# changelog

author: José Expósito <jexposit@redhat.com> - 3.01-2
changelog:
  - Use mesa-compat-libOSMesa on Fedora 42 and later
    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2373991


author: Cristian Le <git@lecris.dev> - 18.11.0-1
changelog:
  - Update to version 18.11.0
  - Atuin 18.9.0 fixes fish 4.x removal of `bind -k` (rhbz#2440541)
  - Add better documentation of how to handle MSRV
  - Move the profile.d script outside of the spec file


author: Aleksei Bavshin <alebastr@fedoraproject.org> - 4.0.4-1
changelog:
  - Update to 4.0.4 (rhbz#2426948)
  - Rewrite the spec according to the non-crate Rust project guidelines.


author: Emir Akdag <infraw.linux@proton.me> - 3.1.0-1
changelog:
  - Update to 3.1.0 (Complete rewrite in Rust) - Package transitioned from
    Python to Rust - Vendored Rust dependencies due to missing crates in
    Fedora - Skipped hardcoded file-path doctests in %check


author: Bastien Nocera <bnocera@redhat.com> - 5.86-4
changelog:
  - Re-add btmgmt as it does not require bluetoothd to be running,
    unlike bluetoothctl mgmt
  - Update audio output patch to be upstream version
  - Fix "bluetoothctl list" empty output (Closes: #2440346)


author: Timothée Ravier <tim@siosm.fr> - 2.26.0-4
changelog:
  - F44+: Ship OpenSSH config file specifying AuthorizedKeysFile
  - Have ignition-edge require the matching main ignition package


author: Steven Presti <spresti@redhat.com> - 2.27.0-1
changelog:
  - New Release
  - Butane config transpiler merged into Ignition repository
  - Butane now follows Ignition version numbering
  - Drop Patch0 (fix merged upstream)
  - Drop legacy fcct/fedora-coreos-config-transpiler provides


author: Than Ngo <than@redhat.com> - 150.0.7871.186-1
changelog:
  - Update to 150.0.7871.186
    * CVE-2026-16807: Out of bounds write in Codecs
    * CVE-2026-16806: Use after free in WebMCP
    * CVE-2026-16805: Use after free in Blink
    * CVE-2026-16804: Use after free in Input


