- 2.0.0 (Fixes: CVE-2023-4504)

- New version.
- Security fixes:
  + CVE-2023-42822: Unchecked access to font glyph info

- 3.1.17 (fixed CVE-2023-42464, CVE-2022-23121, CVE-2022-23123,
   CVE-2022-43634 and CVE-2022-45188)
- Add /etc/netatalk/afppasswd (Closes: #46445)
- Add /var/lib/netatalk (Closes: #46441)
- Add Requires: cracklib-words (Closes: #46446)

- 9.16.42 -> 9.16.44 (fixes: CVE-2023-3341).

- Updated to 3.1.3 (fixes CVE-2023-4807).

- 8.2.1 -> 8.3.0
- Fixes:
   * CVE-2023-38039 HTTP headers eat all memory
- relaxed check on armh

- 8.0.29 -> 8.0.30 (Fixes: CVE-2023-3823, CVE-2023-3824)
- for sisyphus and p11: added conflicts with the installer-stage3 to avoid
  using php8.0 in distributios: The first stage of EOL plan

- 1.3.2 (fixed CVE-2023-4863)

- Updated to v9.0.1893 (fixes CVE-2023-4781, CVE-2023-4752, CVE-2023-4750,
  CVE-2023-4733, CVE-2023-4738, CVE-2023-4736, CVE-2023-4735, CVE-2023-4734).

- 7.0.12
- Fixed License
- Split cli tools to cli subpackage
- Update systemd units
- Update default sentinel config
- Build with systemd support sd_notify
- /var/run -> /run
- Fixed logrotate config
- Fixed permissions for configs
- Move make test to check section
- Enable tests
- Security fixes:
  + CVE-2022-24834 Integer Overflow to Buffer Overflow, Heap-based Buffer Overflow
  + CVE-2022-31144 Out-of-bounds Write, Heap-based Buffer Overflow
  + CVE-2022-33105 Missing Release of Memory after Effective Lifetime
  + CVE-2022-35951 Integer Overflow or Wraparound
  + CVE-2022-35977 Integer Overflow or Wraparound
  + CVE-2022-36021 Inefficient Algorithmic Complexity
  + CVE-2023-22458 Integer Overflow or Wraparound
  + CVE-2023-25155 Integer Overflow or Wraparound
  + CVE-2023-28425 Improper Neutralization of Special Elements used in a Command (Command Injection)
  + CVE-2023-28856 Reachable Assertion
  + CVE-2023-31655 Insufficient Information
  + CVE-2023-36824 Heap overflow in COMMAND GETKEYS and ACL evaluation

- New version 1.5.3 (Fixes: CVE-2023-30575, CVE-2023-30576).

- 1.21.2 (Fixes: CVE-2023-39975)

- new version 1.40.0 (with rpmrb script)
- disable AutoReq
- (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.
- (T335203, CVE-2023-29197) Upgrade guzzlehttp/psr7 to >= 1.9.1/2.4.5.
- (T335612, CVE-2023-36674) Manualthumb bypasses badFile lookup.
- (T332889, CVE-2023-36675) XSS in BlockLogFormatter due to unsafe message use.

- Support for OpenSSL 3 (to access Blowfish encryption).
- Apply fixes to bundled yajl (CVE-2023-33460, CVE-2022-24795, CVE-2017-16516).

- New version 10.0.9
- This release fixes several security issues that has been recently discovered. Update is recommended!
- Security fixes:
 + CVE-2023-37278 : SQL injection in dashboard administration
- Deleted glpi-php7

- New version (633).
- Security fixes:
  + CVE-2022-46663: less -R filtering bypass.

- 1.2.24
- Fixes:
  + CVE-2022-46169 Unauthenticated Command Injection
- switched to php8.0 by default

- New version (3.0.0).
- Fixes:
  + CVE-2023-2804 Various segfaults and buffer overruns

- E2K:
  + added mcst patches, mostly as-is except:
    - 0003-Add-copy-optimizations.patch: partially obsolete
    - 0006-Add-bug-workaround.patch: obsolete for arch > e2kv2
    - 0010-Restore-DRI1-support.{add,mod}.patch: need more reverts
    - 0040-Fix-CVE-2018-14665.patch: applied elsewhere upstream
    and specifically, including:
    - 0010-restore-DRI1-support-for-e1c.patch
    - mga2 related patch from mcst#5155
  + warning-related ftbfs workarounds
  + bool-related ftbfs workaround (ilyakurdyukov@)

- fixes CVE-2023-33460.

- New version 0.9.6 (Fixes: CVE-2023-1017, CVE-2023-1018).

