# changelog

author: Li Nan <linan122@huawei.com> - 6.6.0-89.0.0.83
changelog:
  - !16087  CVE-2025-21979
  - !16102 V3:mm: shmem: skip swapcache for swapin of synchronous swap device
  - !16144 [openEuler-24.03-LTS-SP2] drivers: update Yunsilicon drivers to 2412GA
  - !16101  scsi: qla1280: Fix kernel oops when debug level > 2
  - !16103  md/raid1,raid10: don't ignore IO flags
  - !16055 mailbox: pcc: Always clear the platform ack interrupt first
  - !16143  Revert "tmpfs: fault in smaller chunks if large folio allocation not allowed"
  - !16108  mm: zswap: handle incorrect attempts to load large folios
  - !16075  mpage: fix softlockup in mpage_readahead()
  - !16079 v2  tracing: Verify event formats that have "%*p.."
  - Revert "tmpfs: fault in smaller chunks if large folio allocation not allowed"
  - !16117  PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
  - !16116  spufs: fix gang directory lifetimes
  - drivers: update Yunsilicon drivers to version rel_2412_std_card
  - mailbox: pcc: Always clear the platform ack interrupt first
  - mailbox: pcc: Fix the possible race in updation of chan_in_use flag
  - !16099  fs/resctrl: Create l2 cache monitors
  - PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
  - spufs: fix gang directory lifetimes
  - !15719 vdpa/iommufd: Support taking over vDPA devices' iommu groups through the iommufd API
  - !14169 [OLK-6.6] Fix rnp errors dmesg show in hygon
  - !14174 [OLK-6.6] Fix os crash when cat some sys interface when net down
  - !14100 [OLK-6.6] mucse: rnpm ocp nic support hotplug and show sub-zero temperature
  - !16080  PCI/ASPM: Fix link state exit during switch upstream function removal
  - !16074  x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
  - !16073  acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
  - !15908  soc: qcom: pdr: Fix the potential deadlock
  - !16094  ksmbd: fix session use-after-free in multichannel connection
  - mm: zswap: handle incorrect attempts to load large folios
  - md/raid1,raid10: don't ignore IO flags
  - !16086  media: streamzap: fix race between device disconnection and urb callback
  - mm: shmem: skip swapcache for swapin of synchronous swap device
  - mm: swap: remove 'synchronous' argument to swap_read_folio()
  - vhost/vdpa: Add support to bind and attach iommufd
  - scsi: qla1280: Fix kernel oops when debug level > 2
  - !15897 Two backport bugfix patches
  - !15948 mm/huge_memory: drop beyond-EOF folios with the right number of refs
  - arm64/mpam: Refuse to enter powerdown state after L2 msc updated
  - arm64/mpam: Refuse cpu offline when L2 msc is enabled
  - fs/resctrl: Add l2 mount option to enable L2 msc
  - arm64: mpam: Restore the expected MPAM sysregs on cpuhp
  - arm64: mpam: Add cpu_pm notifier to restore MPAM sysregs
  - fs/resctrl: Create l2 cache monitors
  - x86/resctrl: Add a handling path of default label in get_arch_mbm_state()
  - ksmbd: fix session use-after-free in multichannel connection
  - !16034  swap-in support large folio
  - !15994  ksmbd: fix use-after-free in ksmbd_sessions_deregister()
  - !16066  rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
  - !16062  arm64/mpam: Expanding MPAM's QoS capability
  - !16053  jfs: add check read-only before truncation in jfs_truncate_nolock()
  - !16037  ext4: fix the logic to determine whether buffered IO can use iomap
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails
  - wifi: cfg80211: cancel wiphy_work before freeing wiphy
  - media: streamzap: fix race between device disconnection and urb callback
  - !15986  RDMA/hns: Fix the compatibility between the kernel mode and user mode
  - PCI/ASPM: Fix link state exit during switch upstream function removal
  - tracing: Verify event formats that have "%*p.."
  - mpage: fix softlockup in mpage_readahead()
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
  - !16045  irqchip/mbigen: add check before deference 'mgn_chip'
  - rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
  - arm64/mpam: Add limit feature
  - arm64/mpam: Add PRIO feature
  - arm64/mpam: Add mbw_min and cmin features
  - arm64/mpam: Add CMAX feature
  - fs/resctrl: As a pre-patch for expanding MPAM's QoS capability
  - soc: hisilicon: kunpeng_hccs: Fix incorrect string assembly
  - jfs: add check read-only before truncation in jfs_truncate_nolock()
  - !15887  LoongArch: sync internal repository 20250414
  - !15937  md/raid1: fix memleak and double free in
  - irqchip/mbigen: add check before deference 'mgn_chip'
  - ext4: fix the logic to determine whether buffered IO can use iomap
  - mm: add per-order mTHP swap-in fallback/fallback_charge counters
  - mm: add per-order mTHP swpin counters
  - mm: fix PSWPIN counter for large folios swap-in
  - mm: remove unused stub for can_swapin_thp()
  - mm: zswap: fix zswap_never_enabled() for CONFIG_ZSWAP==N
  - mm: support large folios swap-in for sync io devices
  - mm: add nr argument in mem_cgroup_swapin_uncharge_swap() helper to support large folios
  - mm: zswap: add zswap_never_enabled()
  - mm: convert swap_cluster_readahead and swap_vma_readahead to return a folio
  - mm: return a folio from read_swap_cache_async()
  - mm: remove page_swap_info()
  - mm: convert swap_readpage() to swap_read_folio()
  - mm: convert swap_page_sector() to swap_folio_sector()
  - mm: pass a folio to swap_readpage_bdev_async()
  - mm: pass a folio to swap_readpage_bdev_sync()
  - mm: pass a folio to swap_readpage_fs()
  - mm: pass a folio to swap_writepage_bdev_async()
  - mm: pass a folio to swap_writepage_bdev_sync()
  - mm: pass a folio to swap_writepage_fs()
  - mm: pass a folio to __swap_writepage()
  - mm: return the folio from __read_swap_cache_async()
  - !15931  CVE-2025-22113
  - !16023  CVE-2025-22121
  - ext4: Restore the deleted check paths of the xattr.
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
  - ext4: introduce ITAIL helper
  - !15918 [OLK-6.6] 从上游linux-6.6.y回合nvme驱动重要bugfix
  - !15589 [OLK-6.6] Ethernet: Supports Linkdata ethernet Controllers
  - !15962  LoongArch: BPF: Don't override subprog's return value
  - !16007  compile error: implicit declaration of
  - kvm: hisi_virt: Fix compilation error due to missing ACPI configuration
  - !15981  LoongArch: BPF: Fix off-by-one error in build_prologue()
  - !15935  HID: appleir: Fix potential NULL dereference at raw event handle
  - !15988  fs/resctrl: Fix configuration to wrong control group when CDP is enabled
  - ksmbd: fix use-after-free in ksmbd_sessions_deregister()
  - !15970  erofs/cachefiles: Change the unmark inuse sequence in erofs ondemand mode
  - fs/resctrl: Fix configuration to wrong control group when CDP is enabled
  - arm64/mpam: Add debugging information about CDP monitor value
  - arm64/mpam: Fix allocated cache size information
  - fs/resctrl: Fix kmemleak caused by closid_init()
  - arm64/mpam: Correct the judgment condition of the CMAX feature
  - arm64/mpam: Set the cpbm width of msc class with the minimum
  - fs/resctrl: Determine whether the MBM monitors require overflow checking
  - arm64/mpam: Optimize CSU/MBWU monitor multiplexing
  - arm64/mpam: fix impossible condition in resctrl_arch_rmid_read()
  - arm64/mpam: fix impossible condition in get_cpumask_from_cache_id()
  - arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait()
  - RDMA/hns: Fix the compatibility between the kernel mode and user mode
  - LoongArch: BPF: Fix off-by-one error in build_prologue()
  - erofs/cachefiles: Change the unmark inuse sequence in erofs ondemand mode
  - LoongArch: BPF: Don't override subprog's return value
  - mm/huge_memory: drop beyond-EOF folios with the right number of refs
  - md/raid1: fix memory leak in raid1_run() if no active rdev
  - md/raid1: don't free conf on raid0_run failure
  - HID: appleir: Fix potential NULL dereference at raw event handle
  - ext4: avoid journaling sb update on error if journal is destroying
  - ext4: define ext4_journal_destroy wrapper
  - mm: fix filemap_get_folios_contig returning batches of identical folios
  - nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
  - nvme-tcp: fix possible UAF in nvme_tcp_poll
  - soc: qcom: pdr: Fix the potential deadlock
  - selftests: mincore: fix tmpfs mincore test failure
  - LoongArch: Export some signal functions
  - LoongArch: Make some signal and ptrace functions non-static
  - LoongArch: Handle fp, lsx, lasx and lbt assembly symbols
  - LoongArch: Preserve firmware configuration if ACPI requires.
  - LoongArch: configs: enable some configs
  - LoongArch: configs: set CONFIG_UNWINDER_ORC=y
  - LoongArch: configs: Disable CONFIG_RT_GROUP_SCHED to prevent cgroup2 issues
  - objtool: Fix C jump table annotations for Clang
  - Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - RNP: NET: Fix rnp errors dmesg show in hygon
  - net: mucse: Fix os crash when cat some sys interface when net down
  - mucse: rnpm ocp nic support hotplug and show sub-zero temperature