author: Than Ngo <than@redhat.com> - 151.0.7922.71-1
changelog:
  - Update to 151.0.7922.71
    * CVE-2026-17650: Use after free in Compositing
    * CVE-2026-17651: Insufficient validation of untrusted input in Dawn
    * CVE-2026-17652: Use after free in Views
    * CVE-2026-17653: Use after free in Skia
    * CVE-2026-17654: Race in Updater
    * CVE-2026-17655: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-17656: Use after free in Ozone
    * CVE-2026-17657: Use after free in Navigation
    * CVE-2026-17658: Use after free in V8
    * CVE-2026-17659: Inappropriate implementation in SiteIsolation
    * CVE-2026-17660: Insufficient validation of untrusted input in Network
    * CVE-2026-17661: Use after free in Loader
    * CVE-2026-17662: Insufficient policy enforcement in Prefetch
    * CVE-2026-17663: Insufficient validation of untrusted input in GPU
    * CVE-2026-17664: Insufficient validation of untrusted input in Loader
    * CVE-2026-17665: Use after free in V8
    * CVE-2026-17666: Cryptographic Flaw in Enterprise
    * CVE-2026-17667: Uninitialized Use in ANGLE
    * CVE-2026-17668: Uninitialized Use in ANGLE
    * CVE-2026-17669: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17670: Use after free in Views
    * CVE-2026-17671: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-17672: Insufficient validation of untrusted input in Chromecast
    * CVE-2026-17673: Integer overflow in QUIC
    * CVE-2026-17674: Inappropriate implementation in HTML
    * CVE-2026-17675: Out of bounds write in ANGLE
    * CVE-2026-17676: Inappropriate implementation in ANGLE
    * CVE-2026-17677: Inappropriate implementation in ANGLE
    * CVE-2026-17678: Out of bounds read in ANGLE
    * CVE-2026-17679: Insufficient validation of untrusted input in Print Preview
    * CVE-2026-17680: Heap buffer overflow in Color
    * CVE-2026-17681: Insufficient validation of untrusted input in Web Authentication
    * CVE-2026-17682: Integer overflow in ANGLE
    * CVE-2026-17683: Inappropriate implementation in ANGLE
    * CVE-2026-17684: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17685: Use after free in Autofill
    * CVE-2026-17686: Insufficient validation of untrusted input in Passwords
    * CVE-2026-17687: Type Confusion in ANGLE
    * CVE-2026-17688: Use after free in Input
    * CVE-2026-17689: Uninitialized Use in ANGLE
    * CVE-2026-17690: Insufficient validation of untrusted input in PDF
    * CVE-2026-17691: Out of bounds write in ANGLE
    * CVE-2026-17692: Use after free in DataTransfer
    * CVE-2026-17693: Inappropriate implementation in FileSystem
    * CVE-2026-17694: Use after free in DOM
    * CVE-2026-17695: Inappropriate implementation in ANGLE
    * CVE-2026-17696: Side-channel information leakage in Media
    * CVE-2026-17697: Type Confusion in ANGLE
    * CVE-2026-17698: Insufficient validation of untrusted input in UI
    * CVE-2026-17699: Use after free in Views
    * CVE-2026-17700: Insufficient validation of untrusted input in Actor
    * CVE-2026-17701: Out of bounds read in ANGLE
    * CVE-2026-17702: Inappropriate implementation in Skia
    * CVE-2026-17703: Policy bypass in Chrome for iOS
    * CVE-2026-17704: Use after free in ANGLE
    * CVE-2026-17705: Integer overflow in libxml
    * CVE-2026-17706: Insufficient validation of untrusted input in Media
    * CVE-2026-17707: Uninitialized Use in Media
    * CVE-2026-17708: Use after free in Audio
    * CVE-2026-17709: Race in Downloads
    * CVE-2026-17710: Inappropriate implementation in MHTML
    * CVE-2026-17711: Race in Downloads
    * CVE-2026-17712: Race in Skia
    * CVE-2026-17713: Insufficient validation of untrusted input in Accessibility
    * CVE-2026-17714: Uninitialized Use in ANGLE
    * CVE-2026-17715: Inappropriate implementation in Passwords
    * CVE-2026-17716: Use after free in Updater
    * CVE-2026-17717: Integer overflow in ANGLE
    * CVE-2026-17718: Use after free in ANGLE
    * CVE-2026-17719: Use after free in Input
    * CVE-2026-17720: Insufficient policy enforcement in Passwords
    * CVE-2026-17721: Out of bounds write in ANGLE
    * CVE-2026-17722: Object lifecycle issue in WebView
    * CVE-2026-17723: Use after free in Media
    * CVE-2026-17724: Race in Chrome for iOS
    * CVE-2026-17725: Type Confusion in V8
    * CVE-2026-17726: Integer overflow in WebGL
    * CVE-2026-17727: Out of bounds write in WebGL
    * CVE-2026-17728: Inappropriate implementation in Extensions
    * CVE-2026-17758: Heap buffer overflow in Dawn
    * CVE-2026-17732: Inappropriate implementation in SVG
    * CVE-2026-17729: Use after free in V8
    * CVE-2026-17730: Side-channel information leakage in Autofill
    * CVE-2026-17731: Inappropriate implementation in Autofill
    * CVE-2026-17733: Inappropriate implementation in QUIC
    * CVE-2026-17734: Inappropriate implementation in Autofill
    * CVE-2026-17735: Insufficient validation of untrusted input in BFCache
    * CVE-2026-17736: Insufficient validation of untrusted input in WebView
    * CVE-2026-17737: Use after free in Bluetooth
    * CVE-2026-17738: Insufficient validation of untrusted input in Payments
    * CVE-2026-17739: Insufficient policy enforcement in Extensions
    * CVE-2026-17740: Uninitialized Use in ANGLE
    * CVE-2026-17741: Insufficient validation of untrusted input in WebView
    * CVE-2026-17742: Insufficient policy enforcement in Payments
    * CVE-2026-17743: Insufficient policy enforcement in ControlledFrame
    * CVE-2026-17744: Inappropriate implementation in File Input
    * CVE-2026-17745: Out of bounds read in Skia
    * CVE-2026-17746: Use after free in GPU
    * CVE-2026-17747: Insufficient validation of untrusted input in Payments
    * CVE-2026-17748: Inappropriate implementation in Extensions
    * CVE-2026-17749: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17750: Use after free in ANGLE
    * CVE-2026-17751: Inappropriate implementation in AdFilter
    * CVE-2026-17752: Use after free in Views
    * CVE-2026-17753: Inappropriate implementation in Autofill
    * CVE-2026-17754: Inappropriate implementation in Blink
    * CVE-2026-17755: Incorrect security UI in Extensions
    * CVE-2026-17756: Insufficient policy enforcement in Presentation
    * CVE-2026-17757: Uninitialized Use in Skia
    * CVE-2026-17759: Uninitialized Use in Codecs
    * CVE-2026-17760: Side-channel information leakage in NoStatePrefetch
    * CVE-2026-17761: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17762: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17763: Inappropriate implementation in GPU
    * CVE-2026-17764: Inappropriate implementation in FedCM
    * CVE-2026-17765: Inappropriate implementation in WebProtect
    * CVE-2026-17766: Insufficient validation of untrusted input in Clipboard
    * CVE-2026-17767: Insufficient validation of untrusted input in WebView
    * CVE-2026-17768: Insufficient validation of untrusted input in WebSockets
    * CVE-2026-17769: Insufficient validation of untrusted input in Cast
    * CVE-2026-17770: Out of bounds read in Media
    * CVE-2026-17771: Uninitialized Use in Skia
    * CVE-2026-17772: Out of bounds read in WebGL
    * CVE-2026-17773: Insufficient validation of untrusted input in Cast
    * CVE-2026-17774: Insufficient validation of untrusted input in Variations
    * CVE-2026-17775: Inappropriate implementation in PresentationAPI
    * CVE-2026-17776: Policy bypass in Receiver
    * CVE-2026-17777: Inappropriate implementation in Autofill
    * CVE-2026-17778: Use after free in Extensions
    * CVE-2026-17779: Inappropriate implementation in Site Isolation
    * CVE-2026-17780: Inappropriate implementation in Isolated Web Apps
    * CVE-2026-17781: Inappropriate implementation in Extensions
    * CVE-2026-17782: Incorrect security UI in Chrome for iOS
    * CVE-2026-17783: Inappropriate implementation in Loader
    * CVE-2026-17784: Use after free in Audio
    * CVE-2026-17785: Uninitialized Use in ANGLE
    * CVE-2026-17786: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17787: Inappropriate implementation in DevTools
    * CVE-2026-17788: Inappropriate implementation in Blink
    * CVE-2026-17789: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17790: Uninitialized Use in ANGLE
    * CVE-2026-17791: Insufficient validation of untrusted input in Payments
    * CVE-2026-17792: Inappropriate implementation in Credential Management
    * CVE-2026-17793: Inappropriate implementation in Messages
    * CVE-2026-17794: Insufficient validation of untrusted input in Mobile
    * CVE-2026-17795: Insufficient validation of untrusted input in GetUserMedia
    * CVE-2026-17796: Side-channel information leakage in WebXR
    * CVE-2026-17797: Inappropriate implementation in CSS
    * CVE-2026-17798: Inappropriate implementation in Cast
    * CVE-2026-17799: Insufficient validation of untrusted input in Safe Browsing
    * CVE-2026-17800: Side-channel information leakage in MediaRecording
    * CVE-2026-17801: Out of bounds memory access in ANGLE
    * CVE-2026-17802: Side-channel information leakage in GPU
    * CVE-2026-17803: Insufficient validation of untrusted input in Save to Drive
    * CVE-2026-17804: Use after free in Media
    * CVE-2026-17805: Insufficient policy enforcement in Glic
    * CVE-2026-17806: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17807: Use after free in V8
    * CVE-2026-17808: Uninitialized Use in WebGL
    * CVE-2026-17809: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17810: Uninitialized Use in Dawn
    * CVE-2026-17811: Use after free in ANGLE
    * CVE-2026-17812: Inappropriate implementation in DigitalCredentials
    * CVE-2026-17813: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-17814: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-17815: Insufficient policy enforcement in GuestView
    * CVE-2026-17816: Inappropriate implementation in Speech
    * CVE-2026-17817: Inappropriate implementation in ReportingAndNEL
    * CVE-2026-17818: Inappropriate implementation in Network
    * CVE-2026-17819: Inappropriate implementation in WebAppInstalls
    * CVE-2026-17820: Insufficient policy enforcement in Autofill
    * CVE-2026-17821: Insufficient policy enforcement in Extensions
    * CVE-2026-17822: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17823: Insufficient policy enforcement in WebXR
    * CVE-2026-17824: Insufficient policy enforcement in ServiceWorker
    * CVE-2026-17825: Insufficient policy enforcement in Passwords
    * CVE-2026-17826: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17827: Inappropriate implementation in CSS
    * CVE-2026-17828: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17829: Insufficient policy enforcement in Passwords
    * CVE-2026-17830: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17831: Insufficient validation of untrusted input in Passwords
    * CVE-2026-17832: Use after free in ANGLE
    * CVE-2026-17833: Inappropriate implementation in Passwords
    * CVE-2026-17834: Inappropriate implementation in Passwords
    * CVE-2026-17835: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17836: Use after free in V8
    * CVE-2026-17837: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17838: Incorrect security UI in Chrome for iOS
    * CVE-2026-17839: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17840: Incorrect security UI in Passwords
    * CVE-2026-17841: Race in Chrome for iOS
    * CVE-2026-17842: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17843: Inappropriate implementation in CSS
    * CVE-2026-17844: Insufficient validation of untrusted input in Cast
    * CVE-2026-17845: Inappropriate implementation in CSS
    * CVE-2026-17846: Inappropriate implementation in Media
    * CVE-2026-17847: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-17848: Insufficient validation of untrusted input in Codecs
    * CVE-2026-17849: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17850: Inappropriate implementation in Permissions
    * CVE-2026-17851: Side-channel information leakage in Autofill
    * CVE-2026-17852: Inappropriate implementation in Media Router
    * CVE-2026-17853: Inappropriate implementation in DevTools
    * CVE-2026-17854: Insufficient policy enforcement in WebMCP
    * CVE-2026-17855: Race in DevTools
    * CVE-2026-17856: Inappropriate implementation in Network
    * CVE-2026-17857: Inappropriate implementation in Network
    * CVE-2026-17858: Uninitialized Use in WebNN
    * CVE-2026-17859: Side-channel information leakage in Favicons
    * CVE-2026-17860: Insufficient validation of untrusted input in Mobile
    * CVE-2026-17861: Insufficient validation of untrusted input in Updater
    * CVE-2026-17862: Use after free in Tracing
    * CVE-2026-17863: Inappropriate implementation in Browser
    * CVE-2026-17864: Inappropriate implementation in Updater
    * CVE-2026-17865: Inappropriate implementation in Crypto
    * CVE-2026-17866: Type Confusion in Tab
    * CVE-2026-17867: Insufficient validation of untrusted input in Dawn
    * CVE-2026-17868: Insufficient policy enforcement in USB
    * CVE-2026-17869: Out of bounds read in WebXR
    * CVE-2026-17870: Insufficient validation of untrusted input in Cast
    * CVE-2026-17871: Inappropriate implementation in Passwords
    * CVE-2026-17872: Cryptographic Flaw in WebAppInstalls
    * CVE-2026-17873: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-17874: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17875: Use after free in PDFium
    * CVE-2026-17876: Inappropriate implementation in Payments
    * CVE-2026-17877: Inappropriate implementation in Chromoting
    * CVE-2026-17878: Inappropriate implementation in CSS
    * CVE-2026-17879: Inappropriate implementation in Autofill
    * CVE-2026-17880: Inappropriate implementation in Autofill
    * CVE-2026-17881: Use after free in WebXR
    * CVE-2026-17882: Policy bypass in Extensions
    * CVE-2026-17883: Inappropriate implementation in Headless
    * CVE-2026-17884: Object lifecycle issue in WebRTC
    * CVE-2026-17885: Inappropriate implementation in Paint
    * CVE-2026-17886: Use after free in Enterprise
    * CVE-2026-17887: Use after free in TabStrip
    * CVE-2026-17888: Insufficient validation of untrusted input in WebUI
    * CVE-2026-17889: Uninitialized Use in WebXR
    * CVE-2026-17890: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17891: Use after free in ANGLE
    * CVE-2026-17892: Inappropriate implementation in WebXR
    * CVE-2026-17893: Insufficient validation of untrusted input in Updater
    * CVE-2026-17894: Use after free in Views
    * CVE-2026-17895: Inappropriate implementation in DataTransfer
    * CVE-2026-17896: Use after free in DevTools
    * CVE-2026-17897: Inappropriate implementation in ORB
    * CVE-2026-17898: Use after free in DevTools
    * CVE-2026-17899: Insufficient policy enforcement in DevTools
    * CVE-2026-17900: Inappropriate implementation in Enterprise
    * CVE-2026-17901: Inappropriate implementation in Sharing
    * CVE-2026-17902: Inappropriate implementation in Editing
    * CVE-2026-17903: Insufficient policy enforcement in Chromecast
    * CVE-2026-17904: Insufficient policy enforcement in NFC
    * CVE-2026-17905: Inappropriate implementation in SurfaceCapture
    * CVE-2026-17906: Insufficient validation of untrusted input in Bluetooth
    * CVE-2026-17907: Side-channel information leakage in Network
    * CVE-2026-17908: Insufficient validation of untrusted input in Printing
    * CVE-2026-17909: Insufficient validation of untrusted input in Isolated Web Apps
    * CVE-2026-17910: Insufficient policy enforcement in NFC
    * CVE-2026-17911: Insufficient policy enforcement in SVG
    * CVE-2026-17912: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17913: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17914: Side-channel information leakage in Skia
    * CVE-2026-17915: Inappropriate implementation in WebView
    * CVE-2026-17916: Insufficient policy enforcement in Settings
    * CVE-2026-17917: Policy bypass in Chrome for iOS
    * CVE-2026-17918: Use after free in Sync
    * CVE-2026-17919: Insufficient policy enforcement in Enterprise
    * CVE-2026-17920: Use after free in V8
    * CVE-2026-17921: Insufficient validation of untrusted input in Navigation
    * CVE-2026-17922: Inappropriate implementation in Enterprise
    * CVE-2026-17923: Policy bypass in Enterprise
    * CVE-2026-17924: Use after free in DNS
    * CVE-2026-17925: Inappropriate implementation in Cast
    * CVE-2026-17926: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17927: Insufficient policy enforcement in DevTools
    * CVE-2026-17928: Inappropriate implementation in DataTransfer
    * CVE-2026-17929: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17930: Insufficient validation of untrusted input in Extensions
    * CVE-2026-17931: Inappropriate implementation in DevTools
    * CVE-2026-17932: Use after free in DataTransfer
    * CVE-2026-17933: Inappropriate implementation in DOMStorage
    * CVE-2026-17934: Insufficient validation of untrusted input in DevTools
    * CVE-2026-17935: Heap buffer overflow in Codecs
    * CVE-2026-17936: Inappropriate implementation in DevTools
    * CVE-2026-17937: Inappropriate implementation in DevTools
    * CVE-2026-17938: Inappropriate implementation in FullScreen
    * CVE-2026-17939: Inappropriate implementation in Passwords
    * CVE-2026-17940: Insufficient validation of untrusted input in Picture-in-Picture
    * CVE-2026-17941: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17942: Side-channel information leakage in SVG
    * CVE-2026-17943: Inappropriate implementation in Parser
    * CVE-2026-17944: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17945: Inappropriate implementation in Navigation
    * CVE-2026-17946: Uninitialized Use in Dawn
    * CVE-2026-17947: Use after free in WebSockets
    * CVE-2026-17948: Type Confusion in V8
    * CVE-2026-17949: Uninitialized Use in GPU
    * CVE-2026-17950: Policy bypass in Safebrowsing
    * CVE-2026-17951: Heap buffer overflow in WebRTC
    * CVE-2026-17952: Inappropriate implementation in V8
    * CVE-2026-17953: Insufficient policy enforcement in WebView
    * CVE-2026-17954: Policy bypass in MHTML
    * CVE-2026-17955: Insufficient validation of untrusted input in Payments
    * CVE-2026-17956: Inappropriate implementation in Scheduling
    * CVE-2026-17957: Inappropriate implementation in CORS
    * CVE-2026-17958: Inappropriate implementation in Views
    * CVE-2026-17959: Inappropriate implementation in Network
    * CVE-2026-17960: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17961: Inappropriate implementation in Session
    * CVE-2026-17962: Inappropriate implementation in Blink
    * CVE-2026-17963: Inappropriate implementation in SVG
    * CVE-2026-17964: Incorrect security UI in UI
    * CVE-2026-17965: Incorrect security UI in Chrome for iOS
    * CVE-2026-17966: Inappropriate implementation in Views
    * CVE-2026-17967: Use after free in Chrome for iOS
    * CVE-2026-17968: Uninitialized Use in WebXR
    * CVE-2026-17969: Inappropriate implementation in Passwords
    * CVE-2026-17970: Insufficient validation of untrusted input in Passwords
    * CVE-2026-17971: Inappropriate implementation in Frame
    * CVE-2026-17972: Inappropriate implementation in Chrome for iOS
    * CVE-2026-17973: Inappropriate implementation in Views
    * CVE-2026-17974: Insufficient policy enforcement in DevTools
    * CVE-2026-17975: Inappropriate implementation in IME
    * CVE-2026-17976: Policy bypass in Extensions
    * CVE-2026-17977: Policy bypass in CSS
    * CVE-2026-17978: Side-channel information leakage in WebCodecs
    * CVE-2026-17979: Race in V8
    * CVE-2026-17980: Inappropriate implementation in UI
    * CVE-2026-17981: Inappropriate implementation in Blink
    * CVE-2026-17982: Insufficient validation of untrusted input in Cast
    * CVE-2026-17983: Incorrect security UI in Global Media Controls
    * CVE-2026-17984: Inappropriate implementation in Browser
    * CVE-2026-17985: Insufficient policy enforcement in Speech
    * CVE-2026-17986: Insufficient policy enforcement in Bluetooth
    * CVE-2026-17987: Insufficient validation of untrusted input in Notifications
    * CVE-2026-17988: Insufficient validation of untrusted input in Navigation
    * CVE-2026-17989: Type Confusion in V8
    * CVE-2026-17990: Insufficient validation of untrusted input in WebAuthn
    * CVE-2026-17991: Insufficient validation of untrusted input in AI
    * CVE-2026-17992: Uninitialized Use in Skia
    * CVE-2026-17993: Race in Updater
    * CVE-2026-17994: Inappropriate implementation in Media
    * CVE-2026-17995: Out of bounds read in Dawn
    * CVE-2026-17996: Inappropriate implementation in Browser
    * CVE-2026-17997: Inappropriate implementation in Passwords
    * CVE-2026-17998: Incorrect security UI in Extensions
    * CVE-2026-17999: Incorrect security UI in PictureInPicture
    * CVE-2026-18000: Insufficient policy enforcement in USB
    * CVE-2026-18001: Inappropriate implementation in WebGL
    * CVE-2026-18002: Insufficient validation of untrusted input in Google Lens
    * CVE-2026-18003: Inappropriate implementation in Chrome for iOS
    * CVE-2026-18004: Insufficient policy enforcement in Speech
    * CVE-2026-18005: Inappropriate implementation in WebXR
    * CVE-2026-18006: Inappropriate implementation in Google Lens
    * CVE-2026-18007: Inappropriate implementation in Input
    * CVE-2026-18008: Inappropriate implementation in Settings
    * CVE-2026-18009: Insufficient validation of untrusted input in Passwords
    * CVE-2026-18010: Inappropriate implementation in Passwords
    * CVE-2026-18011: Inappropriate implementation in Chrome for iOS
    * CVE-2026-18012: Use after free in PDFium
    * CVE-2026-18013: Inappropriate implementation in Chrome for iOS
    * CVE-2026-18014: Insufficient validation of untrusted input in DevTools
    * CVE-2026-18015: Inappropriate implementation in Tint
    * CVE-2026-18016: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-18017: Use after free in Dawn
    * CVE-2026-18018: Inappropriate implementation in Updater
    * CVE-2026-18019: Side-channel information leakage in Media