- New version 3.0.3
- Security fixes:
 + CVE-2021-46743 : Firebase PHP-JWT key/algorithm type confusion
 + CVE-2022-31403 : XSS vulnerability via /itop/pages/ajax.render.php
 + CVE-2022-31402 : XSS vulnerability via /itop/webservices/export-v2.php
- Added itop-php8.0
- Deleted itop-php7

- 2.29.0 -> 2.31.0 (fixes: CVE-2023-32681).

- 2.10.4 (Fixes: CVE-2023-29469, CVE-2023-28484)

- 2.33.7 -> 2.33.8 (fixes: CVE-2023-25652, CVE-2023-25815, CVE-2023-29007).

- Autobuild version bump to 10.01.1
- (Fixes: CVE-2023-28879)

- Fixed arbitrary command execution via a tag file with
  a crafted filename (fixes CVE-2022-4515).

- 1.10.3.
- switch to meson.
- Security fixes for CVE-2020-11721, CVE-2020-19668.

- 1.1.4 (Fixes CVE-2023-27478)
- Change URL to new upstream project
- Use CMAKE

- Added patches from upstream git:
  + Avoid undefined behaviour with the ctype(3) functions
  + Fix --rev-server option
  + Fix possible SEGV when no servers defined
  + Set the default maximum DNS UDP packet size to 1232
    (fixes: CVE-2023-28450)
  + Fix DHCPv6 "use multicast" response which previously failed

- 1.14.4 (fixed CVE-2023-28100, CVE-2023-28101)

- 0.103.8 (CVE-2023-20032, CVE-2023-20052)

- 4.0.1 (Fixes: CVE-2023-22745)

- (Fixes: CVE-2022-3534, CVE-2022-3606).

- (Fixes: CVE-2022-47016).

- 3.5.15 (fixes: CVE-2022-46285, CVE-2022-44617, CVE-2022-4883)

- cherry pick upstream fixes for CVE-2018-19876, CVE-2020-35492

- Fixed libssl knob.
- Fixed License tag.
- Added Vcs tag.
- Patch from upstream:
  + Fixed crash when st_info_list is NULL (fixes: CVE-2022-4121).

- new version 0.9.8 (with rpmrb script)
- CVE-2021-30469, CVE-2021-30470, CVE-2021-30471, CVE-2021-30472

- security (fixes: CVE-2022-36227)

- apply upstream commit a1f88e842e0216a5b4df1ab023caebe33c101395
  to fix CVE-2022-44638

- 7.4.32 -> 7.4.33 (Fixes: CVE-2022-31630, CVE-2022-37454)

- rename patch lib-DBD-File.pm-fix-CVE-2014-10401.patch
- fixes changelog

- Updated to 2.5.0 (fixes: CVE-2022-43680 Fix heap use-after-free after
  overeager destruction of a shared DTD in function XML_ExternalEntityParserCreate
  in out-of-memory situations, DoS or potentially ACE).

- security (fixes: CVE-2020-29260)

- Fixes patch CVE-2015-0557-security-traversal-dir (ALT #44143).

- Add support LDAP add/mod operation to set/change password:
 + fix unable to join to active directory after KB5008380/CVE-2021-42287 with
   option '--ldap-passwd';
 + https://gitlab.freedesktop.org/realmd/adcli/-/issues/27
- Add support fall back to LDAPS if CLDAP ping was not successful
 + If the --use-ldaps option is used and there is no reply on the CLDAP 389/udp
   port adcli will try to send the request to the LDAPS port 636/tcp.
- Fix write SID before secret to Samba's db looks like 'net changesecretpw'
- Add passwd-user sub-command for (re)set a user password.
- Add dont-expire-password option for computer.

- fixes CVE-2019-25051

- fixes CVE-2018-10195.

- fixes CVE-2021-4217

- Updated to 4.4.3-P1 (fixes: CVE-2022-2928,CVE-2022-2929).

- 0.25.4 (fixed CVE-2022-37706)

- Update to DROPBEAR_2022.82 (2022-04-01). (Fixes: CVE-2018-15599,
  CVE-2018-5399, CVE-2018-20685, CVE-2019-12953, CVE-2020-15833,
  CVE-2020-36254).
- Disable DSS keys.
- Allow password auth.
- Undo authkey_fp patch (as it does not apply to the new codebase).
- Use bundled libtom{crypt,math} maintained by the authors of Dropbear.
- Doc and client packages are merged into main package.
- Add systemd services.
- Correct sftp-server path (to openssh-server binary).

