- Update to latest stable release of Valkey 9.0
- Security fixes (Fixes: CVE-2026-23479, CVE-2026-25243, CVE-2026-23631).

- 8.6.4 (Fixes: CVE-2026-23479, CVE-2026-25243, CVE-2026-23631).

- Update to security release of Samba 4.22
- Revert DRS replication fixes and improvements (enforcing schedules and
  WERR_DS_DRA_NO_REPLICA handling) for more comprehensive integration testing.
- Security fixes (Fixes: CVE-2026-1933, CVE-2026-2340, CVE-2026-3012,
                         CVE-2026-3238, CVE-2026-4408, CVE-2026-4480):
  + CVE-2026-1933: Lack of access control on reparse points.
                   https://www.samba.org/samba/security/CVE-2026-1933.html
  + CVE-2026-2340: WORM vfs module allows file overwrite.
                   https://www.samba.org/samba/security/CVE-2026-2340.html
  + CVE-2026-3012: Insufficient certificate verification during auto-enrollment.
                   https://www.samba.org/samba/security/CVE-2026-3012.html
  + CVE-2026-3238: NULL pointer dereference in AD DC WINS server.
                   https://www.samba.org/samba/security/CVE-2026-3238.html
  + CVE-2026-4408: Remote code execution via check password script.
                   https://www.samba.org/samba/security/CVE-2026-4408.html
  + CVE-2026-4480: Remote code execution via print command.
                   https://www.samba.org/samba/security/CVE-2026-4480.html

- Add pam_canonicalize_user control enabled by default.

- Update to latest 2.12 release.
- New features and improvements:
  + Passkey (WebAuthn/FIDO2) support - authentication using security keys,
    integrated with PAM and Kerberos preauthentication.
  + OIDC/IdP provider - new identity provider supporting OAuth2/OIDC
    authentication flows (sssd-idp package) for Entra ID and Keycloak.
  + DoT (DNS over TLS) support for dynamic DNS updates.
  + Plasma Login Manager support as a PAM service.
  + sss_ssh_knownhosts - improved tool replacing legacy sss_ssh_knownhostsproxy.
  + IPA provider now supports IPA subdomains, enabling IPA-IPA Trust.
  + IPv6 fallback: automatically switch to secondary IP family if the
    primary is blocked by firewall.
  + Kerberos: automatic creation of krb5 configuration snippet on startup.
- Security hardening:
  + SSSD services can now run fully unprivileged using file capabilities
    instead of SUID bits (including p11_child).
  + Changed 'ldap_id_use_start_tls' default value to true to prevent
    unintentional plaintext communication.

- New version for samba-4.22

- Update to release for samba-4.22.0

- Update to latest release for samba-4.22

- Updated to 0.9.35.
- Major fixes from upstream (basically from 0.9.34):
  + fix race condition freeing spilled pages at end of transaction (ITS#9564)
  + fix memleak in mdb_txn_begin for nested txns (ITS#10342)
  + fix mdb_env_copy2 with values > (2GB-16) (ITS#10346)

- Initial build for Sisyphus

- update to latest release 3.18.1
- build with libuirng (fuse-over-io-uring communication)
- rename libfuse3 to libfuse3_4 according to Shared Libs Policy
- add libfuse3 provide to fuse3 to preserve compatibility with legacy
  circular dependency

- build compatibility library libfuse3_3 with libfuse3.so.3 and
  libfuse3.so.3.16.2 files only according to Shared Libs Policy

- new version (4.7.1) with rpmgs script
- rebuild with libmariadb instead of libmysqlclient

- system-check-localuser.control: local user detection method.
- system-auth-chooser (closes: #53858):
  + update system UID validation range (from UID < 500 to UID < 1000)
  + extract local user check into separate module system-check-localuser
  + add systemd dynamic user support
  + add detailed in-file documentation

- Fix apt-gpgkeys utility (closes: 57005).
- Fix filetrigger execution access (closes: 57006).

- Automatically updated to 0.21.