author: jianmin <jianmin@iscas.ac.cn> - 1.34.1-5
changelog:
  - Type:cve
  - CVE:CVE-2024-3727 CVE-2024-24791
  - SUG:NA
  - DESC: fix CVE-2024-3727 and Rebuild to fix CVE-2024-24791


author: liuxu <liuxu156@huawei.com> - 1:1.36.1-6
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: wangqiang <wangqiang1@kylinos.cn> - 17.0.6-16
changelog:
  - Ignored the `-Wa,--generate-missing-build-notes=` option, update llvm-lit config to support macro `build_for_openeuler`


author: wangqiang <wangqiang1@kylinos.cn> - 17.0.6-17
changelog:
  - Complete -fgcc-compatible option scope to Langopts and Diagopts, and handling of option `-Wall` and `-Werror=format=2` override `-Wno`


author: Zhao Mengmeng <zhaomengmeng@kylinos.cn> - 17.0.6-18
changelog:
  - Fix the too-early instantiation of conditional "explict" by applying the patch
    of https://github.com/llvm/llvm-project/commit/128b3b61fe6768c724975fd1df2be0abec848cf6


author: shixuantong <shixuantong1@huawei.com> - 23.4.1-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add python3-passlib to BuildRequires
         skip some test if there are multiple NICs with the MAC address 'ee:ee:ee:ee:ee:ee'
         fix: unpin jsonschema and update tests
         test: fix tmpdir in test_cc_apk_configure
         bug(tests): mock reads of host's /sys/class/net via  get_sys_class_path
         test: fix disable_sysfs_net mock
         tests: drop CiTestCase and convert to pytest


author: shixuantong <shixuantong1@huawei.com> - 23.4.1-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix growpart race
         handle error when log file is empty
         ec2: Do not enable dhcp6 on EC2


author: shixuantong <shixuantong1@huawei.com> - 23.4.1-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:disable use-dns for secondary nics
         Make duplicate route add succeed
         Fix predictable interface rename issue


author: dongyuzhen <dongyuzhen@h-partners.com> - 23.4.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix(net): klibc ipconfig PROTO compatibility
         fix(openstack): Fix bond mac_address


author: Han Jinpeng <hanjinpeng@kylinos.cn> - 309-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: remove incorrect provides cockpit-machines and cockpit-machines-ovirt
          remove require libvirt and libvirt-client


author: zhangzikang <zhangzikang@kylinos.cn> - 1.6.22-14
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add loong64 to THP patch, fix build error for loongarch64
         fix incorrect dates


author: Peng Fan <fanpeng@loongson.cn> - 12.3.1-33
changelog:
  - Type: Sync
  - DESC: Optimize the loading of immediate numbers.
  -       Fixed bug in bstrins_<mode>for_ior_mask.


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 12.3.1-38
changelog:
  - Type: Sync
  - DESC: Sync patches for fixing building issues with clang
  - Source: https://gitee.com/openeuler/gcc/pulls/239


author: shaojiansong <shaojiansong@kylinos.cn> - 8.0.4-3
changelog:
  - Fix lack of loongarch64 and sw_64 patch files in src.rpm package which is build from any platform.


author: shenzhongwei <shenzhongwei@kylinos.cn> - 8.0.4-10
changelog:
  - remove the architecture judgment in the patches section;
  - include all patches in the source package.


author: lijian <lijian2@kylinos.cn> - 1.8.7-1
changelog:
  - update to 1.8.7
  - crun: new command "crun features".
  - linux: support io_priority from the OCI specs.
  - cgroup: allow setting swap to 0.
  - cgroup, systemd: set the memory limit on the system scope.


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:paramhlp: fix CRLF-stripping files with "-d @file"
         libssh2: set length to 0 if strdup failed
         openldap: create ldap URLs correctly for IPv6 addresses
         multi: avoid memory-leak risk
         tool_cfgable: free {proxy_}cipher13_list on exit


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:multi: check that the multi handle is valid in curl_multi_assign


author: xingwei <xingwei14@h-partners.com> - 8.4.0-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:altsvc: avoid integer overflow in expire calculation
         urlapi: fix redirect to a new fragment or query (only)
         tool_getparam: clear sensitive arguments better


author: yanglu <yanglu72@h-partners.com> - 8.1.2-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:vtls:avoid memory leak if sha256 call fails
         urlapi:make sure zoneid is also duplicated in curl_url_dup


author: zhouyihang <zhouyihang3@h-partners.com> - 8.1.2-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:transfer: also stop the sending on closed connection
         openssl: avoid BN_num_bits() NULL pointer derefs


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-4
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:delete report url added by other upstream patch to keep pace with DHCP


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-5
changelog:
  - Type:CVE
  - ID:CVE-2022-2795,CVE-2022-38177,CVE-2022-38178
  - SUG:restart
  - DESC:fix CVE-2022-2795,CVE-2022-38177 and CVE-2022-38178


author: chenhaixing <chenhaixing@huawei.com> 4.14.0-12
changelog:
  - CVE:NA
  - SUG:NA
  - DESC:dnf:fix undo error when include rollback of group upgrade
             fix can't download package when url have characters encoded


author: hanhuihui <hanhuihui5@huawei.com> - 4.16.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dnf:Remove --duplicates and --oldinstallonly exit with 0 when nothing to remove and Add all candidates for reinstall to solver


author: LuWu <2398491106@qq.com> - 4.16.2-5
changelog:
  - Limit queries to nevra forms when provided by command and Update the man page entry for the countme option


author: renmingshuai <renmingshuai@huawei.com> - 2.89-2
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Fix memory leak when using --dhcp-optsfile with DHCPv6 options


author: lingsheng <lingsheng1@h-partners.com> - 2.90-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         cache: Fix potential NULL deref in arcane situations.
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         allow binding mac with ip6


author: zhangbowei<zhangbowei@kylinos.cn> - 25.0.3-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix bug by using docker-proxy in the source file to get better compatibility


author: suoxiaocong <suoxiaocong@kylinos.cn> - 18.09.0-337
changelog:
  - Type:BUG
  - CVE:NA
  - SUG:NA
  - DESC:remove ifarch condition check when addding source, this causes src.rpm missing files


author: huangdengdui <huangdengui@huawei.com> - 23.11-10
changelog:
  Sync some patches for hns3 about PFC and RSS
   - net/hns3: support new device
   - app/testpmd: fix RSS algorithm choice
   - net/hns3: enable PFC for all user priorities


author: huangdengdui <huangdengui@huawei.com> - 23.11-14
changelog:
  Package the following example to dpdk-tools:
   dpdk-l3fwd, dpdk-l3fwd-power, dpdk-ethtool, dpdk-dma, dpdk-ptpclient


author: huangdengdui <huangdengui@huawei.com> - 23.11-17
changelog:
  Sync some patchs from upstreaming for hns3 pmd and modifications
   are as follow:
   - dma/hisilicon: remove support for HIP09 platform
   - net/hns3: disable SCTP verification tag for RSS hash input
   - net/hns3: fix variable overflow
   - net/hns3: fix double free for Rx/Tx queue
   - net/hns3: fix read Rx timestamp handle
   - net/hns3: fix offload flag of IEEE 1588
   In addition, the following patch synchronizes the latest version
   - ethdev: fix strict aliasing lead to link cannot be up