- Version bump
- Many bugfixes, including security, including:
  Fixes: CVE-2022-24106, CVE-2022-27135

- Autobuild version bump to 6.1.7
- Fixes: CVE-2022-30333

- 2.5.0 (fixed CVE-2013-4289, CVE-2013-4290, CVE-2019-6988, 
  CVE-2018-20846, CVE-2018-16376, CVE-2021-29338)

- New version.
- Security fixes:
  + CVE-2021-28544 Subversion servers reveal copyfrom paths that should be hidden according to configured path-based authorization (authz) rules.
  + CVE-2022-24070 mod_dav_svn is prone to a use-after-free vulnerability when looking up path-based authorization rules, which can result in denial of service (crash of HTTPD worker handling the request).

- NMU (fixes: CVE-2021-4034).
- Applied upstream fix for a trivially exploitable local root vulnerability,
  see https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

- new version 1.41 (Fixes: CVE-2022-23096, CVE-2022-23097, CVE-2022-23098)

- 2.1.38 -> 2.1.39 (fixes for CVE-2021-42097 and CVE-2021-44227).

- Applied SUSE combchar.diff to prevent DoS via crafted UTF-8 character
  sequence (fixes CVE-2021-26937).

- 0.2.5 (fixed CVE-2021-39358)

- New version (Fixes: CVE-2020-15158).

- fix build, apply patches from upstream
- .service: use /run instead of /var/run
- CVE-2021-32749

- 3.2.8 (fixes: CVE-2021-33582)

- E2K: apply mcst patches, including CVE-2018-6621 fix

- new version (1.3.0) with rpmgs script
- CVE-2020-9382, CVE-2020-35625

- avoid infinite-loop in avahi-daemon (closes: #39357) (fixes: CVE-2021-3468)

- Applied security fix from upstream (Fixes CVE-2018-16789).

- Applied security fix from upstream (Fixes CVE-2018-8754).

- Applied security patches from Debian and Gentoo (Fixes: CVE-2014-0466, CVE-2015-8107).

- Updated to upstream version 0.32.3 (Fixes: CVE-2017-5208,
  CVE-2017-5331, CVE-2017-5332, CVE-2017-5333).

- Applied security patch from Gentoo (Fixes: CVE-2017-9430).

- Updated to upstream version 1.2.1 (Fixes: CVE-2018-16741, CVE-2018-16742,
  CVE-2018-16743, CVE-2018-16744, CVE-2018-16745, CVE-2019-1010189, CVE-2019-1010190).

- Applied security fix from upstream (Fixes: CVE-2019-14495).

- Updated to upstream version 1.18.0 (Fixes: CVE-2017-5991, CVE-2018-10289,
  CVE-2018-16647, CVE-2018-16648, CVE-2019-14975, CVE-2020-26519).

- Updated to upstream version 1.2.2 (Fixes: CVE-2019-13045, CVE-2019-15717).

- Applied security patch from Fedora (Fixes: CVE-2019-19917, CVE-2019-19918)

- Updated to upstream version 0.19 (Fixes: CVE-2016-9601, CVE-2020-12268).

- 1.2.3
- securuty fixes: CVE-2016-7951, CVE-2016-7952

- 0.9.10
- securuty fixes: CVE-2016-7949, CVE-2016-7950

- Switched to CVE-2008-4935 fix from Debian.
- Added -Werror=implicit-function-declaration compiler flag.

- Updated to version 1.76 from Debian (Fixes: CVE-2009-1382, CVE-2009-2459).

- Cleaned up sources by importing sources from Debian.
- Forced using system build flags.
- Updated fix for CVE-2015-2063.

- Applied patches from Debian (Fixes: CVE-2013-4420).

- Applied patches from Debian (Fixes: CVE-2014-8123).

- Applied patches from Gentoo (Fixes: CVE-2015-8836, CVE-2015-8837).

- Updated to upstream version 1.2.2 (Fixes: CVE-2017-15953, CVE-2017-15954, CVE-2017-15955).

- Updated to upstream version 1.4.2 (Fixes: CVE-2020-24361).

- Updated to upstream version 2.0.29 (Fixes: CVE-2019-20917, CVE-2020-25269).

- Applied patches from Debian (Fixes: CVE-2005-3178).

- Applied patches from Debian and Gentoo (Fixes: CVE-2005-2536, CVE-2006-5869).
- Build now respects %optflags.

- Applied security fix from Debian (Fixes: CVE-2018-1000825).
- Updated license tag.

- Applied security fix from Gentoo (Fixes: CVE-2017-8364)

- Applied security fixes from upstream (Fixes: CVE-2018-9159)

- Secutity (Fixes: CVE-2015-0848, CVE-2015-4588, CVE-2015-4695,
  CVE-2015-4696, CVE-2016-9011)

- CVE-2015-1200 fix (patch from debian bug #775306)

- really update sources to 2.3.4 fixes (CVE-2012-3478 and CVE-2012-2252)
- add patch for rsync3 compat