author: Than Ngo <than@redhat.com> - 151.0.7922.108-1
changelog:
  - Update to 151.0.7922.108
    * CVE-2026-19137: Use after free in WebGL
    * CVE-2026-19138: Heap buffer overflow in CrashReporting
    * CVE-2026-19139: Race in CredentialProvider
    * CVE-2026-19140: Use after free in GPU
    * CVE-2026-19141: Use after free in Resources
    * CVE-2026-19142: Use after free in Views
    * CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs
    * CVE-2026-19144: Use after free in HTML
    * CVE-2026-19145: Use after free in Translate
    * CVE-2026-19146: Uninitialized Use in GPU
    * CVE-2026-19147: Use after free in Aura
    * CVE-2026-19148: Out of bounds write in GPU
    * CVE-2026-19149: Use after free in Aura
    * CVE-2026-19150: Inappropriate implementation in V8
    * CVE-2026-19151: Use after free in V8
    * CVE-2026-19152: Inappropriate implementation in Navigation
    * CVE-2026-19153: Insufficient validation of untrusted input in Workers
    * CVE-2026-19154: Use after free in Skia
    * CVE-2026-19155: Use after free in Payments
    * CVE-2026-19156: Heap buffer overflow in Base
    * CVE-2026-19157: Out of bounds write in ANGLE
    * CVE-2026-19158: Use after free in Views
    * CVE-2026-19159: Use after free in Views
    * CVE-2026-19160: Uninitialized Use in Skia
    * CVE-2026-19161: Uninitialized Use in Skia
    * CVE-2026-19162: Out of bounds write in V8
    * CVE-2026-19163: Use after free in Media
    * CVE-2026-19164: Insufficient validation of untrusted input in Codecs
    * CVE-2026-19165: Use after free in Extensions
    * CVE-2026-19166: Use after free in Web Authentication
    * CVE-2026-19167: Integer overflow in GPU
    * CVE-2026-19168: Inappropriate implementation in V8
    * CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks
    * CVE-2026-19170: Use after free in WebGL
    * CVE-2026-19171: Use after free in Media
    * CVE-2026-19172: Use after free in Views
    * CVE-2026-19173: Out of bounds write in Skia
    * CVE-2026-19174: Integer overflow in V8
    * CVE-2026-19175: Use after free in Payments
    * CVE-2026-19176: Use after free in Skia
    * CVE-2026-19177: Insufficient validation of untrusted input in UI


author: Than Ngo <than@redhat.com> - 151.0.7922.137-1
changelog:
  - Update to 151.0.7922.137
    * CVE-2026-19556: Use after free in V8
    * CVE-2026-19557: Use after free in TabStrip
    * CVE-2026-19558: Use after free in Extensions
    * CVE-2026-19559: Use after free in HTML
    * CVE-2026-19560: Use after free in Blink


author: Than Ngo <than@redhat.com> - 151.0.7922.169-1
changelog:
  - Update to 151.0.7922.169
    * CVE-2026-76034: Buffer overflow in WebGL
    * CVE-2026-76036: Buffer overflow in Dawn
    * CVE-2026-76033: Inappropriate implementation in CORS
    * CVE-2026-76037: Link following in CredentialProvider
    * CVE-2026-76044: Race condition in USB
    * CVE-2026-76039: Incorrect reference resolution in Core
    * CVE-2026-76040: Use after free in Browser
    * CVE-2026-76035: Inappropriate implementation in Media
    * CVE-2026-76042: Use of uninitialized resource in GPU
    * CVE-2026-76046: Buffer overflow in ANGLE
    * CVE-2026-76043: Incorrect calculation in V8
    * CVE-2026-76041: Information leak in Skia
    * CVE-2026-76047: Type confusion in V8
    * CVE-2026-76038: Type confusion in V8
    * CVE-2026-76045: Use after free in WebGL


author: Than Ngo <than@redhat.com> - 151.0.7922.173-1
changelog:
  - Update to 151.0.7922.173
    * CVE-2026-76017: Use after free in Chromoting
    * CVE-2026-76018: Privilege elevation in Import
    * CVE-2026-76019: Incorrect authorization in Workers
    * CVE-2026-76020: Race condition in V8
    * CVE-2026-76021: Use after free in DOM
    * CVE-2026-76022: Buffer overflow in Network
    * CVE-2026-76023: Improper resource control in Linux Toolkit Theming