author: yinbin <yinbin8@huawei.com> - 23.11-18
changelog:
  - change dpdk-* in dpdk-tools  from dynamic build to static build
  - add -s flag to remove symbols of dpdk-* in dpdk-tools


author: huangdengdui <huangdengui@huawei.com> - 23.11-19
changelog:
  Support more VLAN fields matching for hns3 and sync a bugfix
   - net/hns3: add Rx DMA address align check
   - net/hns3: support more VLAN fields matching


author: huangdengdui <huangdengui@huawei.com> - 23.11-24
changelog:
  Sync some patchs from upstreaming, includind some bugfixes, hns3 pmd
   flow rule priority feature, hns3 pmd outer VLAN flow match feature,
   and support dump reigser names and filter.
   This patch set is modified as follows:
   - net/hns3: fix cannot fully use hardware flow director table
   - net/hns3: fix error code for repeatedly create counter
   - net/hns3: support flow rule priority
   - common/nfp: use new kvargs process API
   - net/tap: use new kvargs process API
   - net/sfc: use new kvargs process API
   - kvargs: rework process API
   - net/hns3: fix variable type
   - net/hns3: fix pointer offset
   - net/hns3: fix error log
   - net/hns3: support filtering registers by module names
   - net/hns3: support reporting names of registers
   - net/hns3: refactor register dump
   - net/hns3: remove separators between register module
   - net/hns3: fix dump counter of registers
   - net/hns3: remove some basic address dump
   - telemetry: register command with private argument
   - ethdev: fix race on ports in telemetry endpoints
   - ethdev: add telemetry command for registers
   - ethdev: add report of register names and filter
   - net/hns3: support outer VLAN flow match
   - net/hns3: register VLAN flow match mode parameter
   - net/hns3: support general tunnel flow match
   - net/hns3: restrict tunnel flow rule to one header
   - net/hns3: remove ROH devices
   - net/hns3: dump queue head and tail pointer info
   - dmadev: fix potential null pointer access
   - net/hns3: verify reset type from firmware
   - ethdev: verify queue ID in Tx done cleanup


author: - Chenxi Mao <chenxi.mao@suse.com> - 1.25-1
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Upgrade dwarves version to 1.25 to fix build error
          if kernel version upgrade to 6.4


author: lifeifei<lifeifei@kylinos.cn> - 2.0.11-10
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix: if libvirt and ebtables are installed at the same time, ping the operation prompts "sendmsg: Operation not permitted".


author: xinghe <xinghe2@h-partners.com> - 2.0.11-12
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix ebtables-restore --noflush failed when ebtables is uninstall


author: yexiao<yexiao7@huawei.com> - 202308-5
changelog:
  - fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 18-4
changelog:
  - Fix segfault when passed --index is greater than current boot order size
    Add missing short option handling for --index (-I)


author: zhangxingrong <zhangxingrong@uniontech.com> - 18-5
changelog:
  - Fix the incorrect long parameter in help messages
  - efibootmgr: delete_bootnext is just a boolean, not an entry id


author: fuanan <fuanan3@h-partners.com> - 0.189-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Remove unnecessary patch because this patch is contained in elfutils-0.189.tar


author: lifeifei <lifeifei@kylinos.cn> - 0.190-3
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:add noreplace to /usr/lib/sysctl.d/10-default-yama-scope.conf


author: wangqiang <wangqiang1@kylinos.cn> - 0.190-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: Fix handling of corefiles with non-contiguous .so segments


author: shixuantong <shixuantong1@huawei.com> - 0.190-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:move /usr/lib64/libdebuginfod.so from debuginfod-client-devel to debuginfod-client


author: lvxiangcong <lvxiangcong@kylinos.cn> - 3.4.14-16
changelog:
  - Type:CVES
  - ID:CVE-2024-24791 CVE-2023-45288 CVE-2024-24783 CVE-2024-24785 CVE-2023-45290
       CVE-2023-39326
  - SUG:NA
  - DESC:Batch fix cves through rebuild


author: wangkai <13474090681@163.com> - 102.14.0-1
changelog:
  - Update to 102.14.0
  - Fix CVE-2023-4045 CVE-2023-4046 CVE-2023-4047 CVE-2023-4048 CVE-2023-4049 CVE-2023-4050 CVE-2023-4054 CVE-2023-4055 CVE-2023-4056


author: lvfei <lvfei@kylinos.cn> - 102.15.0-1
changelog:
  - Update to 102.15.0
  - Fix CVE-2023-4573 CVE-2023-4574 CVE-2023-4575 CVE-2023-4576  CVE-2023-4581 CVE-2023-4584


author: wangkai <13474090681@163.com> - 115.9.0-1
changelog:
  - Update to 115.9.0
  - Fix CVE-2024-2616 CVE-2024-2608 CVE-2024-2610 CVE-2024-2612 CVE-2024-2614 CVE-2023-5388 CVE-2024-2607 CVE-2024-2611
  - CVE-2024-1546 CVE-2024-1549 CVE-2024-1547 CVE-2024-1553 CVE-2024-1551 CVE-2024-1548 CVE-2024-1552 CVE-2024-1550
  - CVE-2024-0750 CVE-2024-0746 CVE-2024-0742 CVE-2024-0741 CVE-2024-0747 CVE-2024-0751 CVE-2024-0749 CVE-2024-0753 CVE-2024-0755
  - CVE-2023-6856 CVE-2023-6859 CVE-2023-6857 CVE-2023-6860 CVE-2023-6867 CVE-2023-6858 CVE-2023-6865 CVE-2023-6863 CVE-2023-6861 CVE-2023-6864


author: wangkai <13474090681@163.com> - 115.12.0-1
changelog:
  - Update to 115.12.0
  - Fix CVE-2024-29944 CVE-2024-3302 CVE-2024-3852 CVE-2024-3854
    CVE-2024-3857 CVE-2024-3859 CVE-2024-3861 CVE-2024-3864 CVE-2024-4367
    CVE-2024-4767 CVE-2024-4768 CVE-2024-4769 CVE-2024-4770 CVE-2024-4777
    CVE-2024-5688 CVE-2024-5690 CVE-2024-5691 CVE-2024-5692 CVE-2024-5693
    CVE-2024-5696 CVE-2024-5700 CVE-2024-5702


author: wangkai <13474090681@163.com> - 115.14.0-1
changelog:
  - Update to 115.14.0
  - Fix CVE-2024-7519 CVE-2024-7521 CVE-2024-7522 CVE-2024-7524
    CVE-2024-7525 CVE-2024-7526 CVE-2024-7527 CVE-2024-7529 CVE-2024-7531


author: wangkai <13474090681@163.com> - 128.4.0-1
changelog:
  - Update to 128.4.0
  - Fix CVE-2024-10458 CVE-2024-10459 CVE-2024-10460 CVE-2024-10461 CVE-2024-10462
    CVE-2024-10463 CVE-2024-10464 CVE-2024-10465 CVE-2024-10466 CVE-2024-10467


author: wangkai <13474090681@163.com> - 128.5.0-1
changelog:
  - Update to 128.5.0
  - Fix CVE-2024-11691 CVE-2024-11692 CVE-2024-11694 CVE-2024-11695 CVE-2024-11696
    CVE-2024-11697 CVE-2024-11699


author: wangkai <13474090681@163.com> - 128.6.0-1
changelog:
  - Update to 128.6.0
  - Fix CVE-2025-0237 CVE-2025-0238 CVE-2025-0239 CVE-2025-0240 CVE-2025-0241
    CVE-2025-0242 CVE-2025-0243


author: wangkai <13474090681@163.com> - 128.7.0-1
changelog:
  - Update to 128.7.0
  - Fix CVE-2025-1009 CVE-2025-1010 CVE-2025-1011 CVE-2025-1012 CVE-2025-1013
    CVE-2025-1014 CVE-2025-1016 CVE-2025-1017


author: wangkai <13474090681@163.com> - 128.8.0-1
changelog:
  - Update to 128.8.0
  - Fix CVE-2024-43097 CVE-2025-1931 CVE-2025-1932 CVE-2025-1933 CVE-2025-1934
    CVE-2025-1935 CVE-2025-1936 CVE-2025-1937 CVE-2025-1938


author: wangkai <13474090681@163.com> - 128.10.0-1
changelog:
  - Update to 128.10.0
  - Fix CVE-2025-2817 CVE-2025-4083 CVE-2025-4084 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093


author: wangkai <13474090681@163.com> - 128.3.0-1
changelog:
  - Update to 128.3.0
  - Fix CVE-2024-9392 CVE-2024-9393 CVE-2024-9394 CVE-2024-9396
    CVE-2024-9397 CVE-2024-9398 CVE-2024-9399 CVE-2024-9400 CVE-2024-9401
    CVE-2024-9402


author: xinghe <xinghe2@h-partnres.com> - 1.0.2-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix zone combined forward must not default to True
         fix fw icmptype don't alter ipvs in io_object
         fix check config use the dictionary variants
         fix functions check config fails if direct.xml exists
         fix service adding includes


author: zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:chore nftables add delete table helper
         fix nftables always flush main table on start


author: zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload related ko when stopping firewalld service
         To reduce unnecessary loading of ebtables-related kernel modules
         fix(nm): release NM client after a timeout


