: fix libcare usage stat displaying
  - KPT-3902: warnings instead of tracebacks in logs if patchsource is not configured
  - KPT-3927: explicit select option for super-admin
  - KPT-3692: address overwrite option for agent installation script used by Eportal


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.11-1
changelog:
  - KPT-2214 add filter option on the patchset page to be able to filter patchset based upon Linux Distribution
  - KPT-3925 update thirdparty python libs


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.12-1
changelog:
  - KPT-3872,KPT-4174,KPT-4274 implemented DB migrations on the package downgrade
  - KPT-4018 added USE_LOCAL_TIMEZONE_FOR_API config option to use local time in API responses (it is false by default)
  - KPT-4082 fix - doctor report script does not respect eportal's config.PROXY value
  - KPT-4278 update thirdparty python libs
  - KPT-4193 fix - eportal returns 100 as an error code on a registration attempt
  - KPT-4159 fix - debian12 patches have to be enabled to turn on pve-8 patches
  - KPT-4175 fix - has no ubuntu24.04 as an option on Patch Source Settings page


author: Artem Murashkin <amurashkin@cloudlinux.com> 2.13-1
changelog:
  - KPT-3604: implement CSRF protection for Admin UI
  - KPT-4218, KPT-4220: new API endpoints for tags
  - KPT-4320: bulk server deletion API
  - KPT-4321: improve server mass deletion in Admin UI
  - KPT-4355: fix broken search on Servers page
  - KPT-4365: fix downgrade package scripts for non-standard BASE_DIR location


author: Artem Murashkin <amurashkin@cloudlinux.com> 2.14-1
changelog:
  - KPT-4377, KPT-4379, KPT-4380, KPT-4427, KPT-4433: implement API keys feature
  - KPT-4381: implement replication of servers bulk delete operation
  - KPT-4413: implement delete operations for keys and feeds in CLI
  - KPT-4434: fix patchsource configuration page broken by malformed URL
  - KPT-4437: advanced logging configuration example added to package
  - KPT-4456: fix settings Export/Import (CSRF token error)
  - update thirdparty python libs


author: Artem Murashkin <amurashkin@cloudlinux.com> 2.15-2
changelog:
  - KPT-4052: fix columns sorting in list views when BUNITS option is on
  - KPT-4219: [public API] tag_list filter for server list
  - KPT-4222, KPT-4224, KPT-4225, KPT-4558: implement server tagging in UI, new tag filters for servers
  - KPT-4539: fix wrong selinux operations order in package scriptlets
  - KPT-4543: fix None serialization in doctor.py


author: Artem Murashkin <amurashkin@cloudlinux.com> 2.16-2
changelog:
  - KPT-4044: update thirdparty python libs
  - KPT-4334: new CLI command "unroll" to uninstall and delete an arbitrary release
  - KPT-4578, KPT-4579, KPT-4657, KPT-4658: new Servers/Overview page with servers stats
  - KPT-4600: add "Tags" tab to server details view
  - KPT-4650: fix filtering by several tags in servers list
  - KPT-4662: update link to tuxcare-release RPM in install-tuxcare
  - KPT-4663: add Radar proxy configuration


author: Aram Danielyan <adanielyan@cloudlinux.com> 2.19-3
changelog:
  - KPT-4763: extend "List Patchsets" API in ePortal: support filtering by distro and include distro in the response
  - KPT-4831: switched ePortal to Python 3.12 for el8, el9 and docker image
  - KPT-4898: add AlmaLinux 10 platform support
  - KPT-4900: fix SELinux warnings during package install/upgrade
  - KPT-4924: show libcare usage statistics on the Servers/Overview page
  - KPT-4925: display the list of effective kernels on the Servers/Overview page
  - KPT-4945: fix incorrect mapping in the distributions filter for Ubuntu Noble
  - KPT-4946, KPT-4948: fix display issue with the list of distributions for undownloaded patchsets
  - KPT-4962: make Radar base URL configurable
  - Update third-party Python libraries