author: Than Ngo <than@redhat.com> - 152.0.7977.64-1
changelog:
  - Update to 152.0.7977.64 
    * CVE-2026-79282: Use after free in ANGLE
    * CVE-2026-79290: Use after free in Aura
    * CVE-2026-79054: Use after free in Chromecast
    * CVE-2026-79121: Improper input validation in Chromecast
    * CVE-2026-79224: Use after free in Chromecast
    * CVE-2026-79052: Use after free in Aura
    * CVE-2026-79150: Use after free in Views
    * CVE-2026-78935: Use of uninitialized variable in Mobile
    * CVE-2026-79012: Use after free in Safebrowsing
    * CVE-2026-79200: Use after free in Aura
    * CVE-2026-78989: Out of bounds read in ANGLE
    * CVE-2026-79069: Memory corruption in Tint
    * CVE-2026-79175: Type confusion in Accessibility
    * CVE-2026-79218: Incorrect authorization in Sandbox
    * CVE-2026-79195: Use after free in Script
    * CVE-2026-78939: Use after free in Chromecast
    * CVE-2026-79194: Use after free in Chromoting
    * CVE-2026-79247: Use after free in Chromoting
    * CVE-2026-79219: Use after free in Bluetooth
    * CVE-2026-79047: Use after free in Views
    * CVE-2026-79292: Integer overflow in Chromecast
    * CVE-2026-78986: Uninitialized resource in GPU
    * CVE-2026-79039: Use after free in Mobile
    * CVE-2026-78934: Race condition in ReadAloud
    * CVE-2026-79011: UI misrepresentation in Browser
    * CVE-2026-78911: Incorrect authorization in USB
    * CVE-2026-79257: Use after free in Views
    * CVE-2026-79202: Use after free in Chromecast
    * CVE-2026-79212: Missing authorization in Passwords
    * CVE-2026-79183: Use after free in Accessibility
    * CVE-2026-79155: Race condition in FileSystem
    * CVE-2026-79093: Incorrect authorization in Paint
    * CVE-2026-79019: Out of bounds write in ANGLE
    * CVE-2026-79187: Use after free in WebRTC
    * CVE-2026-79288: Improper input validation in Autofill
    * CVE-2026-79130: Buffer overflow in ANGLE
    * CVE-2026-78965: Uninitialized resource in ANGLE
    * CVE-2026-79117: Race condition in WebAppInstalls
    * CVE-2026-79082: Incorrect authorization in Transactions Platform
    * CVE-2026-79111: Improper input validation in Dawn
    * CVE-2026-79072: Improper state validation in Performance
    * CVE-2026-79142: Buffer overflow in ANGLE
    * CVE-2026-78948: Buffer overflow in WebGL
    * CVE-2026-78908: Information leak in Canvas
    * CVE-2026-78895: Information leak in Paint
    * CVE-2026-79043: Out of bounds write in ANGLE
    * CVE-2026-79235: Use after free in WebGL
    * CVE-2026-79232: Use after free in Aura
    * CVE-2026-79118: Uninitialized resource in ANGLE
    * CVE-2026-79174: Incorrect authorization in Extensions
    * CVE-2026-78900: Improper input validation in Media
    * CVE-2026-79188: Out of bounds write in ANGLE
    * CVE-2026-79189: Out of bounds write in ANGLE
    * CVE-2026-79048: Out of bounds write in ANGLE
    * CVE-2026-79240: Out of bounds write in ANGLE
    * CVE-2026-79014: Race condition in Autofill
    * CVE-2026-79198: Use after free in Platform
    * CVE-2026-79131: Out of bounds write in ANGLE
    * CVE-2026-79149: Use after free in ANGLE
    * CVE-2026-79275: Use after free in ANGLE
    * CVE-2026-79138: Out of bounds write in ANGLE
    * CVE-2026-79026: Use after free in Extensions
    * CVE-2026-79027: Use after free in WebRTC
    * CVE-2026-78904: Type confusion in ANGLE
    * CVE-2026-78899: Use after free in V8
    * CVE-2026-78954: Incorrect authorization in Extensions
    * CVE-2026-79274: Information leak in GPU
    * CVE-2026-78938: Type confusion in V8
    * CVE-2026-78952: Out of bounds write in Crashpad
    * CVE-2026-79236: Type confusion in V8
    * CVE-2026-79078: Use after free in FedCM
    * CVE-2026-79209: Type confusion in Animation
    * CVE-2026-79030: Observable discrepancy in Autofill
    * CVE-2026-79216: Buffer overflow in Blink
    * CVE-2026-79007: Uninitialized resource in GPU
    * CVE-2026-78893: Information leak in QUIC
    * CVE-2026-79222: Incorrect authorization in CustomTabs
    * CVE-2026-79071: Race condition in GPU
    * CVE-2026-79076: Improper input validation in Sync
    * CVE-2026-79088: Incorrect authorization in FileSystem
    * CVE-2026-79104: Missing authorization in Sensor
    * CVE-2026-79044: Missing authorization in WebAppInstalls
    * CVE-2026-78958: Uninitialized resource in Skia
    * CVE-2026-78961: Incorrect authorization in Core
    * CVE-2026-79262: Incorrect authorization in Network
    * CVE-2026-79106: Improper input validation in Input
    * CVE-2026-79176: UI misrepresentation in Extensions
    * CVE-2026-78966: Externally controlled reference in QUIC
    * CVE-2026-79186: Incorrect authorization in Network
    * CVE-2026-79267: Race condition in Workers
    * CVE-2026-79016: Observable discrepancy in SVG
    * CVE-2026-79010: Operation on a resource after expiration or release in Network
    * CVE-2026-79286: Missing authorization in CustomTabs
    * CVE-2026-78945: Use after free in Views
    * CVE-2026-78999: Improper privilege management in Navigation
    * CVE-2026-78941: Information leak in Core
    * CVE-2026-79032: Improper input validation in Network
    * CVE-2026-79109: Improper input validation in Printing
    * CVE-2026-79256: Externally controlled reference in WebView
    * CVE-2026-79237: Incorrect authorization in Navigation
    * CVE-2026-78898: Incorrect authorization in Downloads
    * CVE-2026-78985: Incorrect reference resolution in FileSystem
    * CVE-2026-79028: Observable discrepancy in Network
    * CVE-2026-79210: Use after free in Audio
    * CVE-2026-79046: Race condition in Permissions
    * CVE-2026-79129: Use after free in Sessions
    * CVE-2026-78937: Use after free in Search
    * CVE-2026-78987: Information leak in Canvas
    * CVE-2026-78990: Use after free in Compositing
    * CVE-2026-78909: Use after free in Views
    * CVE-2026-79271: Information leak in DOM
    * CVE-2026-79144: Information leak in Skia
    * CVE-2026-79065: Improper input validation in Network
    * CVE-2026-79192: Improper input validation in Variations
    * CVE-2026-79140: Use after free in Views
    * CVE-2026-79128: Use after free in Views
    * CVE-2026-78942: Incorrect reference resolution in Loader
    * CVE-2026-79116: Missing authorization in Viz
    * CVE-2026-79006: Protection mechanism failure in HttpsUpgrades
    * CVE-2026-79095: Information leak in Payments
    * CVE-2026-79084: Inadequate encryption strength in Notifications
    * CVE-2026-78991: Race condition in WebProtect
    * CVE-2026-79248: Incorrect authorization in Input
    * CVE-2026-78891: Buffer overflow in WebRTC
    * CVE-2026-79031: Improper resource exposure in Preload
    * CVE-2026-79110: Missing authorization in Preload
    * CVE-2026-79136: Incorrect authorization in ServiceWorker
    * CVE-2026-78907: Incorrect authorization in WebProtect
    * CVE-2026-79087: Injection in Chrome Tabs
    * CVE-2026-79231: Buffer overflow in Media
    * CVE-2026-78969: Uninitialized resource in Video
    * CVE-2026-79137: Incorrect authorization in Extensions
    * CVE-2026-79057: Race condition in Start
    * CVE-2026-78894: Race condition in Payments
    * CVE-2026-79264: Incorrect reference resolution in Preload
    * CVE-2026-78910: Buffer overflow in V8
    * CVE-2026-79066: Improper input validation in Navigation
    * CVE-2026-79255: Improper input validation in WebRTC
    * CVE-2026-79086: Missing authorization in CustomTabs
    * CVE-2026-79038: Incorrect authorization in WebProtect
    * CVE-2026-78940: Improper initialization in Network
    * CVE-2026-79107: Incorrect authorization in TabGroups
    * CVE-2026-79120: Uninitialized resource in ANGLE
    * CVE-2026-79270: Uninitialized resource in ANGLE
    * CVE-2026-79067: Missing authorization in Network
    * CVE-2026-79213: Incorrect authorization in WebAppInstalls
    * CVE-2026-78943: Improper input validation in Editing
    * CVE-2026-79259: Improper input validation in Safebrowsing
    * CVE-2026-79208: Missing authorization in HTTP2
    * CVE-2026-79251: Improper input validation in Network
    * CVE-2026-79226: Improper privilege management in Regional Capabilities
    * CVE-2026-79042: Missing authorization in Payments
    * CVE-2026-79122: Information leak in SignIn
    * CVE-2026-79199: Incorrect authorization in Network
    * CVE-2026-79013: Improper input validation in Sync
    * CVE-2026-79074: Information leak in Network
    * CVE-2026-79215: Integer overflow in WebGL
    * CVE-2026-79049: Incorrect reference resolution in Passwords
    * CVE-2026-79132: Improper input validation in Input
    * CVE-2026-79201: Improper access control in Workers
    * CVE-2026-79051: Incorrect authorization in Loader
    * CVE-2026-79053: Missing authorization in Lighthouse
    * CVE-2026-79285: Uninitialized resource in ANGLE
    * CVE-2026-78906: Race condition in ANGLE
    * CVE-2026-79250: UI misrepresentation in Navigation
    * CVE-2026-79020: Out of bounds read in Skia
    * CVE-2026-79217: Incorrect authorization in Mobile
    * CVE-2026-79204: UI misrepresentation in Input
    * CVE-2026-78912: UI misrepresentation in Browser
    * CVE-2026-78955: Observable discrepancy in PerformanceAPIs
    * CVE-2026-79143: Incorrect authorization in FileSystem
    * CVE-2026-79241: Out of bounds read in GPU
    * CVE-2026-78967: Missing authorization in BFCache
    * CVE-2026-79214: Improper input validation in Preload
    * CVE-2026-79228: Incorrect authorization in SiteIsolation
    * CVE-2026-78953: Missing authorization in SiteIsolation
    * CVE-2026-79229: Uninitialized resource in ANGLE
    * CVE-2026-79002: Incorrect authorization in SiteIsolation
    * CVE-2026-79272: Improper input validation in FindInPage
    * CVE-2026-79127: Out of bounds write in ANGLE
    * CVE-2026-79151: Improper input validation in Safebrowsing
    * CVE-2026-78936: Observable discrepancy in CustomTabs
    * CVE-2026-78905: Type confusion in ANGLE
    * CVE-2026-79050: Incorrect authorization in Network
    * CVE-2026-79008: Improper input validation in GPU
    * CVE-2026-78975: Incorrect authorization in DOM
    * CVE-2026-79287: Observable discrepancy in Forms
    * CVE-2026-79094: Race condition in Workers
    * CVE-2026-79173: UI misrepresentation in WebAppInstalls
    * CVE-2026-78976: Improper input validation in StorageAccessAPI
    * CVE-2026-79276: Improper privilege management in FileSystem
    * CVE-2026-79191: Incorrect authorization in SiteIsolation
    * CVE-2026-79099: Missing authorization in Network
    * CVE-2026-79024: Information leak in ServiceWorker
    * CVE-2026-79193: Information leak in Canvas
    * CVE-2026-79242: Observable discrepancy in HTML
    * CVE-2026-79180: UI misrepresentation in CustomTabs
    * CVE-2026-79293: Information leak in Animation
    * CVE-2026-79023: Incorrect authorization in Editing
    * CVE-2026-79146: Information leak in CustomTabs
    * CVE-2026-79238: Incorrect authorization in ServiceWorker
    * CVE-2026-78949: Observable discrepancy in CustomTabs
    * CVE-2026-79291: Information leak in CSS
    * CVE-2026-79283: UI misrepresentation in Geometry
    * CVE-2026-78892: Incorrect authorization in Chromoting
    * CVE-2026-79070: Incorrect reference resolution in Cache
    * CVE-2026-79205: Incorrect authorization in Network
    * CVE-2026-78903: Incomplete cleanup in SiteIsolation
    * CVE-2026-78959: Improper handling of case sensitivity in FileSystem
    * CVE-2026-79234: Injection in CSS
    * CVE-2026-78983: Use after free in Views
    * CVE-2026-79083: Improper enforcement of behavioral workflow in Media
    * CVE-2026-78944: Use after free in DevTools
    * CVE-2026-79178: Incorrect authorization in Web Authentication (Passkeys & Security Keys)
    * CVE-2026-79059: Information leak in BFCache
    * CVE-2026-79245: Use after free in UI
    * CVE-2026-78978: Out of bounds read in ANGLE
    * CVE-2026-79103: Incorrect reference resolution in Speech
    * CVE-2026-79154: Missing authorization in DevTools
    * CVE-2026-79230: Improper input validation in ANGLE
    * CVE-2026-79068: Improper resource exposure in StreamsAPI
    * CVE-2026-79269: Uninitialized resource in ANGLE
    * CVE-2026-79085: Missing authorization in Network
    * CVE-2026-79134: Incorrect authorization in GetUserMedia
    * CVE-2026-79064: Use after free in Network
    * CVE-2026-79003: Incorrect authorization in Device
    * CVE-2026-79220: Information leak in Network
    * CVE-2026-78951: Use after free in ServiceWorker
    * CVE-2026-79249: Code injection in Bisection
    * CVE-2026-79091: Use after free in Bluetooth
    * CVE-2026-79265: Incomplete cleanup in GetUserMedia
    * CVE-2026-78913: Use after free in Chromoting
    * CVE-2026-79258: Incorrect authorization in WebXR
    * CVE-2026-79211: Incorrect authorization in USB
    * CVE-2026-79252: Information leak in ServiceWorker
    * CVE-2026-78962: Uninitialized resource in WebXR
    * CVE-2026-78901: Race condition in V8
    * CVE-2026-79097: Use after free in V8
    * CVE-2026-79227: Type confusion in DevTools
    * CVE-2026-79203: Improper input validation in DevTools
    * CVE-2026-79033: Insufficient control flow management in DevTools
    * CVE-2026-79139: Improper input validation in Media
    * CVE-2026-79221: Uninitialized resource in Dawn
    * CVE-2026-79034: Information leak in CORS
    * CVE-2026-79075: Information leak in Geolocation
    * CVE-2026-78960: Information leak in Extensions
    * CVE-2026-78984: Uninitialized resource in GPU
    * CVE-2026-78963: Improper input validation in Media
    * CVE-2026-79004: Out of bounds read in Media
    * CVE-2026-79182: Improper input validation in Media
    * CVE-2026-79185: Information leak in DOM
    * CVE-2026-79073: Improper state validation in Parser
    * CVE-2026-79266: Use after free in DevTools
    * CVE-2026-79025: Improper input validation in Workers
    * CVE-2026-79141: Incorrect authorization in Browser
    * CVE-2026-78974: UI misrepresentation in Linux Toolkit Theming
    * CVE-2026-79055: Information leak in Sharing
    * CVE-2026-79263: Race condition in Extensions
    * CVE-2026-79124: Information leak in Intents
    * CVE-2026-79184: Missing authorization in Preload
    * CVE-2026-79289: Improper control of a resource through its lifetime in Workers
    * CVE-2026-79001: Information leak in Bluetooth
    * CVE-2026-79077: Incorrect authorization in WebProtect
    * CVE-2026-78950: Integer overflow in WebRTC
    * CVE-2026-79196: Race condition in Editing
    * CVE-2026-79000: Improper input validation in DeviceBoundSessionCredentials
    * CVE-2026-78979: Race condition in Core
    * CVE-2026-79181: Observable discrepancy in Glic
    * CVE-2026-79190: Incorrect authorization in Extensions
    * CVE-2026-79206: Out of bounds read in FileSystem
    * CVE-2026-78897: Missing authorization in BrowserTag
    * CVE-2026-79119: Use after free in PDF
    * CVE-2026-79089: Race condition in Transactions Platform
    * CVE-2026-79147: Information leak in Skia
    * CVE-2026-79098: UI misrepresentation in PermissionElement
    * CVE-2026-79022: UI misrepresentation in Transactions Platform
    * CVE-2026-79233: UI misrepresentation in CustomTabs
    * CVE-2026-79261: Incorrect authorization in Controls
    * CVE-2026-78977: Uninitialized resource in GPU
    * CVE-2026-79040: Uninitialized resource in GPU
    * CVE-2026-79273: Incorrect reference resolution in WebView
    * CVE-2026-79243: Improper input validation in ReadingList
    * CVE-2026-79123: Improper input validation in NTP Footer
    * CVE-2026-79005: Incorrect authorization in StorageAccessAPI
    * CVE-2026-79090: Improper privilege management in Actor
    * CVE-2026-78946: Incorrect authorization in Select
    * CVE-2026-78968: Missing authorization in Core
    * CVE-2026-79041: Missing authorization in Browser
    * CVE-2026-79284: UI misrepresentation in Core
    * CVE-2026-78896: Information leak in StorageAccessAPI
    * CVE-2026-79058: Missing authorization in Passwords
    * CVE-2026-79009: UI misrepresentation in UI
    * CVE-2026-79060: Incorrect authorization in StorageAccessAPI
    * CVE-2026-79177: Incorrect authorization in Media
    * CVE-2026-78956: Type confusion in V8
    * CVE-2026-79239: Out of bounds read in Tint
    * CVE-2026-79015: Improper input validation in ServiceWorker
    * CVE-2026-79108: UI misrepresentation in Web Authentication (Passkeys & Security Keys)
    * CVE-2026-79056: Use after free in ServiceWorker
    * CVE-2026-79018: Information leak in FoldableAPIs
    * CVE-2026-78980: Improper input validation in ReaderMode
    * CVE-2026-78947: Incomplete cleanup in Chromium
    * CVE-2026-79244: Use after free in Animation
    * CVE-2026-79112: Out of bounds read in Skia
    * CVE-2026-79246: Information leak in DataTransfer
    * CVE-2026-79223: Integer overflow in Chromium
    * CVE-2026-79045: Type confusion in V8
    * CVE-2026-79197: Use after free in V8
    * CVE-2026-79148: Off-by-one error in DevTools
    * CVE-2026-79125: Information leak in XR
    * CVE-2026-79207: Information leak in Passwords
    * CVE-2026-79017: Race condition in Extensions
    * CVE-2026-79105: Improper input validation in Mobile
    * CVE-2026-79225: Incorrect authorization in Browser
    * CVE-2026-79021: Missing authorization in InterestGroups
    * CVE-2026-79133: Incorrect authorization in Forms
    * CVE-2026-79179: Incorrect authorization in DOM
    * CVE-2026-79152: Incorrect authorization in CustomTabs
    * CVE-2026-78981: Information leak in Mobile
    * CVE-2026-78957: Information leak in Mobile
    * CVE-2026-79126: Incorrect provision of specified functionality in Proxy
    * CVE-2026-78915: Race condition in Enterprise
    * CVE-2026-79253: Improper input validation in Network
    * CVE-2026-79260: Improper input validation in Cookies
    * CVE-2026-79254: Incorrect reference resolution in CustomTabs
    * CVE-2026-78914: Uninitialized resource in Skia
    * CVE-2026-78964: Use after free in Sync


author: Than Ngo <than@redhat.com> - 152.0.7977.75-1
changelog:
  - Update to 152.0.7977.75
    * CVE-2026-84353: Use after free in Shared Tab Groups
    * CVE-2026-84352: Use after free in WebGL
    * CVE-2026-84354: Incorrect authorization in FileSystem
    * CVE-2026-84359: Information leak in Skia
    * CVE-2026-84357: Improper input validation in Omnibox
    * CVE-2026-84324: Use after free in Proxy
    * CVE-2026-84349: Use after free in Browser
    * CVE-2026-84326: Uninitialized resource in V8
    * CVE-2026-84333: Use after free in Dawn
    * CVE-2026-84351: Buffer overflow in GPU
    * CVE-2026-84325: Improper input validation in DataTransfer
    * CVE-2026-84328: Missing authorization in FileSystem
    * CVE-2026-84347: Use after free in WebRTC
    * CVE-2026-84323: Missing authorization in FileSystem
    * CVE-2026-84355: Incorrect authorization in Navigation
    * CVE-2026-84358: Improper privilege management in Downloads
    * CVE-2026-84332: Incorrect authorization in SiteSettings
    * CVE-2026-84330: UI misrepresentation in FullScreen
    * CVE-2026-84334: Incorrect authorization in Chromoting
    * CVE-2026-84348: Information leak in MediaCapture
    * CVE-2026-84335: Incorrect authorization in TabStrip
    * CVE-2026-84327: Incorrect authorization in Autofill
    * CVE-2026-84329: Confused deputy in CredentialProvider
    * CVE-2026-84356: UI misrepresentation in FullScreen
    * CVE-2026-84350: Use after free in TabStrip
    * CVE-2026-84331: Incorrect authorization in Actor


author: Than Ngo <than@redhat.com> - 152.0.7977.82-1
changelog:
  - Update to 152.0.7977.82
    * CVE-2026-85046: Type confusion in V8
    * CVE-2026-85052: Out of bounds read in CrashReporting
    * CVE-2026-85043: Incomplete cleanup in Network
    * CVE-2026-85048: Use after free in Compositing
    * CVE-2026-85045: Race condition in V8
    * CVE-2026-85050: Out of bounds write in WebGL
    * CVE-2026-85053: Improper resource exposure in CacheStorage
    * CVE-2026-85042: Use after free in DevTools
    * CVE-2026-85049: Use after free in Skia
    * CVE-2026-85051: Type confusion in Compositing
    * CVE-2026-85047: Improper input validation in Transactions Platform
    * CVE-2026-85044: Use of released resource in Mobile


author: Paulo Alcantara <paalcant@redhat.com> - 7.6-2
changelog:
  - cifs.upcall: fix regression with kerberos mounts
  - Resolves: rhbz#2497446
  - Resolves: rhbz#2496963
  - Resolves: rhbz#2489808 - CVE-2026-12505


author: Packit <hello@packit.dev> - 362-1
changelog:
  - Bug fixes and translation updates
  - Fix arbitrary code execution via specially crafted logs page link (CVE-2026-4802)


author: Packit <hello@packit.dev> - 366-1
changelog:
  - Networkmanager: Don't activate new network connections by default
  - Networkmanager: Navigate to details page after creation
  - Translations and dependency updates