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-47
changelog:
  - fix coredump when get empty from udp sendring
  - [virtio]: distribute pkg by dst_port
  - parse packages type in rx_poll
  - [virtio]: cfg ipv4 and ipv6 addr
  - fix build failed in 2003sp4
  - fix dpdk_bond_primary_set bug
  - cfg: del unnecessary logs
  - perftool: add latency tool


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-48
changelog:
  - add flow_bifurcation switch in lstack_cfg file
  - virtio: dfx data of virtio
  - virtio: update g_rule_port by reg_ring_type enum
  - virtio: mode actual_queue_num
  - fix poll init not clear old fd


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-50
changelog:
  - cleancode: rename gazelle files in lwip
  - add .gitignore
  - cleancode: improving makefile readability


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-51
changelog:
  - cleancode: refactor sys_now and lwip_ioctl
  - add sem post when update event
  - cleancode: refactor lwipgz_hlist.h
  - fix EPOLLIN event dropd
  - cleancode: refactor lwipgz_list.h
  - cleancode: refactor posix_api
  - fix some error of NULL pointer
  - cleancode: refactor posix type and get_socket
  - cleancode: refactor lwipsock.h


author: yangchen555 <yangchen145@huawei.com> - 1.0.2-52
changelog:
  - fix redis coredump when hugetlbs pagesize is 1024M
  - vitio_user: modify mbuf index for bond4
  - Check the return of lwip_init
  - support kernel connect
  - POSIX: fix select timeout disable and build failed in openEuler 2003


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-53
changelog:
  - virtio_user: modify mbuf index for bond4
  - fix issue: create virtio_user based on bond4 main network card
  - virtio: fix dfx error with multiple cpus
  - dfx: optimize gazellectl -x for bond


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-54
changelog:
  - refector fill udp sendring
  - virtio_user: solve the issue that failed to bind virtio_user's IPv6 address
  - virtio_user: add vlan info for kernerl packets when vlan switch is on
  - WRAP:fix double connect lead posix api disable


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-55
changelog:
  - virtio: mod virtio_user_name when multi process is on
  - WRAP: fix bind log error
  - WRAP:fix ltran mode did not bind kernel while open kni
  - virtio_user: The program establishes a network connection when network card status is up
  - fix redis coredump ctrl-c during the pressure test


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-59
changelog:
  - epoll: fix wild pointer detected by cooddy
  - tools: fix sync patch script date wrong and update the way get patchnum
  - cfg: modify maximum tcp_conn_count to 2w
  - fix mbuf_total calculation error


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-64
changelog:
  - cleancode: declare different cfg_params types
  - cleancode: add rpc_async_call, remove rpc_msg_arg.socklen, fix some format
  - cleancode: move some API from stack to rpc and rtw
  - cleancode: refactor rtc_api rtw_api and dummy_api


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-66
changelog:
  - af_xdp: set rlimit unlimit when gazelle init
  - add interrupt mode support
  - add pingpong dfx support


author: yinbin6 <jiangheng14@huawei.com> - 1.0.2-67
changelog:
  - bugfix: fix gazelle init failed while setup by non-root user
  - rpc: fix rpc_sync_call spinlock block when msg be recalled
  - rtw: fix send length exceeding send_ring_size
  - fix stack null when register interrupt


author: hantwofish <yinbin8@huawei.com> - 1.0.2-73
changelog:
  - xdp: support XDP_STATISTICS by posix_api->getsockopt_fn
  - add SO_NUMA_ID(optname) for adapting opneGauss
  - remove the unused return variable.
  - Fix annotation errors
  - bugfix: start fail when executing the popen command for the second time in openGauss


author: yinbin <jiangheng14@huawei.com> - 1.0.2-74
changelog:
  - LOG: Optimize some log displays
  - remove: code about nobolck mode for mysql
  - interrupt: fix timeout events cannot be counted


author: yinbin <yinbin8@huawei.com> - 1.0.2-77
changelog:
  - openGauss: support kernel connnect
  - xdp: support stack bind numa
  - CFG: fix xdp iface check error
  - fix build error in 2003SP4
  - cfg: show dpdk args after dpdk_adjust_args
  - fix free null pointer when no matching device is found
  - update test/unitest/ltran/ltran_param_test.c.
  - Fix the wrong spelling description in the notes and logs
  - LWIP: adjust position of shutdown in callback of connect
  - fix socket of control thread is overwirtten due to another primary process start


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-79
changelog:
  - cfg: notify that it's unsupported, when stack_num > 1
  - fix errno == ETIMEFOUT
  - fix epoll and recv threads blocked on the same semaphore. data cannot be read in recv thread.
  - fix rpc pool leak, when thread exits
  - remove app_bind_numa check from exclude_cpus
  - openGauss: fix connection attempt failed
  - openGauss: fix gs_ctl switchover failed


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-80
changelog:
  - Connect: execute lwip connect if dst_ip and host_ip are in the same network.
  - kernerl bind: add ipv6 add check
  - openGauss unsupport_tcp_optname
  - fix a contention issue when rpc pools are added to rpc_pool_array


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-82
changelog:
  - DUMP: fix abnomal printing in the dump process.
  - SIGNAL: Adjust hijack sigal table to hijack SIGABRT SIGQUIT and delet SIGKILL
  - SIGNAL: Adjust sigaction function to keep lstack signal function executed successfully.


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-83
changelog:
  - SIGNAL: block SIGSEGV during exit process
  - Stack: unset stack_stop, while stacks exit by rpc message.
  - fix the memory leak when using strdup


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-84
changelog:
  - update gazelle max numa nodes 8
  - Protocal: fixing deathlock between protocol threads and app thread
  - Connect: fix benchmark_dws connect failed
  - RTC-mode: fix gazellectl can't print connenct info
  - add xdp tx checksum/tso offload


author: yaoxin <yao_xin001@hoperun.com> - 0.4.50-1
changelog:
  - Update to 0.4.50:
  - Core:
    * Better Gobject Introspection annotation coverage.
    * Improved error handling for gegl chain processing.
    * Added accessors for pad meta-data, to be able to show names and descriptions in UIs.
    * GeglColor: more lax parameters for g_arapm_values_cmp
    * exr-save: store 16bpc files as half, fixing gimp#10778
    * ff-load, ff-save: fix build with FFmpeg 7
    * dither: do processing in linear when all levels==2


author: zhangxianting <zhangxianting@uniontech.com> - 9.56.1-6
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: fix CVE-2024-29506 CVE-2024-29507 CVE-2024-29508 CVE-2024-29509 CVE-2024-29511


author: Funda Wang <fundawang@yeah.net> - 9.56.1-14
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27833, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836


author: hdliu <dev03108@linx-info.com> - 9.56.1-15
changelog:
  - Add font mappings so that the PS interpreter can rasterize Chinese content using the two fonts STKaiti-Regular and STheiti-Regular.


