- new version 1.10.3

- New version (1.20.13).

- Backported to c9f2.

- New version 1.25.0.

- Rename the package to include major and minor versions.

- 1.25.15 -> 1.25.16 (Fixes: CVE-2023-5528)

- 1.26.14

- Add parameters to macros

- Initial build.

- New version 0.5.48.

- Backported to c9f2.

- New version 9.5.13
- This release fixes several security issues that have been recently discovered. Update is recommended!
- Security fixes:
 + CVE-2023-28632 : Account takeover by authenticated user
 + CVE-2023-28838 : SQL injection through dynamic reports
 + CVE-2023-28852 : Stored XSS through dashboard administration
 + CVE-2023-28636 : Stored XSS on external links
 + CVE-2023-28639 : Reflected XSS in search pages
 + CVE-2023-28634 : Privilege Escalation from technician to super-admin
 + CVE-2023-28633 : Blind Server-Side Request Forgery (SSRF) in RSS feeds

- NMU: new version 8.7.1 (with rpmrb script)
- rebuild with new libvips 8

- Backport to c9f2.

- Backport to c9f2.

- automated CPAN update

- 2.42.0 -> 2.42.1 (closes: #47999).

- e2k: inline without static leads to a link error on the EDG frontend.

- Applied security fix from Debian (Fixes: CVE-2018-1000825).
- Updated license tag.

- fixed systemd unit (Closes: #49359)

- Fixed arbitrary command execution via a tag file with
  a crafted filename (fixes CVE-2022-4515).

- Added patches from debian and fix vulnerabilities (Fixes: CVE-2017-15371,
CVE-2019-8355, CVE-2021-33844, CVE-2017-15370, CVE-2019-8356, CVE-2021-3643,
CVE-2017-11332, CVE-2019-8357, CVE-2021-40426, CVE-2017-11359, CVE-2023-32627,
CVE-2022-31650, CVE-2017-15372, CVE-2017-11358, CVE-2022-31651, CVE-2017-15642,
CVE-2019-13590, CVE-2019-8354, CVE-2021-23159):
    + fixed hcom big endian
    + fixed resource leak comments
    + fixed resource leak hcom
    + added handle vorbis analysis headerout errors
    + added wavpack check errors
    + added xa validate channel count

- Fix side-channel in the deterministic ECDSA (fixes: CVE-2024-28834).
- tests: Add test for CVE-2024-28835.
- rsa-psk: minimize branching after decryption (fixes: CVE-2024-0553).
- x509: detect loop in certificate chain (fixes: CVE-2024-0567).

- new version 0.4 (fixes: CVE-2017-14232, CVE-2018-10971,
  CVE-2018-11507, CVE-2018-12109, CVE-2018-14876, CVE-2019-14373)

- 2.4.2 (Fixes: CVE-2012-6687)

- 0.3.23 -> 0.3.26.

- NMU: 2.1.28 (Closes: #49511)

- backport to c9 branch new version.

- Add knob for building without python.

- new version 4.12.1 (with rpmrb script)

- Updated to upstream version 1.2.2 (Fixes: CVE-2019-13045, CVE-2019-15717).

- Updated to upstream version 1.4.2 (Fixes: CVE-2020-24361).

- Updated to upstream version 1.93.

- 1.20.5

- new version 1.48.0 (with rpmrb script)
- CVE-2024-24806

- 1.3.3 released

- New version (3.98).
- Certificate Authority Changes:
  + Add CN=D-Trust SBR Root CA 1 2022
  + Add CN=D-Trust SBR Root CA 2 2022
  + Add CN=Telekom Security SMIME ECC Root 2021
  + Add CN=Telekom Security SMIME RSA Root 2023
  + Add CN=Telekom Security TLS ECC Root 2020
  + Add CN=Telekom Security TLS RSA Root 2023

- New version 6.9.12.93 (Fixes: CVE-2022-44268)

- 3.75

- Fixed build on 64-bit arches
- Minor spec cleanup

- Build without libgnustep-objc2-devel.
- Build on aarch64 architectire.

- Remove redundant clang-devel for build

- 1.5.10

- Add info about CVE to changelog.

- Reverted upstream commit "patch 9.1.0041: xxd -i may generate incorrect C
  statements" to fix regression in xxd -i output (ALT#49180).

- Fixed different signedness comparison on 32bit systems.
- Dropped obsoleted patches.
- Patches from upstream git:
  + Add missing CHANGELOG entries for 2.90;
  + Fix spurious "resource limit exceeded" messages.
- Updated to 2.90 (fixes: CVE-2023-50387,CVE 2023-50868).

- 8.5.0 -> 8.6.0
- Fixes:
   * CVE-2024-0853 : OCSP verification bypass with TLS session reuse

- New version.

- 0.16.3

- update to new version.

- 0.1.2

- 2021.5

- Eliminate missing -rfbwait option

- new version
- update shim-15.8-alt-Bump-grub-SBAT-revocation-to-4 patch
- Fixes:
  + CVE-2023-40546 mok: fix LogError() invocation
  + CVE-2023-40547 - avoid incorrectly trusting HTTP headers
  + CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system
  + CVE-2023-40549 Authenticode: verify that the signature header is in bounds.
  + CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat()
  + CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries

- Fixes CVE-2023-5455.

- 0.79.18 -> 0.79.19.

- auth/rsa_psk: side-step potential side-channel (fixes: CVE-2023-5981).

- Backported upstream security fix for Terrapin attack (fixes CVE-2023-48795).

- 1.4.5.

- Backport to c9.

- Updated to latest upstream snapshot

- new version (fixes: CVE-2017-18926 CVE-2020-25713) (closes: 48916)

- 8.4.0 -> 8.5.0
- Fixes:
   * CVE-2023-46218: cookie mixed case PSL bypass
   * CVE-2023-46219: HSTS long file name clears contents

- Drop devel-static subpackage.

- New version.

- 3.6.4 (Fixes: CVE-2023-49284)