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.0-1
changelog:
  - Bump to version 0.1.0
  - Add OPA provider sub-package
  - Add build-time version injection via ldflags


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.0-1
changelog:
  - Modernize spec for Fedora Go packaging guidelines
  - Adopt go-vendor-tools for vendored license verification
  - Fix debuginfo generation by switching to %gobuild macro
  - Use %gocheck2 for unit tests
  - Use %autorelease for automatic release numbering
  - Bump complyctl dependency to >= 1.0.0
  - Add Fedora 43 Go 1.25 compatibility workaround
  - Add main package for shared license files
  - Add aggregated vendored license expression


author: Marcus Burghardt <maburgha@redhat.com> - 0.2.0-1
changelog:
  - Bump to upstream version v0.2.0
  - XDG Base Directory paths for provider discovery
  - CPE-based datastream auto-detection for OpenSCAP
  - Aggregate extraction limits for complypack archives
  - Shared archive extraction in internal/archive package
  - Ampel tenet message and guidance surfacing
  - OPA complypack content path and mapping requirement
  - Remove Export RPC (upstream complyctl removed Exporter interface)


author: Marcus Burghardt <maburgha@redhat.com> - 0.2.1-1
changelog:
  - Bump to upstream version v0.2.1
  - Fix go-vendor-tools.toml license override path for go.yaml.in/yaml/v3
  - Add local RPM build and test documentation to RELEASE_PROCESS.md


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.0-1
changelog:
  - Update to release v2.3.0
  - Refreshed spec file using go2rpm
  - Build now using gobuild macro for most binaries.
  - 'go build' is used for containerd-shim-runc-v2 to emulate makefile static
    build


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.0-2
changelog:
  - Build shim as static-pie
  - Build shim as static using static-pie to retain pie benefits and static
    build. See https://github.com/containerd/containerd/discussions/13340#dis
    cussioncomment-16883392 for additional information.


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.1-1
changelog:
  - Update to release v2.3.1
  - Resolves: rhbz#2464270
  - Upstream feature enhancements and fixes
  - Resolves CVE-2026-34986: rhbz#2455637, rhbz#2455646
  - Resolves CVE-2026-35469: rhbz#2467593


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.2-1
changelog:
  - Update to release v2.3.2
  - Resolves: rhbz#2464270
  - Resolves CVE-2026-34986: rhbz#2455637, rhbz#2455646
  - Resolves CVE-2026-35469: rhbz#2467593
  - Resolves CVE-2026-50195
  - Resolves CVE-2026-53488
  - Resolves CVE-2026-53492
  - Resolves CVE-2026-53489
  - Resolves CVE-2026-47262
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.4-1
changelog:
  - Update to release v2.3.4
  - Resolves: rhbz#2514862
  - Upstream fixes and enhancements and breaking change


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.5-1
changelog:
  - Update to release v2.3.5
  - Resolves: rhbz#2528927
  - Resolves CVE-2026-53495
  - Resolves  GHSA-rp3h-jf77-q9p4
  - Upstream fixs and enhancements
  - Drops rpminspect.yaml
  - Add rpmlint.toml


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-5
changelog:
  - totemsrp: Return error if sanity check fails
    (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity
    (fixes CVE-2026-35092)


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-8
changelog:
  - totemsrp: Fix int overflow in commit_token_sanity
    (fixes CVE-2026-81666)
  - totempg: Replace assert with check in deliver_fn
    (fixes CVE-2026-81665)


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.34.11-1
changelog:
  - Update to release v1.34.11
  - Resolves: rhbz#2510870
  - Resolves CVE-2026-34986: rhbz#2455652
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.34.13-1
changelog:
  - Update to release v1.34.13
  - Resolves: rhbz#2527294
  - Upstream fixes
  - Likely the last v1.34 release


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.35.3-1
changelog:
  - Update to release v1.35.3
  - Resolves: rhbz#2466629
  - Fix CVE-2026-35469
  - Upstream fixes and new feature


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.0-6
changelog:
  - Document elf exception
  - The elf inspection in rpminspect apparently does not implement the
    'ignore' feature. CRI-O does have TEXTREL which elf marks as bad. The
    --skip-textrel option for annocheck works.


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.0-8
changelog:
  - Add internal/version.buildCommit to GO_LDFLAGS
  - Add the upstream 'internal/version.buildCommit' flag to GO_LDFLAGS using
    %{release} as the value


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.3-1
changelog:
  - Update to release v1.36.3
  - Resolves: rhbz#2510870
  - Resolves  CVE-2026-15809: rhbz#2500983
  - Upstream fixes


author: Packit <hello@packit.dev> - 5.4.4.0-1
changelog:
  - Update to version 5.4.4.0
  - Correct libdnf5-cli license to "GPL-2.0-or-later AND LGPL-2.1-or-later"
  - spec: Fix bcond ordering so plugin_systemd_inhibit is enabled
  - libdnf5: Fix dangling reference bug in is_vendor_change_allowed
  - spec: Mark all /etc configuration files as noreplacible
  - spec: Build-require perl(lib) for tests


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.30.0-1
changelog:
  - Update to release v0.30.0
  - Resolves CVE-2026-39984: rhbz#2458929
  - Upstream new features and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.31.0-1
changelog:
  - Update to release v0.31.0
  - Resolve CVE-2026-39829: rhbz#2489939, rhbz#2490056
  - Upstream new features and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.31.2-1
changelog:
  - Update to release v0.31.2
  - Upstream security fixes (including ones in v0.31.1)
  - GHSA-hw3h-2gp9-cxpv
  - GHSA-qx3x-mv6r-52p6
  - GHSA-32pv-7hq5-qhwq
  - GHSA-g2h8-426c-7976
  - GHSA-388v-wmr2-g2v2
  - GHSA-7236-3392-c5c6
  - GHSA-72x6-4j93-7w86
  - Additional fixes`


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.32.0-1
changelog:
  - Update to release v0.32.0
  - Upstream new features and fixes
  - Resolves CVE-2026-47262 - rhbz#2496456
  - Resolves CVE-2026-53492 - rhbz#2496552


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.33.0-2
changelog:
  - Update to new spec file
  - Regenerate spec file using go2rpm
  - Use gocheck2. Current v0.33.0 release will sometimes fail during check
    phase with an https related test. No obvious pattern related to
    architecture. gocheck2 will allow for test to be skipped if needed


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.34.0-1
changelog:
  - Update to release v0.34.0
  - Resolves: rhbz#2467576
  - Resolves CVE-2026-39984: rhbz#2458930
  - Upstream new features and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.35.0-1
changelog:
  - Update to release v0.35.0
  - Resolves: rhbz#2487819
  - Resolves CVE-2026-39828: rhbz#2489918, rhbz#2490102
  - Upstream enhancements, new features, and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.36.0-1
changelog:
  - Update to release v0.36.0
  - Resolves: rhbz#2506339
  - Upstream new features and fixes
  - Resolves CVE-2026-53492 - rhbz#2496553
  - Resolves CVE-2026-47262 - rhbz#2496436


author: Bradley G Smith <bradley.g.smith@gmail.com> - 5.1.3-1
changelog:
  - Update to release v5.1.3
  - Resolves rhbz#2458697
  - Resolves CVE-2026-33747: rhbz#2452188, rhbz#2452199
  - Resolves CVE-2026-33748: rhbz#2453089
  - Upstream fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 5.2.0-1
changelog:
  - Update to release v5.2.0
  - Resolves: rhbz#2491751
  - Important upstream note: This version introduces a new reconciliation
    algorithm between the observed state and the expected state. If you
    experience any issues with a Compose workload that was previously
    working, please open an issue with upsteam.
  - Additional upstream enhancements and fixes


author: Bradley G Smith <bradley.g.smith@gmail.com> - 5.3.0-1
changelog:
  - Update to release v5.3.0
  - Resolves: rhbz#2496535
  - Resolves CVE-2026-53492: rhbz#2496550
  - Resolves CVE-2026-47262: rhbz#2496433
  - Upstream note: This release introduces native support for init
    containers.
  - Additional upstream fixes and new features


author: Pavel Valena <pvalena@redhat.com> - 111-2
changelog:
  - fix(base): escape die() message in emergency hook script
  - fix(base): replace eval with safe variable indirection in splitsep and export_n
  - spec: json support for dracut-install (needed for detecting dlopen dependencies)


author: Hans de Goede <johannes.goede@oss.qualcomm.com> - 111-2
changelog:
  - fix(devicetree-firmware): include soc specific firmwares in install_generic()
  - fix(devicetree-firmware): include Qualcomm X2 laptop model specific firmwares


author: Aaron Merey <amerey@redhat.com> - 0.195-1
changelog:
  - Upgrade to upstream elfutils 0.195
  - Drop upstreamed patches
    elfutils-0.194-aarch64-Recognize-SHT_AARCH64_ATTRIBUTES.patch
    elfutils-0.194-alloc-jobs.patch
    elfutils-0.194-fix-const.patch
    elfutils-0.194-sh_addr-non-zero.patch
  - Add gelf.3 to %files
  - Enable eu-stacktrace on aarch64
  - Rename elfutils-default-yama-scope subpackage to yama-ptrace-enable,
    drop Requires on elfutils-libs, add Recommends on elfutils main
    package for FESCo Change #3569 (rhbz#2448388)


author: Aaron Merey <amerey@redhat.com> - 0.196-1
changelog:
  - Upgrade to upstream elfutils 0.196 (rhbz#2516216)
  - Obsolete all versions of elfutils-default-yama-scope so that the
    package from an older Fedora is removed on upgrade (rhbz#2515161)
  - Add eu-stackprof, a new tool for collecting systemwide stacktrace
    profiles, on x86/ARM
  - Remove the experimental eu-stacktrace tool along with the
    sysprof-capture-devel build dependency
  - Add libpfm-devel build dependency for eu-stackprof


author: Xavier Delaruelle <xavier.delaruelle@cea.fr> - 5.5.0-1
changelog:
  - Update to 5.5.0 (#2325175)
  - Require util-linux-core to get logger command for logging capabilities


author: Xavier Delaruelle <xavier.delaruelle@cea.fr> - 5.6.0-1
changelog:
  - Update to 5.6.0 (#2385838)
  - Add envml(1) man page
  - Use shell completion path macros
  - Install Emacs addon files
  - Use 'vimfiles_root' macro provided by vim-filesystem


author: Xavier Delaruelle <xavier.delaruelle@cea.fr> - 5.6.1-1
changelog:
  - Update to 5.6.1 (#2417160)
  - Update-alternatives is now available from _bindir
  - Update URL to https://envmodules.io
  - Add missing command to byte compile Elisp file


author: Peter Lemenkov <lemenkov@gmail.com> - 27.3.4.16-1
changelog:
  - Ver. 27.3.4.16

  8 Mon Jul 27 2026 Peter Lemenkov <lemenkov@gmail.com> - 27.3.4.15-1
  - Ver. 27.3.4.15


author: psklenar@redhat.com <psklenar@redhat.com> - 2.7.1-2
changelog:
  - fedora CI plans move to gitlab for centos-stream test space
    https://issues.redhat.com/browse/RHELMISC-13073


author: Vincent Mihalkovic <vmihalko@redhat.com> - 5.48-3
changelog:
  - Allow external decompressors to execute under Landlock
  - Migrate Python bindings to pyproject macros
    Resolves: rhbz#2513643
    Resolves: rhbz#2427330
    Resolves: rhbz#2378541


author: Martin Stransky <stransky@redhat.com> - 154.0-4
changelog:
  - Backported fix for HDR crash when HLG transform is missing
    (and it's always missing!).
  - Backported HDR fix for GL framebuffer (D318191).