- Update to latest stable bugfix and security release
  (upstream fix of CVE-2025-32462, CVE-2025-32463 applied in 1.9.16p2-alt3):
 + Fixed a crash in sudo which could occur if there was a fatal error after the
   user was validated but before the command was actually run.
 + Fixed a problem with the pwfeedback option where an initial backspace would
   reduce the maximum length allowed for the password (GitHub#439).
 + Fixed a bug where a user could avoid entering a password for sudo -l command
   if they specified their own user or group name via the -u or -g options.
 + Avoid potential password guessing based on timing attacks on the strcmp()
   function on systems without PAM or a crypt() function where plaintext
   passwords are stored in the shadow password file.
 + Fixed a potential information leak where sudo -l command could be used to
   determine whether an executable exists in a directory that they do not have
   search access to.
 + Fixed a problem running sudo from a serial console on Linux when the command
   is run in a pseudo-terminal (the default).
 + Fixed a bug where the ALL command in a sudoers rule would override a previous
   NOSETENV tag. Command tags are inherited from previous Cmnds in a
   Cmnd_Spec_List. There is a special case for the SETENV tag with the ALL
   command, where SETENV is implied if no explicit SETENV or NOSETENV tag is
   specified. This special case did not take into account that a NOSETENV tag
   that was inherited should override this behavior.
- Fixes in behavior:
 + The ignore_dot sudoers setting is now on by default.
 + If sudo is run via ssh without a terminal and a password is required, it now
   suggest using ssh's -t option.
 + Sudo uses TCSAFLUSH, not TCSADRAIN, when disabling echo once again. A long
   time ago sudo changed from using TCSAFLUSH to TCSADRAIN due to some systems
   having bugs related to TCSAFLUSH. That should no longer be a concern. Using
   TCSAFLUSH ensures that password input that has been received by the kernel,
   but not yet read by sudo, will be discarded and not echoed.
 + Added the SUDO_TTY environment variable if the user has a terminal. This can
   be used to find the user's original tty device when sudo runs the command in
   its own pseudo-terminal (GitHub#447).

- NMU: fixed FTBFS

- Updated to new version 1.3.2 (released 2025-07-24)
- Fixes from upstream:
  + Fixed binding the getresgid glibc symbol

- Updates to new version 1.5.0 (released 2025-05-06)
- Fixes from upstream:
  + Added support for quic_ko_wrapper
  + Fixed pcap frames generation for recv(m)msg and recvfrom
  + Fixed setsockopt(SO_REUSEPORT) with glibc 2.40 (from version 1.4.4)

- 4.8.0 -> 5.1.0

- Update to latest stable release.
- Major fixes from upstream:
  + Security enhancements including support for password rotation, better
    credential management, and namespaces.
    * getcifsacl: fix return code check for getting full ACL.
    * cifs-utils: support and document password2 mount option.
    * cifs-utils: Skip TGT check if valid service ticket is already available.
    * Do not pass passwords with sec=none and sec=krb5.
  + Various improvements to man pages.

- Added the ability to select the fusermount2/fuserumount2 version using
  alternatives-manual (thx Korney Gedert).

- Add support distr profile layer
- Add service specific system profile template
- Update obsoletes default user profile during upgrade

- Removed dependency on pipes.

- Fix FTBS by CFLAGS="-Wno-incompatible-pointer-types"

- Updated to 14 version (fixes: CVE-2023-50967)

- Initial build

- Move executable script to bindir.
- Update systemd unit.

- Added additional methods on the bus for forced downloading of gpt (thx greh@)

- Updated to new version 1.1.16 (released 2024-07-05)
- Fixes from upstream:
  + Fixed copy&paste error in the destructor
  + Fixed thread sanitizer on modern Linux Kernels
  + Fixed building with newer cmocka versions

- 2.8.102 -> 2.8.135

- Spec created by cabal2rpm 0.20_11

- Add support LDAP add/mod operation to set/change password:
 + fix unable to join to active directory after KB5008380/CVE-2021-42287 with
   option '--ldap-passwd';
 + https://gitlab.freedesktop.org/realmd/adcli/-/issues/27
- Add support fall back to LDAPS if CLDAP ping was not successful
 + If the --use-ldaps option is used and there is no reply on the CLDAP 389/udp
   port adcli will try to send the request to the LDAPS port 636/tcp.
- Fix write SID before secret to Samba's db looks like 'net changesecretpw'
- Add passwd-user sub-command for (re)set a user password.
- Add dont-expire-password option for computer.

- Update Administrative Templates (.admx) default source URL:
  Windows 10 October 2020 Update -> Windows 10 2022 Update (22H2).

- Add compatibility with stable releases of samba-4.18 and later (closes: 49404).
- Replace python3 build to new pyproject_build process.

- Add control pam_propperpwnam for support module in system authentication (ALT#47713).

- Fixed prepare-vm script dependency to gpasswd.

- Fix check of mime type for images.

- Update spec template to newest rpm-build-haskel supports haskell(abi)

- add requires to apt-gpgkeys with Etersoft keys

- Updated spec to allow any compression of man page

- NMU: spec: adapt to new cmake macros.

- NMU: spec: adapted to new cmake macros.

- Add options to initscript

- Build on aarch64 fixed

- Initial build for Sisyphus

- updated with the help of cabal2gear.

- Spec created by cabal2rpm 0.20_11

- Initial from upstream with Spec created by cabal2rpm 0.20_11