author: Anton Bobrov <abobrov@cloudlinux.com> 1.38-1
changelog:
  - KPT-2015: replication status CLI command for monitoring
  - KPT-1996: keep patchset name in kcservers table
  - KPT-2013: proxy pass to patches.kernelcare.com
  - KPT-2027: send ePortal instance os name with report
  - KPT-1990: added missing initial migration
  - KPT-2048: ensure database files has proper owner before applying migration
  - KPT-2037: 500 ServerError when creating key with the same name


author: Anton Bobrov <abobrov@cloudlinux.com> 1.39-1
changelog:
  - KPT-1997, KPT-1993: performance optimizations
  - KPT-2073: add config to disable index page view for non-admins
  - KPT-2083: add patchset/agent-version host counters in the report
  - KPT-2093: fix clean server tasks
  - KPT-2105: add feed/key counts in the report


author: Anton Bobrov <abobrov@cloudlinux.com> 1.41-1
changelog:
  - KPT-2200: add "key" field into server's detailed view and CSV export
  - KPT-2179: registration API endpoint with JSON interface
  - KPT-2132: send detailed stat counters for each release/kernel_id pair
  - KPT-2005, KPT-2146: eportal: store and send userspace checkin info in report


author: Anton Bobrov <abobrov@cloudlinux.com> 1.42-1
changelog:
  - KPT-1258: HTTP API to manage keys, feeds and patchsets
  - KPT-2220: update bundled sqlite to 3.39.4
  - KPT-2222: fix slow registration for instances with over 10k hosts
  - KPT-2223: send stat about number of autoupdated and delayed feeds
  - KPT-2224: fix ssl configuration to disable tls1.0/tls1.1 and enable tls1.3
  - KPT-2225: add parameter to configure an url to ePortal instance
  - KPT-2226: expose configuration params to scale ePortal instance
  - KPT-2241: add aggressive oplog cleanup mode for checkin operations
  - KPT-2248: use native pysqlite3 facility to backup databases
  - KPT-2252: add hostname to `kc.eportal server list` output


author: Anton Bobrov <abobrov@cloudlinux.com> 1.43-1
changelog:
  - KPT-2400: hide server version header
  - KPT-2303: HTTP API endpoint to set tags
  - KPT-2304: HTTP API endpoint to list users
  - KPT-2068: add missing distributions on Patch Source settings page


author: Anton Bobrov <abobrov@cloudlinux.com> 1.44-1
changelog:
  - KPT-2367: ability to limit keys to a set of products
  - KPT-2379: unmasked credentials (audit)
  - KPT-2380: fix xss in changelog endpoint (audit)
  - KPT-2382: host header injection (audit)
  - KPT-2383: increase minimal password length (audit)
  - KPT-2384: update JavaScript libraries (audit)
  - KPT-2385: limit login attempts rate (audit)
  - KPT-2396: add explicit cache control headers (audit)
  - KPT-2398: missing content security policy (audit)
  - KPT-2420: HTTP API endpoints should return proper error instead of 301 on invalid auth.
  - KPT-2428: proxy kc-doctor requests


author: Anton Bobrov <abobrov@cloudlinux.com> 1.45-1
changelog:
  - KPT-2462: handle registration replication lag
  - KPT-2510, KPT-2366: proxy to AlmaCare repos
  - KPT-2511: reconcile nodes state for replicated setups


author: Aram Danielyan <adanielyan@cloudlinux.com> 2.20-2
changelog:
  - KPT-5028 fix system_id validation in /patches/.+ api
  - KPT-5075 increase UWSGI buffer sizes
  - KPT-5140, KPT-5154 patches v3 support