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: fuanan <fuanan3@h-partners.com> - 2.39.1-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:enable multithreading compilation and installation,
         move Git.3pm.gz to perl-Git,avoid installation conflicts,
         change BuildRequires from pcre-devel to pcre2-devel.


author: huyubiao <huyubiao@huawei.com> - 2.39.1-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: fuanan <fuanan3@h-partners.com> - 2.43.0-4
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: zhangzikang <zhangzikang@kylinos.cn> - 2.78.3-3
changelog:
  - backport patch:
      backport-gdbusmessage-Clean-the-cached-arg0-when-setting-the-message-body.patch
      backport-gsocketclient-Fix-a-use-after-free-in-g_socket_client_connected_callback.patch
      backport-gcontextspecificgroup-Wait-until-stop_func-is-done.patch
      backport-gresources-fix-memory-leak-from-libelf.patch


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-38
changelog:
  - nptl: Use <support/check.h> facilities in tst-setuid3
  - posix: Use <support/check.h> facilities in tst-truncate and tst-truncate64
  - ungetc: Fix backup buffer leak on program exit [BZ #27821]
  - ungetc: Fix uninitialized read when putting into unused streams [BZ #27821]
  - Make tst-ungetc use libsupport
  - stdio-common: Add test for vfscanf with matches longer than INT_MAX [BZ #27650]
  - support: Add FAIL test failure helper


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-40
changelog:
  - elf: Change ldconfig auxcache magic number (bug 32231)
  - Add crt1-2.0.o for glibc 2.0 compatibility tests
  - libio: Attempt wide backup free only for non-legacy code


author: shixuantong <shixuantong@huawei.com> - 2.38-43
changelog:
  - elf: avoid jumping over a needed declaration
  - elf: Move __rtld_malloc_init_stubs call into _dl_start_final


author: shixuantong <shixuantong@huawei.com> - 2.38-44
changelog:
  - elf: Handle static PIE with non-zero load address
  - elf: Introduce _dl_relocate_object_no_relro
  - elf: Switch to main malloc after final ld.so self-relocation


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-45
changelog:
  - nptl: initialize cpu_id_start prior to rseq registration
  - nptl: initialize rseq area prior to registration


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-52
changelog:
  - stdlib: Test using setenv with updated environ [BZ #32588]
  - Fix underallocation of abort_msg_s struct (CVE-2025-0395)
  - elf: Support recursive use of dynamic TLS in interposed malloc
  - elf: Avoid some free (NULL) calls in _dl_update_slotinfo
  - x86/string: Fixup alignment of main loop in str{n}cmp-evex [BZ #32212]
  - x86: Improve large memset perf with non-temporal stores [RHEL-29312]
  - x86_64: Fix missing wcsncat function definition without multiarch (x86-64-v4)
  - sysdeps/x86/Makefile: Split and sort tests
  - x86: Only align destination to 1x VEC_SIZE in memset 4x loop
  - elf: Fix slow tls access after dlopen [BZ #19924]
  - x86: Check the lower byte of EAX of CPUID leaf 2 [BZ #30643]
  - x86_64: Add log1p with FMA
  - x86_64: Add expm1 with FMA
  - x86_64: Add log2 with FMA
  - x86_64: Sort fpu/multiarch/Makefile


author: xuraoqing <xuraoqing@huawei.com> - 3.8.2-1
changelog:
  - update to 3.8.2
  - some API and ABI modifications, see NEWS for details
  - New option --attime to specify current time
  - libgnutls: Add a mechanism to control whether to enforce extended master secret (RFC 7627)
  - libgnutls: Add additional PBKDF limit checks in FIPS mode as defined in SP 800-132
  - libgnutls: %GNUTLS_NO_EXTENSIONS has been renamed to %GNUTLS_NO_DEFAULT_EXTENSIONS.
  - libgnutls: Add support for RFC 9258 external PSK importer.
  - libgnutls: ClientHello extensions are randomized by default,
               To make fingerprinting harder, TLS extensions in ClientHello messages are shuffled.
  - gnutls-cli: New option --starttls-name.
  - libgnutls: transparent KTLS support is extended to FreeBSD kernel.
  - libgnutls: Added support for AES-GCM-SIV ciphers (RFC 8452).
  - libgnutls: Add API functions to perform ECDH and DH key agreement.
  - libgnutls: Fix timing side-channel inside RSA-PSK key exchange(CVE-2023-5981).


author: wangshuo <wangshuo@kylinos.cn> - 1.21.4-25
changelog:
  - Type:CVE
  - CVE:CVE-2024-34158
  - SUG:NA
  - DESC:fix CVE-2024-34158
  -      optimize the names of the first two patch files


author: wangshuo <wangshuo@kylinos.cn> - 1.21.4-29
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:crypto/tls: fix Config.Time in tests using expired certificates


author: Vanient <xiadanni1@huawei.com> - 1.21.4-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: allow update of system stack bounds on callback from C thread


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ignore signing failure
         Revert "templates: Disable the os-prober by default"
         Revert "templates: Properly disable the os-prober by default"
         Add grub-get-kernel-settings and use it in 10_linux
         Replace a lot of man pages with slightly nicer ones


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-15
changelog:
  - Type:CVE
  - CVE:CVE-2021-46848
  - SUG:NA
  - DESC:lib/libtasn1: Fix ETYPE_OK off by one array size check


author: yueyuankun <yueyuankun@kylinos.cn> - 1:2.12-21
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Export all variables from the initial context when creating a submenu


author: peng.zou <peng.zou@shingroup.cn> - 1:2.12-22
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:remove BuildRequires:pesign >= 0.99-8 and fix bug about petitboot doesn't ignore EFI entries for ppc64le


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:10_linux: fix missing "ro" in kernel boot parameters
         Disable LTO


author: hanliyang <hanliyang@hygon.cn> - 1:2.12-26
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:use confidential computing provisioned secrets for disk decryption


author: yueyuankun <yueyuankun@kylinos.cn> - 1:2.12-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:acpi: Fix out of bounds access in grub_acpi_xsdt_find_table()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:commands/efi/tpm: Re-enable measurements on confidential computing platforms


author: Funda Wang <fundawang@yeah.net> - 1:2.12-32
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:disable fortify level based on new settings of openEuler-rpm-config


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-33
changelog:
  - Type:CVE
  - CVE:CVE-2024-45781,CVE-2024-45782,CVE-2024-56737,CVE-2024-45780,CVE-2024-45783,CVE-2024-49504,CVE-2025-0624,CVE-20
  24-45774,CVE-2024-45775,CVE-2025-0622,CVE-2025-0622,CVE-2025-0622,CVE-2024-45776,CVE-2024-45777,CVE-2025-0690,CVE-20
  25-1118,CVE-2024-45778,CVE-2024-45779,CVE-2025-0677,CVE-2025-0684,CVE-2025-0685,CVE-2025-0686,CVE-2025-0689,CVE-2025
  -0678,CVE-2025-1125
  - SUG:NA
  - DESC:fix the vulnerabilities announced on February 18th, 2025


author: Funda Wang <fundawang@yeah.net> - 1:2.12-40
changelog:
  - requirement
  - CVE:NA
  - SUG:NA
  - DESC: Disable the .package_note awfulness
  - DESC: drop duplicate list of locale files


author: Funda Wang <fundawang@yeah.net> - 1.22.5-2
changelog:
  - fix CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600,
    CVE-2024-47607, CVE-2024-47615, CVE-2024-47835


author: yaoxin <yao_xin001@hoperun.com> - 1.20.3-3
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47599,CVE-2024-47613,CVE-2024-47775
    CVE-2024-47776,CVE-2024-47777,CVE-2024-47778,CVE-2024-47774
    CVE-2024-47540,CVE-2024-47602,CVE-2024-47601,CVE-2024-47603
    CVE-2024-47834,CVE-2024-47537,CVE-2024-47597,CVE-2024-47543
    CVE-2024-47596,CVE-2024-47539,CVE-2024-47546,CVE-2024-47598


author: Jia Chao <jiac13@chinaunicom.cn> - 3.3.4-4
changelog:
  - fix: use $HOME rather than /home/abuild, suit for all buildtools.
  - fix: yarn have ELF bin, not noarch at all.


author: Dingli Zhang <dingli@iscas.ac.cn> - 3.3.6-3
changelog:
  - Fix build on riscv64
  - Upgrade os-maven-plugin to 1.7.1
  - Remove settings.xml and use ${HOME}/.m2/repository as maven repo


author: xinghe <xinghe2@h-partners.com> - 2.6.6-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:backport to fix potential coredump:
         errors: handle malloc failure in usermsgs_put
         ssl_sock: add check for ha_meth
         thread: add a check for pthread_creat


author: xinghe <xinghe2@h-partners.com> - 2.9.5-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: xinghe <xinghe2@h-partners.com> - 2.9.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:stream: Prevent mux upgrades if client connection is no longer ready


author: yanglu <yanglu72@h-partners.com> - 2.9.5-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:queues:Do not use pendconn_grab_from_px
         queues:Make sure we call process_srv_queue when leaving
         queue:Make process_srv_queue return the number of streams