author: Artur Frenszek-Iwicki <fedora@svgames.pl> - 3.2.2-16
changelog:
  - Convert License tag to SPDX
  - Add a patch to make generated code fallback to localhost if no DNS servers are specified
  - Add a patch to fix symbols being wrongly marked as unused


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.13.3-1
changelog:
  - Upstream release 4.13.3
  - Resolves: CVE-2026-11861, CVE-2026-13097, CVE-2026-19550, CVE-2026-73199, CVE-2026-73198, CVE-2026-73197, CVE-2026-73196


author: Ondrej Holy <oholy@redhat.com> - 2:3.27.1-1
changelog:
  - Update to 3.27.1 (CVE-2026-55191, CVE-2026-55192, CVE-2026-55193,
    CVE-2026-55194, CVE-2026-55648, CVE-2026-55827)
    Resolves: rhbz#2488900


author: Ondrej Holy <oholy@redhat.com> - 2.11.7-16
changelog:
  - Backport several CVE fixes (CVE-2026-22852, CVE-2026-22854, CVE-2026-22855,
    CVE-2026-22856, CVE-2026-22858, CVE-2026-22859, CVE-2026-23530,
    CVE-2026-23531, CVE-2026-23532, CVE-2026-23533, CVE-2026-23534,
    CVE-2026-23732, CVE-2026-23883, CVE-2026-23884, CVE-2026-23948,
    CVE-2026-24491, CVE-2026-24675, CVE-2026-24676, CVE-2026-24679,
    CVE-2026-24681, CVE-2026-24683, CVE-2026-24684, CVE-2026-25952,
    CVE-2026-26955, CVE-2026-26965, CVE-2026-26986, CVE-2026-27951,
    CVE-2026-29775, CVE-2026-31806, CVE-2026-31883, CVE-2026-31884,
    CVE-2026-31885, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985,
    CVE-2026-45700, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299 and
    CVE-2026-68580)
    Resolves: rhbz#2430919, rhbz#2430908, rhbz#2430898, rhbz#2430914, rhbz#2430903
    Resolves: rhbz#2430924, rhbz#2430933, rhbz#2429808, rhbz#2429823, rhbz#2429794
    Resolves: rhbz#2443146, rhbz#2442975, rhbz#2429799, rhbz#2429814, rhbz#2429821
    Resolves: rhbz#2438309, rhbz#2438321, rhbz#2438308, rhbz#2438328, rhbz#2438324
    Resolves: rhbz#2438302, rhbz#2438310, rhbz#2438300, rhbz#2447394, rhbz#2453243
    Resolves: rhbz#2453240, rhbz#2442837, rhbz#2442810, rhbz#2447426, rhbz#2447422
    Resolves: rhbz#2447413, rhbz#2447416, rhbz#2453247, rhbz#2442857, rhbz#2491683
    Resolves: rhbz#2510295, rhbz#2510643, rhbz#2503646, rhbz#2510448


author: Leo Sandoval <lsandova@redhat.com> - 2.12-69
changelog:
  - mm: try allocating regions above defined limit as last resource
  - Revert 'verifiers: Allocate EFI pages instead of grub_malloc for verified buffer'
  - Resolves: #2263643
  - Related: #2427945
  - Related: #2422881
  - Related: #2453022
  - Related: #2451630
  - Related: #2450672


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-1
changelog:
  - Bump to 1.5.18
  - Fix Backspace in prediction
  - Update translations
  - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI
  - Delete gnome-themes-extra from Fedora CI


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-4
changelog:
  - Fix some issues with thumb shift mode
  - return False for thumb-shift release keys
  - Add super key support for thumb shift mode


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.35~alpha2-4
changelog:
  - Fix typo in ibus-compose
  - Merge ibus-2444009-wayland-xkb-lv-tilde.patch
  - Fix CapsLock between focus changes in Wayland


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.35~beta1-1
changelog:
  - Resolves: #2512529 GTK 4.23.3 apps cause SIGSEGV with ibus-gtk4
  - Implement forward-key-event in Wayland input-method V2
  - Fix some issues in ibus-keypress


author: Packit <hello@packit.dev> - 73.0.0-1
changelog:
  Changes with 73.0.0
  ----------------
    - Update dependencies 2026-06-21 (#2451)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - Update osbuild dependency commit ID (#2450)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - disk: check all partitions for boot partition requirement (#2459)
      - Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - github: drop the reverse dependency check with image-builder-cli (#2454)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - imgtestlib: handle missing sources key in tests (#2447)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - osbuild: ddi mount (#2457)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal
    - rhel-10: reintroduce minimal-raw-xz (#2465)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal

  — Somewhere on the Internet, 2026-06-29


author: Packit <hello@packit.dev> - 74.0.0-1
changelog:
  Changes with 74.0.0
  ----------------
    - Test depsolvednf with dnf5 [HMS-10324] (#2475)
      - Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza
    - Update dependencies 2026-06-28 (#2472)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update dependencies 2026-07-05 (#2490)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - depsolvednf: don't require solver.json in test (#2479)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Brian C. Lane
    - distro/eln: use dnf5 and update package lists (#2482)
      - Author: Yaakov Selkowitz, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - gen-manifest: optimize checksum calculation (#2382)
      - Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Tomáš Hozza
    - generic/bootc: allow disk.yaml to provide root filesystem type (#2405)
      - Author: Joel Capitao, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - github: remove osbuild-composer reverse dependency test (#2477)
      - Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza
    - image-builder/build: add json format option (#2484)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - manifest: add firstboot support (HMS-9187) (#1913)
      - Author: Lukáš Zapletal, Reviewers: Brian C. Lane, Simon de Vlieger
    - many: plumb sdboot options (#2456)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - many: use `image-builder upload` in tests (HMS-10856) (#2476)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - partition_table: Make AlignUp clearer (#2419)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - pkg/rhsm: match subscription baseurls with wildcards (RHEL-36789) (#2460)
      - Author: Lucas Garfield, Reviewers: Achilleas Koutsou, Brian C. Lane, Lukáš Zapletal
    - progress: lock around sub progress (#2487)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - workflows: Add a link to the osbuild-composer API unit test results (#2469)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - workflows: Update old images urls to image-builder (#2468)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-07-08


author: Packit <hello@packit.dev> - 75.0.0-1
changelog:
  Changes with 75.0.0
  ----------------
    - Add hidden pkgsearch subcommand for querying available packages (HMS-11011) (#2515)
      - Author: Gianluca Zuccarelli, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - Always use seed argument directly (#2516)
      - Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - Enable basic bootc-image-builder tests [HMS-10851] (#2467)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Tomáš Koscielniak
    - Enable image-builder container builds [HMS-10851] (#2497)
      - Author: Achilleas Koutsou, Reviewers: Florian Schüller, Simon de Vlieger
    - Fedora ISO Modernization (HMS-9965) (#2533)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Sanne Raymaekers
    - Improve error message for pkgsearch with no packages (#2526)
      - Author: Gianluca Zuccarelli, Reviewers: Brian C. Lane, Lucas Garfield
    - README: update deprecated information in docs (#2498)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Run more bootc-image-builder tests in gitlab [HMS-10854] (#2520)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Tomáš Hozza
    - Update dependencies 2026-07-12 (#2513)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update osbuild dependency commit ID (#2512)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - Update snapshots to 20260705 (#2488)
      - Author: SchutzBot, Reviewers: Anna Vítová, Simon de Vlieger
    - bootc: support grub2 serial console customization (#2403)
      - Author: Jean-Baptiste Trystram, Reviewers: Brian C. Lane, Joel Capitao, Tomáš Hozza
    - build(deps): bump actions/checkout from 6 to 7 (#2452)
      - Author: dependabot, Reviewers: Anna Vítová, Simon de Vlieger
    - ci: enable allow-unsafe-pr-checkout in checkout/7 (#2523)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - cmd/image-builder: mock simple integration tests (HMS-10857) (#2473)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - disk: systemd-repart compatibility (#2510)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - fedora: drop slirp4netns from the IoT image (#2478)
      - Author: Peter Robinson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - image-builder: add hidden `--with-upload-result` option (#2521)
      - Author: Sanne Raymaekers, Reviewers: Brian C. Lane, Tomáš Hozza
    - pkg/disk: add XFS agcount option in `disk.yaml` (#2496)
      - Author: Jean-Baptiste Trystram, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - progress: add file progress (HMS-10977) (#2493)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Anna Vítová, Simon de Vlieger
    - test: fix build info cache path creation to use correct runner_distro (#2495)
      - Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - test: fix vm.py import error [HMS-11012] (#2522)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test: go 1.27 compatibility (#2504)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - test: mock cache dir (#2519)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová

  — Somewhere on the Internet, 2026-07-21


author: Packit <hello@packit.dev> - 76.0.0-1
changelog:
  Changes with 76.0.0
  ----------------
    - Restore anaconda-iso/iso type to bootc-image-builder (#2527)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update osbuild dependency commit ID (#2531)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - anaconda: enable shell shenanigans for anaconda (#2544)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - build(deps): bump actions/setup-go from 6 to 7 (#2532)
      - Author: dependabot, Reviewers: Achilleas Koutsou, Anna Vítová
    - eln: set runner to eln11 (#2535)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - image-builder: distro detection for `build` and `manifest` (#2542)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Ondřej Budai

  — Somewhere on the Internet, 2026-07-22


author: Packit <hello@packit.dev> - 77.0.0-1
changelog:
  Changes with 77.0.0
  ----------------
    - Generate bootc-image-builder test jobs dynamically and enable all tests [HMS-11073] (#2539)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Simon de Vlieger
    - Refactor CLI setup (#2503)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Update osbuild dependency commit ID (#2555)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - anaconda: rectify comment (#2548)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová, Lukáš Zapletal
    - bib: Replace logrus usage with olog (#2543)
      - Author: Brian C. Lane, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - bib_legacy: Use functions from bootc (#2540)
      - Author: Brian C. Lane, Reviewers: Anna Vítová, Lukáš Zapletal, Simon de Vlieger
    - build(deps): bump actions/setup-python from 6 to 7 (#2556)
      - Author: dependabot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - eln: enable `aarch64` for `gce` (HMS-11095) (#2558)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - github: enable building the bootc-image-builder container [HMS-11005] (#2549)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - gitlab: remove setup-show option for pytest (#2551)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Brian C. Lane
    - manifest/raw_bootc: support subscription registration on first boot (HMS-10897) (#2528)
      - Author: Lucas Garfield, Reviewers: Brian C. Lane, Simon de Vlieger
    - pkg/koji/upload: session credentials to headers (#2550)
      - Author: Anna Vítová, Reviewers: Florian Schüller, Sanne Raymaekers

  — Somewhere on the Internet, 2026-07-28


author: Packit <hello@packit.dev> - 78.0.0-1
changelog:
  Changes with 78.0.0
  ----------------
    - Simplify early manifest generation code and enable custom seeds for bootc-based images (#2565)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Update RHEL 9, 10 OCI image defs to add Oracle as cloud init datasource (#2559)
      - Author: src-up, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update osbuild dependency commit ID (#2576)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260719 (#2530)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - ci: tag containers (#2575)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - cmd/image-builder: drop `images` from version (#2573)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - container: add SetAuthFilePath method to Resolver (#2580)
      - Author: Ondřej Budai, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - disk: align footer to grain by default (#2562)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - disk: take the ESP size from the image type's partition table (RHEL-214147) (#2552)
      - Author: Lucas Garfield, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - distro/generic: pass subscription options to pxe-tar-xz images (HMS-11108) (#2564)
      - Author: Lucas Garfield, Reviewers: Achilleas Koutsou, Brian C. Lane
    - fedora: create 46 (#2546)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Florian Schüller
    - imgtestlib: configure setuptools package discovery (#2563)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test/imgtestlib: revert boot.py to old behaviour (#2579)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test: remove iot-bootable-container image type (#2569)
      - Author: Anna Vítová, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-08-10


author: Packit <hello@packit.dev> - 79.0.0-1
changelog:
  Changes with 79.0.0
  ----------------
    - Fix the container resolver tests (#2602)
      - Author: Achilleas Koutsou, Reviewers: Florian Schüller, Sanne Raymaekers
    - Run privileged unit tests on gitlab (#2603)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Start container with repos support for legacy ISO only [HMS-11156] (#2582)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
    - Update osbuild dependency commit ID (#2600)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260816 (#2599)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - anaconda_installer: platform build packages (#2589)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Sanne Raymaekers
    - distrodefs: Add aliases to Fedora for GCP (HMS-11182) (#2583)
      - Author: Tomáš Koscielniak, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - fedora: drop explicit `anaconda-widgets` (#2597)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Katerina Koukiou, Lukáš Zapletal
    - image-builder: reuse progress bars for upload (#2592)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Lukáš Zapletal, Simon de Vlieger
    - manifest: accept human-readable image sizes (#2571)
      - Author: tomatotomata, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - osbuild/rpm: implement generic env   (#2586)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - ova: set os type and virtual hardware version (HMS-3248) (#2480)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - packit: enable riscv64 (#2595)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - pkg/disk.yaml: add an option to not grow root (#2524)
      - Author: Jean-Baptiste Trystram, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - test: add GPG keys to Fedora 44 test repos (#2585)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Simon de Vlieger
    - test: mock host arch for package search (#2594)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal