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.21-1
changelog:
  - KPT-4572: added user-friendly error messages when deploying patchsets from files in cache mode
  - KPT-4993: upgraded urllib3 to version 2.5.0 for improved security (Note: Ubuntu 20.04 and CentOS 7
    continue using urllib3 1.26 for compatibility reasons)
  - KPT-5196: added drill-down functionality to Overview donut charts for enhanced data exploration
  - KPT-5197: made counters on the Servers page clickable for improved navigation and usability
  - KPT-5198: added comprehensive LibCare installation notes to the documentation page
  - KPT-5199: prevented users from accidentally removing their own accounts through the UI
  - KPT-5304: reduced excessive logging in replication logs to improve readability
  - KPT-5305: discontinued DBCare support
  - KPT-5310: fixed package downgrade functionality for DEB-based systems
  - KPT-5316: implemented immediate process shutdown when receiving system signals


author: Artem Murashkin <amurashkin@cloudlinux.com> 2.22-1
changelog:
  - KPT-3942: improved API error handling for invalid patchset IDs
  - KPT-5087, KPT-5435: enhanced error handling by pushing ePortal tracebacks to the patchserver (disabled by default)
  - KPT-5299: added a filter for the Usage column to show only patchset that are in use
  - KPT-5300: blocked or frozen releases are now visible as "Blocked", with audit logging and modification restrictions
  - KPT-5301: fixed an issue where the ePortal admin could not disable a release until it was fully deployed
  - KPT-5399: updated third-party libraries for improved stability and compatibility
  - KPT-5408: fixed issue where the ePortal admin had no control over releases disabled on the patchserver
  - KPT-5412: improved FIPS compliance by updating digest methods in Flask-related code
  - KPT-5459: fixups-only releases are now deployed automatically and hidden from the UI, with audit logging
  - KPT-5481: fixed Radar proxy to respect ePortal proxy settings


author: Mikhail Alekseev <malekseev@cloudlinux.com> 2.22-4
changelog:
  - KPT-5559: added configurable timeout and retry logic for patch source requests
  - KPT-5687: added dynamic timeout adjustment for large file uploads
  - updated pyasn1, urllib3, werkzeug libraries to fix security vulnerabilities


author: Mikhail Alekseev <malekseev@cloudlinux.com> 3.0-3
changelog:
  - KPT-5529: redesigned admin UI with new custom pages replacing Flask-Admin
  - KPT-5566: improved request validation with Pydantic schemas
  - KPT-5478: fixed unauthorized patch delivery to unregistered servers
  - KPT-5772: added patching error status display on the server details page
  - KPT-5777: added "latest" patch status indicator on the Servers page
  - KPT-5797: added bulk cleanup of stale and never-checked-in servers
  - KPT-5791: added configurable OIDC email claim name for SSO login
  - KPT-5776: added oplog database to doctor report for improved diagnostics
  - KPT-5723: added EPORTAL_* environment variables to doctor report
  - KPT-5734: fixed KeyError in doctor report when collecting patches info
  - updated third-party Python libraries


author: Mikhail Alekseev <malekseev@cloudlinux.com> 3.1-1
changelog:
  - KPT-5327, KPT-5830, KPT-5965: upgraded Bootstrap to 5.x, updated Vue.js to 3.5.
  - KPT-5644: completely removed flask-admin code, custom template overrides, and
    the OLD_ADMIN_UI config parameter
  - KPT-5795: updated SQLite to 3.51.3 and pysqlite3 to 0.6.0, resolving all
    previously suppressed CVEs
  - KPT-5831: added a UI button to send a doctor report directly from the admin
    interface
  - KPT-5839: agents are now locked on their current patchset when a matching fixup
    is required, preventing unpatch failures until the fixup becomes available
  - KPT-5857: Ubuntu 26.04 (Resolute) support. ePortal can now be installed and run
    on Ubuntu 26.04 (Resolute).
  - KPT-5884: when the OIDC userinfo endpoint lacks the configured email claim,
    ePortal now falls back to id_token claims
  - KPT-5913: the servers CSV export now includes the kcare_version column
  - KPT-5968: show Ubuntu 24.04 in the list of available distros
  - KPT-5969: apply usage filter on servers-list links
  - KPT-6010: updated nginx to 1.30.2 in the Docker image
  - KPT-6019: hide delete buttons for read-only clients
  - KPT-6041: fixed API key expiration dates displaying in the wrong timezone on
    the API Keys admin page
  - updated third-party Python libraries