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: chengyechun <chengyechun1@huawei.com> - 2.4.55-3
changelog:
  - Type:CVE
  - ID:CVE-2023-27522, CVE-2023-25690
  - SUG:restart
  - DESC:fix CVE-2023-27522, CVE-2023-25690


author: chengyechun <chengyechun1@huawei.com> - 2.4.55-5
changelog:
  - Type:CVE
  - ID:CVE-2023-31122, CVE-2023-45802, CVE-2023-43622
  - SUG:NA
  - DESC:fix CVE-2023-31122 and CVE-2023-45802 and CVE-2023-43622


author: chengyechun <chengyechun1@huaiwe.com> - 2.4.58-2
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: zhangyaqi <zhagnyaqi@kylinos.cn> - 2.4.58-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:allocate a heap buffer if the configured size is greater than the stack-allocated buffer.


author: chengyechun <chengyechun1@huawei.com> - 2.4.58-6
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: xingwei <xingwei14@h-partners.com> - 2.4.58-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mod_log_config: Fix LogFormat directive merging
         Fix X509 leak and Increase MAX_CONCURRENCY hard limit
         mod_proxy_balancer: Fix the handling of the stickysession
         mod_cache_socache: Fix possible crash on error path
         mod_ssl: Check SSL_CTX_new() return value
         core: Report invalid Options argument when parsing AllowOverride directives


author: zhongtao <zhongtao17@huawei.com> - 2.1.5-7
changelog:
  - Type: update
  - ID: NA
  - SUG: NA
  - DESC: bugfix of background execution exec error command and setting negative cpu-rt issue


author: zhongtao <zhongtao17@huawei.com> - 2.1.5-8
changelog:
  - Type: update
  - ID: NA
  - SUG: NA
  - DESC: remove extra %s in CreateContainerLogSymlink and allow env variable has an empty value


author: wujichao <wujichao1@huawei.com> - 2.1.5-12
changelog:
  - Type: update
  - ID: NA
  - SUG: NA
  - DESC: combine ten similar submissions into one(0125-fix-clang-build-error.patch) and Upgrade from upstream


author: jingxiaolu<lujingxiao@huawei.com> - 2.1.5-18
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: sync patches from upstream for refactoring sandbox and bugfixing


author: Funda Wang <fundawang@yeah.net> - 50.0-14
changelog:
  - adopt to new cmake macro
  - migrated to SPDX license
  - drop useless setup macro, cause it duplicates with autosetup
  - drop useless ldconfig_scriptlets, it has been done through glibc's
    filetriggers since openeuler 1.0


author: Xinghai Cen <cenxinghai@h-partners.com> - 50.0-17
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: Fix coredump during QP destruction when send_cq == recv_cq


author: zhangxingrong <zhangxingrong@uniontech.com> - 3.16-4
changelog:
  - iperf3 now builds correctly on architectures without native support for 64-bit atomic types, by linking with the libatomic library


author: wangkai <13474090681@163.com> - 3.17.1-1
changelog:
  - Update to 3.17.1
  - iperf3 no longer changes its current working directory in --daemon mode. This results in more 
    predictable behavior with relative paths, in particular finding key and credential files for authentication.
  - A new --json-stream option has been added to enable a streaming output format, consisting of 
    a series of JSON objects (for the start of the test, each measurement interval, and the end of the test) separated by newlines
  - UDP tests now work correctly between different endian hosts
  - The --fq-rate parameter now works for --reverse tests
  - The statistics reporting interval is now available in the --json start test object


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:6.1.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix testsuite build failure and delete libcap-devel dependency


author: xinghe <xinghe2@h-partners.com> - 1:6.6.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ss: fix expired time format of timer
         route: filter by interface on multipath routes
         lib: names: check calloc return value in db_names_alloc
         remove redundant patches


author: yanglu <yanglu72@h-partners.com> - 1.8.9-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ebtables translate Print flush command after parsing is finished
         fix crash when opts isn't reallocated
         Fix handling of non-existent chains
         nft: Special casing for among match in compare_matches
         extensions: libipt_icmp: Fix confusion between 255/255 and any
         Revert libiptc: fix wrong maptype of base chain counters on restore
         extensions: Fix checking of conntrack --ctproto 0
         libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks
         libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK
         libiptc: Fix for another segfault due to chain index NULL pointer


author: liweigang <liweiganga@uniontech.com> - 1.8.9-5
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libxtables: Fix memleak of matches' udata
          xshared: Fix parsing of empty string arg in '-c' option


author: yanglu <yanglu72@h-partners.com> - 1.8.9-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:extensions:recent:Fix format string for unsigned values
         nft:cmd:Init struct nft_cmd::head early


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.422-b05.4
changelog:
  - Add 8137165-Tests-fail-in-SR_Handler-because-thread-is-n.patch
  - Extending-the-IV-Length-Supported-by-KAEProvider-AES.patch


author: songliyang <songliyang@kylinos.cn> -1:1.8.0.422-b05.6
changelog:
  - let support-KAE-zip.patch not install libz.so on loongarch64
  - update LoongArch64 port to 8u422
  - fix changelog date error


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.432-b05.rolling
changelog:
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8193682-Infinite-loop-in-ZipOutputStream.close.patch
  - modified 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - modified Backport-8318889-Backport-Important-Fixed-Issues-in-Later-Ver.patch
  - modified GCC-12-reports-some-compiler-warnings.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - deleted 8278794-Infinite-loop-in-DeflaterOutputStream.finish.patch


author: neu-mobi <liuyulong.work@qq.com> - 1:17.0.10.9-0.rolling
changelog:
  - del 8168469-Memory-leak-in-JceSecurity.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-rep.patch
  - del 8275509-ModuleDescriptor.hashCode-isn-t-reproducible.patch
  - del 8285516-clearPassword-should-be-called-in-a-finally-.patch
  - del 8312065-Socket.connect-does-not-timeout-when-profili.patch
  - del 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - del 8314063-The-socket-is-not-closed-in-Connection-creat.patch
  - del 8316576-com.sun.jndi.ldap.Connection.cleanup-does-no.patch
  - modified 8253495-CDS-generates-non-deterministic-outpu.patch
  - modified 8280872-Reorder-code-cache-segments-to-improv.patch
  - modified add-version-txt.patch
  - add Add-problemlist.patch
  - add puyuan-jdk17.0.9-patch.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.11.9-0.rolling
changelog:
  - del 8295068-SSLEngine-throws-NPE-parsing-CertificateRequ.patch
  - modify puyuan-jdk17.0.9-patch.patch


author: songliyang <songliyang@kylinos.cn> - 1:17.0.11.9-1
changelog:
  - rewrite LoongArch64-support.patch to sovle error while applying this patch in prep stage
  - fix loongarch vendor error and delete redundant vendor args


author: songliyang <songliyang@kylinos.cn> - 1:17.0.12.7-1
changelog:
  - update Loongarch support patch to fix the error while applying in prep stage
  - delete redundant symbols while viewing spec file with vim that make it strange on highlight


author: kuenking111 <wangkun49@huawei.com> - 1:17.0.12.7-2
changelog:
  - add Huawei-Extending-the-IV-Length-Supported-by-KAEProvider-AES.patch
  - add Backport-7036144-GZIPInputStream-readTrailer-uses-faulty-avai.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> - 1:17.0.12.7-5
changelog:
  - Add Backport-of-JDK-8305680.patch
  - Add Backport-of-JDK-8305937.patch
  - Add 8338785-The-java.awt.datatransfer.SystemFlavorMap-FL.patch
  - Add 8337982-Remove-dead-undef-assrt0n.patch
  - Add 8337274-Remove-repeated-the-in-StyleSheet.create-Sma.patch
  - Add 8335610-DiagnosticFramework-CmdLine-is_executable-co.patch
  - Add Backport-of-8333088-ubsan-shenandoahAdaptiveHeuristi.patch
  - Add Backport-of-8339351-Remove-duplicate-line-in-FileMap.patch
  - Add Backport-of-8330191-Fix-typo-in-precompiled.hpp.patch
  - Add Backport-of-8337712-Wrong-javadoc-in-java.util.Date-.patch