  — Somewhere on the Internet, 2026-08-20


author: Packit <hello@packit.dev> - 82.0.0-1
changelog:
  Changes with 82.0.0
  ----------------
    - Enable bootc-image-builder ISO tests on aarch64 [HMS-11073] (#2637)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Lucas Garfield
    - Implement rootless container introspection (#2617)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Anna Vítová, Simon de Vlieger
    - Rewrite container handling internals to drop graphdriver and gpgme dependencies [RHEL-56367] (#2607)
      - Author: Achilleas Koutsou, Reviewers: Lucas Garfield, Simon de Vlieger
    - Update osbuild dependency commit ID (#2631)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - Update snapshots to 20260830 (#2630)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Anna Vítová
    - client: Respect CONTAINERS_GRAPHROOT and CONTAINERS_RUNROOT (#2645)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - cmd/image-builder: only run findDistro once (#2651)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - cmd/image-builder: upload messages progress bar (#2654)
      - Author: Simon de Vlieger, Reviewers: Florian Schüller, Sanne Raymaekers
    - el9/10: parity bits (#2659)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - gce: ensure disk images are GiB-aligned (#2655)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová
    - osbuild: compare Go against JSON (#2529)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Brian C. Lane
    - osinfo: never fall back if new prefix exists (#2649)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Brian C. Lane
    - osinfo: warn on old-prefix usage (#2648)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Gianluca Zuccarelli, Sanne Raymaekers
    - pkg/crypt: add support for yescrypt hashed passwords (#2650)
      - Author: Loris Fauster, Reviewers: Lucas Garfield, Simon de Vlieger
    - pkg/rhsm: use Katello CA as default on Satellite hosts (#2613)
      - Author: Lukáš Zapletal, Reviewers: Lucas Garfield, Simon de Vlieger
    - rm SECURITY.md: fall back to org-wide policy (#2633)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Simon de Vlieger
    - rootless: Don't disallow --in-vm in rootless non-container (#2626)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-09-04


author: Mikhail Medvedev 1.7.1-1
changelog:
  - Fix: pressing the Stop key did not stop auto operations
  - Added support for SPI NAND flash
  - Added traditional chinese translation
  - New chips added to database


author: Mikhail Medvedev 1.7.2-1
changelog:
  - Fix: NAND Flash information form freeze
  - Added new images for CH341A v1.7
  - Added programmer type menu
  - Added support for the AT24CM02 chip


author: Mikhail Medvedev 1.7.3-1
changelog:
  - Fix: Incorrect HexEdit size when starting the program
  - Added: saving program settings to an ini file


author: Mikhail Medvedev 1.8.1-1
changelog:
  - Fix: increased interface speed
  - Fix: increased SPI NOR Flash operations speed
  - Fix: incorrect chip page sizes values removed
  - Fix: unused files removed
  - Added: support for the CH347T programmer


author: Mikhail Medvedev 1.8.2-1
changelog:
  - Fix: error reading/writing data from I2C chips on the CH347T version 5.44
  - Fix: bit error during NOR/NAND operations in the CH347V1.1 programmer
  - Added: showing the programmer revision function
  - Added: erase check function
  - Added: filling code function


author: Mikhail Medvedev 1.8.3-1
changelog:
  - Fixed: If no chip is selected, the programmer was not detected
  - Fixed: MACOS library compatibility
  - Fixed: MACOS invalid pathes
  - Fixed: libusb detection
  - Fixed: udev rules install
  - Added: 2.5v VCC item
  - SPI NOR FLASH writing speed increased
  - Changed chip database update bash script to Qt app
  - The Zenity package is no longer used


author: Mikhail Medvedev 1.8.4-1
changelog:
  - Fixed: segmentation fault in Qt6
  - Fixed: incorrect interface display on macOS
  - Fixed: write error to sector 0 in Windows
  - Fixed: incorrect saving of the database file in the chip editor
  - Fixed: Unable to erase the 93C66, 93C76 and 93C86 chips
  - Fixed: the font is too large in Qt6
  - Added: migration to Qt6
  - Added: specification file for Fedora
  - Added: universal Qt5/Qt6 CmakeLists.txt
  - Added: support for the spare area for NAND flash memory.


author: Mikhail Medvedev 1.8.5-1
changelog:
  - Fixed: the first highlighted area in HexEdit was not being cleared
  - Fixed: combobox Operations was not reset if chip type changed
  - Fixed: program crashed if current chip is nothing and combobox Operation changed
  - Fixed: Operations label showed for all chip types
  - Added: I2C 5v0 images on info form
  - Added: support for I2C and SPI FeRAM chips


author: Mikhail Medvedev 1.8.6-1
changelog:
  - Removed unused files
  - Copyright added/changed
  - Fixed: if an error was detected, the sequence of operations was not interrupted
  - Fixed: when erasing I2C or SPI Flash, the STOP button did not stop the chip erasing
  - Fixed: the programmer version is not displayed after any chip operation
  - Fixed: chip database updater crashed when the internet connection was lost
  - Fixed: issues on macOS when using file selection dialogs
  - Added: support for 24LC515, 24LC1025


author: Mikhail Medvedev 1.9.1-1
changelog:
  - Added: support for the FH232H v1.2 device
  - Added: The chip delay database parameter used to adjust the SPI and I2C bus speed


author: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-9
changelog:
  - Reapply the change to keep symlinks managed by alternatives under /usr/bin,
    this time with a scriptlet create symlinks if /usr/sbin is unmerged.


author: Kevin Fenzi <kevin@scrye.com> - 1.8.12-1
changelog:
  - Update to 1.8.12. Fixes rhbz#2440980
  - Add patch to revert refuse to run under file capabilities and fix docker.


author: David Howells <dhowells@redhat.com> 0.7-1
changelog:
  - aklog-kafs: Update the cmdline options to be closer to standard aklog.
  - aklog-kafs: Reduce verbosity.
  - aklog-kafs: Allow the destination keyring to be specified.
  - aklog-kafs: Do better default keyring handling.
  - aklog-kafs: Improve error messages.
  - kafs-preload: Add a debug cmdline option and reduce some verbosity.
  - kafs-check-config: Use the kernel's rootcell if no cell specified.
  - Convert most manpages to POD form and supply a generation script.
  - kafs-check-config: Fix a missing inclusion of unistd.h.
  - lib: Fix a modification of a read-only string.
  - Move to using autoconf when building.
  - Generate manpages during the build.
  - kafs-preload: Honour the show_cell setting on each cell.
  - Add SPDX licence tags.
  - Remove the street address from the LICENCE file.


author: David Howells <dhowells@redhat.com> 0.8-1
changelog:
  - Updated cellservdb.
  - spec: Change to new format licence tag.
  - spec: Buildrequire make.
  - spec: Remove dep on filesystem-afs rpm.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 6.7.0-2
changelog:
  - Patch kamelion-qmk-helper for qmk-via-api 0.8
  - Account for licenses of statically-linked Rust dependencies


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [7.2.0-60]
changelog:
  - dracut-virt.conf: change systemd-pcrphase to systemd-pcrextend (Vitaly Kuznetsov)
  - redhat/kernel.spec.template: Switch UKI addons to using UKI cert (Vitaly Kuznetsov)
  - Linux v7.2.0


author: Justin M. Forbes <jforbes@fedoraproject.org> [7.2.1-0]
changelog:
  - Initial setup for stable Fedora release (Justin M. Forbes)
  - Reset Makefile.rhelver for the 7.3 cycle (Justin M. Forbes)
  - Merge configs into common for 7.2 (Justin M. Forbes)
  - redhat/configs: automotive: enable RTC_DRV_PL031 (Eric Chanudet)
  - redhat: name the dtb and UKI arch lists (Jan Stancek)
  - redhat: use one spelling for the nobuildarches files guard (Jan Stancek)
  - redhat: drop stale ppc64 from the kabidw-base arch list (Jan Stancek)
  - redhat: document the kabichk force-off as a seasonal toggle (Jan Stancek)
  - redhat: use one spelling for the include and gemini conditionals (Jan Stancek)
  - redhat: remove unused elf_image_install_path and duplicate defines (Jan Stancek)
  - redhat: drop the dead kernel-tools __requires_exclude python filter (Jan Stancek)
  - redhat: drop the Fedora 41 cross-build gdb-index workaround (Jan Stancek)
  - redhat: drop stale build switches from dist-perf and dist-rpm-baseonly (Jan Stancek)
  - redhat: give kernel-automotive its own summary (Jan Stancek)
  - redhat: drop leftover kernel_kvm_post calls for rt-64k (Jan Stancek)
  - redhat: restore missing summary of the kernel-debug variant (Jan Stancek)
  - redhat: fix parse error in baseonly sanity check message (Jan Stancek)
  - Linux v7.2.1


author: Justin M. Forbes <jforbes@fedoraproject.org> [7.2.3-0]
changelog:
  - Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 (Junjie Cao)
  - ACPI: scan: Do not combine resources that overlap completely (Rafael J. Wysocki)
  - ACPI: scan: Avoid registering platform devices with resource overlaps (Rafael J. Wysocki)
  - page_pool: keep frag_offset aligned for odd-sized requests (Florian Schauer) [2521546 2521847]
  - media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() (Laurent Pinchart)
  - media: i2c: cvs: Add NVL ACPI ID (Arun T)
  - media: i2c: cvs: Add IPU8 PCI device ID (Arun T)
  - random: Drop the extrng module reference when import_ubuf() fails (Junjie Cao) [2524262]
  - Add mechanism to back out the af_alg_restrict sysctl (Justin M. Forbes)
  - crypto: af_alg - Stop after finding name in allowlist (Eric Biggers)
  - crypto: af_alg - Replace 'bool privileged' with flags (Eric Biggers)
  - crypto: af_alg - Make cbc(paes) privileged-only (Eric Biggers)
  - crypto: af_alg - clean up kernel-doc warnings (Randy Dunlap)
  - crypto: af_alg - Allow additional ciphers for cryptsetup (Eric Biggers)
  - crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 (Eric Biggers)
  - Linux v7.2.3


author: Justin M. Forbes <jforbes@fedoraproject.org> [7.2.4-0]
changelog:
  - Remove unnecessary config file for Fedora (Justin M. Forbes)
  - Add F43 and F44 to release_targets (Justin M. Forbes)
  - Linux v7.2.4


author: Steve Cossette <farchord@gmail.com> - 6.27.0-1
changelog:
  - Initial release (Rename/version scheme change from kmime)
  - Removed doc subpackage (It's been empty for a while)
  - Cleaned up dependancies


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.37.0-1
changelog:
  - Add initial Kubernetes 1.37.0 release
  - Initial release for Fedora
  - Urgent (must read) upgrade notes at: https://github.com/kubernetes/kubern
    etes/blob/master/CHANGELOG/CHANGELOG-1.37.md#urgent-upgrade-notes
  - New features, enhancements, and fixes


author: Artur Frenszek-Iwicki <fedora@svgames.pl> - 4.8-3
changelog:
  - Build the IDE for all widgetsets, not just GTK2
  - Suffix qt5pas/qt6pas versions with Lazarus version instead of abusing the Release number


author: Fedor Vorobev <fvorobev@redhat.com> - 2.1.13-1
changelog:
  - Update to 2.1.13.
  - The following security vulnerabilites are fixed in this update:
  - * GHSA-fj29-64w6-73h6 CVE-2026-63383 https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6
  - * GHSA-45c6-qx49-89m8 CVE-2026-63384 https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8
  - * GHSA-cvq5-vrvr-j338 CVE-2026-63388 https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338
  - * GHSA-58rx-7448-jw47 CVE-2026-63387 https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47
  - * GHSA-2gmv-p5m7-98p6 CVE-2026-63379 https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6
  - * GHSA-c2pj-cg4r-88c8 CVE-2026-63381 https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
  - * GHSA-q39v-w2g7-gr8j CVE-2026-63382 https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j
  - * GHSA-jcwh-pvf2-73p2 CVE-2026-63385 https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2


author: Remi Collet <remi@remirepo.net> - 1.1.4-8
changelog:
  - fix test suite with memcached 1.6.40
    reported as https://github.com/awesomized/libmemcached/issues/161
    using fix from https://github.com/awesomized/libmemcached/pull/162


author: Remi Collet <remi@remirepo.net> - 1.1.4-12
changelog:
  - fix FTBFS #2504281
  - add patch for Sphinx 9 from
    https://github.com/awesomized/libmemcached/pull/159
  - re-license spec file to CECILL-2.1


author: Bradley G Smith <bradley.g.smith@gmail.com> - 0.2.4-3
changelog:
  - Initial pathrs release
  - Pathrs v0.2.4
  - Provides libpathrs used by runc and other packages
  - Exclude i686 arch


author: Milan Crha <mcrha@redhat.com> - 3.6.6-6
changelog:
  - Add patch for CVE-2026-1539 (Also remove Proxy-Authorization header on
    cross origin redirect)
  - Resolves: rhbz#2433867


author: Andreas Schneider <asn@redhat.com> - 0.26.10-1
changelog:
  - Update to version 0.26.10
  - https://github.com/tree-sitter/tree-sitter/releases/tag/v0.26.10
  - resolves: rhbz#2479963


author: Miro Hrončok <mhroncok@redhat.com> - 5.4.8-4
changelog:
  - Move the license file to lua-libs, so it is always present if any combination of subpackages is installed
  - Fixes: rhbz#2418960