author: Mikhail Alekseev <malekseev@cloudlinux.com> 3.1-2
changelog:
  - KPT-6049: fixed bulk-delete on the Servers page ignoring the active
    quick-search filter, which could delete all servers in the unit instead of
    the filtered selection


author: Mikhail Alekseev <malekseev@cloudlinux.com> 3.2-1
changelog:
  - KPT-5966: resize table columns to fit your content; column widths are
    now remembered per user
  - KPT-5967: filter and sort the Servers list by patch status
  - KPT-6048: feeds whose name contains a "/" can now be edited and deleted
    per-row (previously they could be created but not modified)
  - KPT-6051: accept patchset names with 4-digit identifiers; existing
    names keep working
  - KPT-6072: respect per-kernel deployment settings from the patch server,
    so kernels disabled for a release are no longer deployed to servers


author: Mikhail Alekseev <malekseev@cloudlinux.com> 3.3-3
changelog:
  - KPT-5859, KPT-6410: The releases page now shows the exact kernel flavors on
    hover, in addition to the groups of distros it lists for each patchset.
  - KPT-6131: Restoring saved table column widths no longer breaks the page
    layout.
  - KPT-6158: Registration endpoints now respond uniformly and are rate-limited,
    preventing them from being used to probe for valid license keys.
  - KPT-6159: The feed list at /admin/api/feed-names now respects
    AUTH_RESTRICTED_INDEX and is no longer publicly readable without
    authentication.
  - KPT-6190: Transient patch-source errors are now retried automatically instead
    of failing the request immediately.
  - KPT-6192: The agent registration token lifetime is now configurable for
    token-based registration.
  - KPT-6194: Check-in values (IP address, server ID, hostname) can now be
    reported in plain text instead of hashed.
  - KPT-6220, KPT-6405, KPT-6406, KPT-6407, KPT-6458: A release deployed from a
    local archive is now correctly replicated to follower nodes, and stays listed
    in the web UI when a patch source is configured.
  - KPT-6227: TuxCare replaces CloudLinux throughout the UI, EULA, and copyright
    notices.
  - KPT-6228: QemuCare is no longer offered in the UI.
  - KPT-6306, KPT-6390: Maintenance operations now wait for any in-flight deploy
    to complete before proceeding, preventing race conditions that could delete a
    freshly-deployed patchset or leave a release corrupted mid-unpack. Affected
    operations: cleaning up obsolete releases, deploying a patchset from a local
    file, unrolling a patchset, and unpacking a patchset fetched by
    download-missing.
  - KPT-6324, KPT-6413: Third-party dependencies updated to address known
    vulnerabilities -- includes bundled Python libraries, SQLite, and the
    container image's OS packages.
  - KPT-6364: With business units enabled, the admin area correctly applies its
    Content-Security-Policy header and login rate limit.
  - KPT-6368: An unknown business-unit URL now returns a proper 404 instead of a
    500 error with a traceback.
  - KPT-6392: The /patch-download/ endpoint now requires a credential (basic
    auth, API key, or replication shared key). Anonymous archive downloads are
    refused by default. To continue serving anonymous downloads while migrating
    callers to credentials, set AUTH_RESTRICTED_ARCHIVES=False.