author: Benshuai5D <zhangyunbo7@huawei.com> - 1:17.0.13.11-0
changelog:
  - modify 8264805-Backport-Ahead-of-Time-Compiler.patch
  - modify 8264806-Backport-Graal-Compiler.patch
  - modify Add-JBooster-Lazy-AOT-module.patch
  - modify Apply-TBI-to-ZGC-of-JDK17.patch
  - modify Backport-Important-Fixed-Issues.patch
  - modify KAE-zip-Features.patch
  - modify add-version-txt.patch
  - add Huawei-Fix-JBooster-file-issue-caused-by-os-write-change.patch
  - update to 17.0.13+11(ga)


author: mengkanglai <mengkanglai2@huawei.com> - 0.16-2
changelog:
  - add backport-Add-test-to-check-for-the-memory-leak-mentioned-in-issue-781.patch
  - add backport-Fix-memory-leak-with-emtpy-strings-in-json_object_set_string.patch
  - add backport-json_object_from_fd_ex-fail-if-file-is-too-large.patch


author: liweigang <liweiganga@uniontech.com> - 0.17-3
changelog:
  - add backport-Handle-yet-another-out-of-memory-condition.patch
  - add backport-Issue-857-fix-a-few-places-where-json_tokener-should.patch


author: yueyuankun <yueyuankun@kylinos.cn> - 0.17-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Disallow control characters in strict mode
          Fix the expected output for test_parse
          Fix causing the strict-mode control characters check to incorrectly trigger


author: sunhai <sunhai10@huawei.com> - 0.17-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Fix the apps/json_parse "-s" (strict) option so it actually does something, and default to non-strict.


author: sunhai <sunhai10@huawei.com> - 0.17-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Handle NULL gracefully in json_tokener_free
          Issue 881 don t allow json_tokener_new_ex with a dep


author: yanglu <yanglu72@h-partners.com> - 006-2
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC:Add crashkernel auto for Arm 
         enable kdump and set default reserve memory 512MB
         fix test failed due to default value change


author: caixiaomeng <caixiaomeng2@huawei.com> - 1:0.9.9-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:remove .export_symbol section newly added in 6.6 kernel to avoid compile error


author: zhongtao<zhongtao17@huawei.com> - 2.1.4-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add enable pod events field and Add oomkilled field in inspect.json


author: chengyechun <chengyechun1@huawei.com> - 4.9.2-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix second find_cmd Segmentation fault
         Ensure that PollVec enum matches poll values


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: yanglongkang <yanglongkang@h-partners.com> - 2.69-3
changelog:
  - backport upstream patches:
    getpcaps: fix program name in help message
    Stop using _pam_overwrite() in pam_cap.c


author: chenhaixing <chenhaixing@huawei.com> - 0.70.2-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libdnf:Avoid reinstalling installonly packages marked for ERASE
                Fix utimes error message in dnf-repo
                Do not download repository if our local cache is up to date in dnf-repo
                python bindings:Load all modules with RTLD_GLOBAL


author: Kai Liu <kai.liu@windriver.com> - 1:1.49.5-3
changelog:
  - Replace patch support_OPENEULER_to_configure.patch by backport-support-openEuler.patch
    which is backported from upstream, fix issue of detecting openEuler.
  - Add provide-openEuler-appliance-package-list.patch after correctly detected openEuler.
    It was using REDHAT list before.


author: yixiangzhike <yixiangzhike007@163.com> - 1.6.4-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch to fix possible uninitialized variable


author: xinghe <xinghe2@h-partners.com> - 8.17.2-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:extending the certificate validate period
         remove redundant patches


author: shechenglong <shechenglong@xfusion.com> - 25.0.3-17
changelog:
  - DESC: move group creation into pre section rather than post section
          change requires into meta dependency for its actual use


author: Funda Wang <fundawang@yeah.net> - 25.0.3-22
changelog:
  - fix CVE-2024-36620, CVE-2024-36621, CVE-2024-36623
  - reorganize patches so that they could be applied automatically


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.4-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:change the files order in patch file fix-doc-about-difok.patch


author: liying <liying_1@chinatelecom.cn> - 1.0.31-3
changelog:
  - Marked unimplemented dither enums in the header file as such.
  - Fix typo
  - Fix memory leak in caf_read_header


author: xinghe <xinghe2@h-partners.com> - 2.74.3-4
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-5
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: Funda Wang <fundawang@yeah.net> - 2.11.5-5
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: Funda Wang <fundawang@yeah.net> - 2.11.5-6
changelog:
  - Type:CVE
  - CVE:CVE-2025-32414
  - CVE:CVE-2025-32415
  - SUG:NA
  - DESC: fix CVE-2025-32414, CVE-2025-32415


author: yinbin <yinbin8@huawei.com> - 2.2.0-60
changelog:
  - IPV6: Enable IPV6_FRAG_COPYHEADER macro to adapt 64bit
  - IPV6: fix array out of bounds in function ip6_ntoa_r
  - IPV6: add group check while mld6 schedule a report


author: hankangkang <hankangkang5@huawei.com> - 2.2.0-62
changelog:
  - When the GAZELLE_TCP_REUSE_IPPORT is on, min_cnts_lpcb is NULL
  - Turn on the LWIP_SO-LINGER switch


author: yaoxin <1024769339@qq.com> - 2.4.16.6-1
changelog:
  - Update to 2.4.16.6:
    * metadata: fix caching of JWKs from jwks_uri when using the default expiry setting
    * info: fix requests to the info hook with extend_session=false
    * cookie: OIDCCookieSameSite default behaviour Lax
    * cookie: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
    * cache: avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory
      cannot be found on the system upon initaliizing cache mutexes and the file cache
    * metadata: allow plain HTTP URLs in metadata elements jwks_uri and signed_jwks_uri to ensure backwards
      compatibility with <=2.4.15.7 and to support private/test deployments
    * code: address warnings from static code analysis tool CodeChecker


author: wangkai <13474090681@163.com> - 8.0.37-1
changelog:
  - Update to 8.0.37 for fix CVEs(CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,
    CVE-2024-20973,CVE-2024-20978,CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,
    CVE-2024-20963,CVE-2024-20965,CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,
    CVE-2024-20970,CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,
    CVE-2024-20960,CVE-2024-20985,CVE-2024-20969,CVE-2024-21000,CVE-2024-21069,
    CVE-2024-21009,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,CVE-2024-21013,
    CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,CVE-2024-21054,CVE-2024-21062,
    CVE-2024-20994,CVE-2024-21096,CVE-2024-21061,CVE-2024-20993,CVE-2024-21055,
    CVE-2024-21057,CVE-2023-6129)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: xingwei <xingwei14@h-partners.com> - 1:5.9.1-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: IF-MIB, IP-FORWARD-MIB: Improve robustness
  	IF-MIB: pass the network interface index to net
  	IF-MIB: fix a memory leak
  	IF-MIB: fix a recently introduced use after free
  	IF-MIB: add a trailing newline to an error message


author: gaihuiying <eaglegai@163.com> - 1:5.9.3-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Customized the anti-attacki/reset-last_engineTime function for IdeaUI
         change the permissions of passtest


author: xingwei <xingwei14@h-partners.com> - 1:5.9.3-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Migration patch from upstream, add compatibility to parse
  Linux 6.7 Ip header while keep support for previous versions.