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 0.5.3^20220831git2d4ba970-10
changelog:
  - F42+: Add old style pre scriptlet for LXDM user creation so as to make it work
    when upgrading from F41


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.10-11
changelog:
  - Remove redundand restorecon call, redirect safe to ignore output
    to /dev/null, mark module directory to avoid rpm verification


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.10-15
changelog:
  - Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling
    Resolves: #2513829


author: Aleksei Bavshin <alebastr@fedoraproject.org> - 0.2.19-1
changelog:
  - Update to 0.2.19
  - Build with Qt6
  - Convert License tag to SPDX
  - Use xwfb-run for tests instead of xvfb-run


author: Frantisek Krenzelok <fkrenzel@redhat.com> - 3.125.0-2
changelog:
  - fix the nspr version to full expansion
  - affected: https://bugzilla.redhat.com/show_bug.cgi?id=2488324


author: Rostislav Krasny <rostiprodev@gmail.com> - 3.125.0-2
changelog:
  - Reseed the freebl DRBG after fork() so forked children do not replay the
    parent's random stream (Firefox fork server duplicate UUIDs / crypto output)


author: Simon Pichugin <spichugi@redhat.com> - 2.6.10-4
changelog:
  - Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728)
  - Convert STI tests to FMF (rhbz#2382998)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:4.0.0~beta1-5
changelog:
  - Mark release as beta1 according to upstream naming.
  - Update requirements for better backward compatibility


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:4.0.1-3
changelog:
  - We use FIPS provider from a separate package and can drop
    FIPS-specific patches and stop building OpenSSL native FIPS provider


author: Pavol Žáčik <pzacik@redhat.com> - 1:4.0.1-5
changelog:
  - Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary
    (Backport from https://github.com/openssl/openssl/commit/4360d53)


author: Frank Lichtenheld <frank@lichtenheld.com> - 2.7.6-1
changelog:
  - Update to upstream 2.7.6 release
  - Drop obsolete patch 0001-test_tls_crypt-Fix-issue-with-temp-file-name-on-big-.patch


author: Neal Gompa <ngompa@fedoraproject.org> - 2.1.0-2
changelog:
  - Fix setting to background in LXQt sessions
  - Clean up spec formatting and changelog
  - Drop broken rpmautospec setup


author: Filipe Rosset <filiperosset@fedoraproject.org> - 5.4.3-1
changelog:
  - update to 5.4.3 fixes rhbz#2492868
  - a bunch of other bugs were fixed and will be backported to all supported
    Fedora / EPEL versions


author: Paul Howarth <paul@city-fan.org> - 4.40-1
changelog:
  - Update to 4.40
    - Fix overflow with overlong numbers, fuzzing only (CVE-2025-40929)
    - Detect more malformed numbers, with two decimal points
    - Pin Github actions to latest @v via pinact run -u


author: Paul Howarth <paul@city-fan.org> - 4.41-1
changelog:
  - Update to 4.41
    - Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
    - Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)
    - Fix incr_parse single-quote string delimiter (GH#245)
    - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
      truncated input (GH#244)


author: Paul Howarth <paul@city-fan.org> - 4.42-1
changelog:
  - Update to 4.42
    - Ensure encode with a type spec hashref does not change the hashref argument
      (GH#240)
    - Fix -e docs: "written" → "read" (GH#239)
    - Fix Boolean eq overload matching undef (GH#207); Cpanel::JSON::XS::Boolean
      overloaded eq would match undef as equal to false because undef stringifies
      to "" - added defined() guard
    - Fix error messages showing overloaded stringification for blessed objects
      (GH#191); error messages now use ClassName=TYPE(addr) format, bypassing any
      "" overload
    - Fix type_all_string overriding allow_blessed/convert_blessed (GH#175); with
      type_all_string + allow_blessed, blessed objects are now encoded as null
      (not stringified as HASH address)
    - Fix infinite recursion when encode is called from a "" overload (GH#128);
      the recursion guard temporarily clears convert_blessed and allow_stringify
      flags on the JSON object before calling the overload, preventing re-entrant
      encode loops
    - Fix $obj->new creating a broken object (GH#93); when new() is called on an
      existing object (e.g. $json->new->new), the class name is now extracted
      from the object's stash rather than using the stringified reference
    - Change allow_nonref default to true (GH#241, matching JSON::PP and
      JSON::XS 4.0+ and the insecure RFC 7159); encode and decode now accept
      non-reference values by default; decode_json() with an explicit 0/1 second
      argument still works; allow_nonref(0) to disable scalars-only for secure
      JSON
    - Fix minor t/12_blessed.t typo
    - Fix GH#112: encode large whole-number NV values without .0 on 32-bit Perl
      (values exceeding UV_MAX that Perl stores as float)
    - Fix GH#197: prefer IOK over pNOK when encoding values where IV is accurate
      but NV is imprecise (SvNOK not set)


author: Paul Howarth <paul@city-fan.org> - 4.43-1
changelog:
  - Update to 4.43
    - Fix canonical sort: Compare by UTF-16 code units per RFC 8785 (GH#248)
    - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8
      decoding instead of checking SvUTF8 flag, since older Perls may store valid
      UTF-8 hash keys without the flag set
    - Fix quadmath encode dropping ".0" for large floats (GH #246)
      - The .0 guard condition that suppressed appending for NV values > UV_MAX
        was incorrect on high-precision FP (quadmath, 128-bit long double on
        arm64) where %g uses fixed-point notation for values like 1.01e30
      - Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g
        naturally uses %e for large values


author: Paul Howarth <paul@city-fan.org> - 4.44-1
changelog:
  - Update to 4.44
    - Fix canonical sort infinite loop (GH#252): malformed UTF-8 keys (e.g.
      Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's
      (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer: now
      checked as 0 or > remaining length


author: Paul Howarth <paul@city-fan.org> - 2:1.66-1
changelog:
  - Update to 1.66 (rhbz#2346459)
    - Require Specio 0.50
      - That release has a bug fix for validation of integer values
      - Without the fix, DateTime could accept non-integer values for things like
        nanoseconds (GH#145)


author: Paul Howarth <paul@city-fan.org> - 2:1.67-1
changelog:
  - Update to 1.67 (rhbz#2526041)
    - Documented that the 'truncate' method can throw a fatal error if the
      truncation produces a datetime that doesn't exist in the local time zone,
      which can happen when truncating to a day (or more) in a time zone with a
      DST transition at midnight (GH#155)
    - Documented that 'rfc3339' does not include nanoseconds (GH#150)
    - Fixed docs for 'strftime' to remove the bit that said it returned the same
      values as the POSIX 'strftime'; this hasn't been the case for a long time
      (GH#148)


author: Remi Collet <remi@remirepo.net> - 2.4.0-1
changelog:
  - update to 2.4.0
  - raise dependency on libmongoc 2.4.0 and libmongocrypt 1.20.0
  - run upstream test suite without server


author: Jos de Kloe <josdekloe@gmail.com> 2.45.0-1
changelog:
  - move to upstream release 2.45.0
   (skipped version 2.44.0 due to bug https://github.com/ecmwf/eccodes-python/issues/145)


author: Miro Hrončok <mhroncok@redhat.com> - 3.15.0~b2-5
changelog:
  - Restore compatibility with setuptools nspkg.pth files in site module
  - Fixes: rhbz#2486045
  - Fixes: rhbz#2486059
  - Fixes: rhbz#2487621
  - Fixes: rhbz#2488369


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.02-1
changelog:
  - Update to 6.40.02
  - Rename the jupyroot and distrdf packages to reflect that they are
    now submodules of the main python package
  - New subpackages: root-graf3d-glad, root-net-curl,
    root-tmva-sofie-parser-python, root-tree-ml, root-histv7util
  - Dropped patches: 2
  - New patches: 7


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.02-5
changelog:
  - Use the system civetweb library since it now supports web sockets
  - Drop the davix module for Fedora 45+ (davix will soon be retired)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.04-1
changelog:
  - Update to 6.40.04
  - The root-roofit-jsoninterface package was merged with root-roofit-hs3
  - Fix calculation of kerning distances in generated PDF files
  - Dropped patches: 1
  - New patches: 2


author: Dmitry Belyavskiy <beldmit@gmail.com> - 6.11.1-4
changelog:
  - Backport of upstream OpenSSL4 commit
    https://github.com/qt/qtbase/commit/e806630e694d89f567cffa9c982d1f471089ecd8


author: Jan Grulich <jgrulich@redhat.com> - 6.11.1-2
changelog:
  - Upstream backport:
    - QQmlTableInstanceModel: refactor QModelIndex calculation out
      of QQuickTableView


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.13.0-4
changelog:
  - Rebuilt with rust-tar 0.4.45 for CVE-2026-33056
  - Restore binary package License expression, lost in a previous update


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-44
changelog:
  - Validate IPC message in provider-manager to prevent OOB access
    via malformed OperationHdr (CVE-2026-73583)
  - Use mktemp for sfcbrepos instance migration temp file to prevent
    TOCTOU symlink attack via /tmp/sfcbinst.mof (CVE-2026-73584)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com> - 261.2-1
changelog:
  - Version 261.2
  - a bugfix release with correctness and security-relevant fixes too. 276
    patches, so too much to describe here.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com> - 262~rc1-1
changelog:
  - Version 262~rc1
  - See https://raw.githubusercontent.com/systemd/systemd/v262-rc1/NEWS. Too
    many changes to list or discuss here.


author: Tom Callaway <spot@fedoraproject.org> - 2.1.0-1
changelog:
  - update to 2.1.0
  - update the bundled copy of libpng to 1.6.53
  - update the bundled copy of libtiff to 4.7.1
  - build for tcl/tk 9


author: Tom Callaway <spot@fedoraproject.org> - 2.1.1-1
changelog:
  - update to 2.1.1
  - bump libtiff to 4.7.2 (the tkimg libtiff library glue still versions at 4.7.1, because I didn't want to break compat when/if upstream makes a similar change)


author: Remi Collet <remi@remirepo.net> - 9.1.1-1
changelog:
  - Valkey 9.1.1 - Released Tue 21 July 2026
  - Upgrade urgency SECURITY: This release includes security fixes
    CVE-2026-56684 CVE-2026-63639
  - own /etc/logrotate.d as its owner is an optional dependency
  - refresh the documentation
  - drop OpenSSL 4 patch merged upstream


author: Remi Collet <remi@remirepo.net> - 9.1.2-1
changelog:
  - Valkey 9.1.2 - Released Mon 31 August 2026
  - Upgrade urgency SECURITY: This release includes security fixes


author: Michel Lind <salimma@centosproject.org> - 0.4-1
changelog:
  - Update to version 0.4
  - Apply temporary blazesym workaround to swallow /proc/kcore EPERM when
    querying KASLR


author: Michel Lind <salimma@centosproject.org> - 0.5-1
changelog:
  - Update to version 0.5
  - Apply build flags consistently
  - Update licenses to account for bundled dependencies


author: Michel Lind <salimma@centosproject.org> - 0.5-2
changelog:
  - fix to show SHA commit in help text
  - also ensure `make install` uses the right build flags
  - include all bundled projects' licenses


author: Michel Lind <salimma@fedoraproject.org> - 0.5-3
changelog:
  - Drop rust_arches; no longer needed. But limit builds to the architectures
    strobelight-libs supports


author: Michel Lind <salimma@fedoraproject.org> - 0.8.0-1
changelog:
  - Update to 0.8.0 upstream release
  - Resolves: rhbz#2443508
  - Re-enable debuginfo generation
  - Enable Packit
  - Verified the SPDX license conversion