author: Anton Bobrov <abobrov@cloudlinux.com> 1.34-1
changelog:
  - KPT-1934: flag to skip strict certificate check for replication requests
  - KPT-1935: pass external balancer proto scheme to private nginx instance
  - KPT-1945: ability to specify hour in age filters for /api/admin/servers


author: Anton Bobrov <abobrov@cloudlinux.com> 1.36-1
changelog:
  - KPT-1936: add instance-id of a leader node to report
  - KPT-1949: fix status code in host registration HTTP API
  - KPT-1958: use tab separated values in table outputs for CLI commands, extend user list output
  - KPT-1959: added `kc.eportal user` subcommand to manage users, added option to specify user role instead of toggle
  - KPT-1968: CLI command to sync nginx config with ePortal config to make nginx serve patches from non-standard location
  - KPT-1969: ability to search servers by tag in HTTP API
  - KPT-1972: log additional details for replication errors
  - KPT-1987: WebSeal auth


author: Anton Bobrov <abobrov@cloudlinux.com> 1.37-1
changelog:
  - regression: scheduler in 1.36 doesn't start
  - KPT-2032, KPT-2031: ensure correct path to custom patch storage and nginx cache
  - KPT-2008: fix broken links to patches on index page if there is no selected feed
  - KPT-1757: fix misleading message if `kcarectl --license-info` invoked without registration
  - KPT-1982: `kc.eportal server clean --inactive` command and opt-in auto server cleanup


author: Igor Seletskiy <iseletsk@kernelcare.com> - 1.1.0-1
changelog:
  - Added support for raw_xml_v2 report format
  - Weakened SSL checks
  - Fixed ns-xml format when CVE is in upper case


author: Igor Seletskiy <iseletsk@kernelcare.com> - 1.1.4-1
changelog:
  - if we cannot get report_format from report_config, get it from script config
  - or default to raw-xml-v2
  - add support for parsing new format/longer CVE numbers


author: Igor Seletskiy <iseletsk@kernelcare.com> - 1.2.0-1
changelog:
  - Added ability to delete old exceptions by specifying delete_old in yaml config file
  - Improved SSL handing for python 2.7 and higher


author: Igor Seletskiy <iseletsk@kernelcare.com> - 1.2.4-1
changelog:
  - Remove spaces around hostnames
  - Display number of nodes matched
  - Show if hostnames are used to match hosts


author: Ralph Bean <rbean@redhat.com> - 0.6.6-1
changelog:
  - Latest upstream.
  - Modernized python macros.
  - Re-enabled python3 tests.
  - Cleaned up the description formatting.


author: Ralph Bean <rbean@redhat.com> - 0.7.4-2
changelog:
  - Merge in epel7 compat changes to the spec file.
  - Drop patch for epel7, no longer needed with modern upstream.


author: Ralph Bean <rbean@redhat.com> - 0.7.6-3
changelog:
  - Disable tests until sqlalchemy-1.1 is out.  There's a bug against
    MS sql DBs (likely won't affect us).


author: Ralph Bean <rbean@redhat.com> - 0.4-4
changelog:
  - Merge branches together and bump release for bodhi updates.
  - Removed empty %check section.
  - Fix incorrect usage of %{pypi_name}.


author: Tim Flink <tflink@fedoraproject.org> - 2.0-1
changelog:
  - Upgraded to upstream 2.0
  - Enhanced internal signal control, made more customizable and less global to play nice with non-flask-sqlalchemy sessions


author: Ralph Bean <rbean@redhat.com> - 1.1.0-1
changelog:
  - Latest upstream.
  - Relicense to ASL 2.0 with upstream.
  - Removed cookie handling patch (fixed in upstream tarball).
  - Updated cert unbundling patch to match upstream.
  - Added check section, but left it commented out for koji.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-2
changelog:
  - Unbundled python-charade/chardet.  Using system python-chardet now.
  - Removed deprecated comments and actions against oauthlib unbundling.
    Those are no longer necessary in 1.1.0.
  - Added links to bz tickets over Patch declarations.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-3
changelog:
  - Unbundled python-urllib3.  Using system python-urllib3 now.
  - Conditionally include python-ordereddict for el6.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.3.0-8
changelog:
  - Python 2 binary package renamed to python2-flask-login
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