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:The python-setup tools causes an error in the nftables packaging path,This macro is added to ensure that path remains unchanged


author: xinghe <xinghe2@h-partners.com> - 1:1.0.0-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cache prepare nft_cache evaluate to return error
         fix cache validate handle string length
         add src support for implicit chain bindings
         fix cache release pending rules
         fix segtree map listing
         parser_json fix device parsing in netdev family
         fix src Don't parse string as verdict in map


author: lingsheng <lingsheng1@h-partners.com> - 1:1.0.8-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: liweigang <liweiganga@uniontech.com> - 1:1.0.8-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: evaluate: guard against NULL basetype
  evaluate: error out if basetypes are different
  evaluate: reject attempt to update a set
  evaluate: release mpz type in expr_evaluate_list() error path
  expression: missing line in describe command with invalid expression
  evaluate: handle invalid mapping expressions in stateful object statements gracefully


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ct expectation: fix 'list object x' vs. 'list objects in table' confusion
         tests: shell: connect chains to hook point


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         parser_json: release buffer returned by json_dumps
         parser_json: fix crash in json_parse_set_stmt_list
         parser_json: fix handle memleak from error path
         parser_json: fix several expression memleaks from error path
         libnftables: Zero ctx->vars after freeing it


author: xingwei <xingwei14@h-partners.com> - 2:7.92-4
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:decouple from PCRE because it has been End-of-life, use local libpcre to build instead


author: wangkai <13474090681@163.com> - 1:20.11.1-1
changelog:
  - Update to 20.11.1
  - Fix CVE-2023-46809 CVE-2024-21896 CVE-2024-22019 CVE-2024-21892 CVE-2024-24758 CVE-2024-22025


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:20.12.1-2
changelog:
  - fix building w/ clang: only apply '-fno-ipa-icf' for gcc && disable LTO for clang + ld.bfd
  - improve the handling of trilling whitespaces in C/CXXFLAGS


author: Ge Wang <wang__ge@126.com> - 1:20.12.1-3
changelog:
  - CVE-2023-45853 - Reject overflows of zip header fields in minizip
  - CVE-2024-5274 - Using FunctionParsingScope for parsing class static
  - CVE-2024-5535 - Fix SSL_select_next_proto
  - CVE-2024-7971 - Spill all loop inputs before entering loop


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: cuixucui <cuixucui1@h-partner.com> - 1.1.3-2
changelog:
  - Fix code issue and update log print in network
  - Cancel deleting the IP that automatically configured on the server
  - Fix cdrom bug


author: liqiang <liqiang332@h-partner.com> - 1.1.3-3
changelog:
  - Fix libswsds.so not stripped
  - Fix the value of kernel.src obtained by the kabi test case is incorrect
  - Add board infomation and fix memory bug
  - Fix the block size fails to be obtained during the NVME test
  - Judge whether to support kabi testing by architecture
  - Update readme and dev_design


author: cuixucui <cuixucui1@h-partner.com> - 1.1.4-0
changelog:
  - Add board information in the test report
  - Add spdk test case
  - Add dpdk test case
  - Update pci.ids file


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-0
changelog:
  - Add support for openEuler 20.03 LTS SP4, openEuler 22.03 LTS SP2, openEuler 22.03 LTS SP3
  - Add modifications to Kylinsec with oec-hardware
  - Add support for Loongson and SW architectures
  - Bugfix


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-3
changelog:
  - Update the pci.ids file
  - Remove unused variable in cdrom test suite
  - Update test_guide doc
  - Unify the location for downloading kernel source RPMs
  - Optimize kabiwhitelist and system test


author: Funda Wang <fundawang@yeah.net> - 0.23.0-7
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: renmingshuai<renmingshuai@huawei.com> - 9.3p1-3
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: bitianyuan <bitianyuan@huawei.com> - 9.3p2-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the missing member of the struct Authmethod method_gsskeyex


author: wangcheng <wangcheng156@huawei.com> - 1:3.0.12-1
changelog:
  - Upgrade to 3.0.12
    Resolves: CVE-2023-0464
    Resolves: CVE-2023-0465
    Resolves: CVE-2023-0466
    Resolves: CVE-2023-1255
    Resolves: CVE-2023-2650
    Resolves: CVE-2023-5363
    Resolves: CVE-2023-6237
    Resolves: CVE-2023-6129
    Resolves: CVE-2023-5678
    Resolves: CVE-2024-0727


author: baiguo <baiguo@kylinos.cn> - 0.4.34-2
changelog:
  - Use vasprintf() if available for error messages and otherwise vsnprintf();orccompiler, orcparse: Use secure UCRT printing functions on Windows


author: wangkai <13474090681@163.com> - 6.2.2-4
changelog:
  - Fix CVE-2024-45769,CVE-2024-45770
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57805)
  - Guard against symlink attacks in pmpost program (RHEL-57810)
  - Fix libpcp_web webgroup slow request refcounting (RHEL-58306)
  - Updated pmdahacluster for newer crm_mon versions (RHEL-50693)


author: hugel <gengqihu2@h-partners.com> - 10.42-12
changelog:
  - DESC:sync patches from upstream
         backport-Further-ASCII-tests-and-minor-bugfix-plus-ChangeLog-.patch
         backport-avoid-inconsistency-between-d-and-digit-when-using-a.patch
         backport-Fix-the-lookahead-after-d-or-posix-to-skip-whitespac.patch
         backport-Improve-error-offsets-for-character-classes-548.patch
         backport-Non-recursive-scan-prefix-in-JIT-560.patch


author: Xiaoqian Lv <xiaoqian@nj.iscas.ac.cn> - 4.5-5
changelog:
  - Type: enhancement
  - ID: NA
  - SUG: NA
  - DESC: backport upstream 4.5-0.20 patches to support riscv64


author: Guofeng Yue <yueguofeng@h-partners.com> - 4.5-12
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: modify "--source_ip" to "--bind_source_ip" to fix init connection establishment with specific interface


author: pengjian <pengjian23@mails.ucas.ac.cn> - 1:0.82-3
changelog:
  - Introduced environment variable-controlled polling timeouts 
  for the close and connection-keeping functions in the os_unix.c file.


author: duyiwei <duyiwei@kylinos.cn> - 1:4.9.4-10
changelog:
  - Type:bugfix
  - CVE:CVE-2024-9355、CVE-2019-9514、CVE-2024-24791、CVE-2022-32189、CVE-2022-41715、CVE-2022-2880、CVE-2022-1962、CVE-2023-45290、CVE-2024-24783、CVE-2024-24785
  - SUG:NA
  - DESC: Optimize spec files and fix CVE in batches through rebuild


author: duyiwei <duyiwei@kylinos.cn> - 1:4.9.4-11
changelog:
  - Type:bugfix
  - CVE:CVE-2024-9676,CVE-2024-9675, CVE-2024-9407,CVE-2024-9341
  - SUG:NA
  - DESC: fix CVE-2024-9676,CVE-2024-9675, CVE-2024-9407, and CVE-2024-9341


author: dillon chen <dillon.chen@gmail.com> - 13.3-7
changelog:
  - Fix issue: confilct between libpq-devel and postgresql-devel
  - guess init spec from redhat 
  - change redhat spec:rm private package and add files to server-devel
  - so add delete lines to Fix issue
  - Next: write oe libpq and postgresql spec by myself


author: gaihuiying <eaglegai@163.com> - 2.4.9-2
changelog:
  - Type:bufix
  - ID:NA
  - SUG:NA
  - DESC:pppd: Negotiate IP address when only peer addresses are provided


author: gaihuiying <eaglegai@163.com> - 2.5.0-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:pre-created upstream default lock dir
         Openssl engine API is deprecated for a while thus disable it


author: gaihuiying <eaglegai@163.com> - 2.5.0-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream
         Fixing up parsing in radiusclient.conf
         Add configure check to see if we have struct sockaddr_ll


author: jiangxinyu <jiangxinyu@kylinos.cn> - 1.0.5-1
changelog:
  - Update package to version 1.0.5
  - fix error handling that might result in null exception
    cleanups of exception handling : errors must now have an exception
    Handling NameError is not working


author: yaoxin <1024769339@qq.com> - 1.0.6-1
changelog:
  - Update to 1.0.6:
    * drop testing and support for Python3.8, add Python 3.13, change document to reflect this.
    * implement safe_getattr and safe_format functions; fix bugs in UNSAFE_ATTRS and UNSAFE_ATTRS_DTYPES usage
    * make all procedure attributes private to curb access to AST nodes, which can be exploited
    * improvements to error messages, including use ast functions to construct better error messages
    * remove import of numpy.linalg, as documented
    * update doc description for security advisory


author: xuchenchen <xuchenchen@kylinos.cn> - 3.1.3-2
changelog:
  - Type: CVE
  - CVE: CVE-2024-34064
  - SUG: NA
  - DESC: fix disallow invalid characters in keys to xmlattr filter


author: xuhe <xuhe@kylinos.cn> - 2.27.3-1
changelog:
  - Update to 2.27.3
  - Fix test util typings.
  - Use json5 typings.
  - Use updated releaser workflows.
  - Ignore pageconfig file if JSON is zero-length.
  - For v2 extensions parse entrypoint data.
  - Add util to get consolidated page_config from higher levels.
  - Move ENV_CONFIG_PATH import back into _get_config_manager.
  - Load overrides once, rather than in each settings handler.
  - Run docs on ubuntu.
  - Fix handling language packs for pseudo language.


author: Shinwell Hu <micromotive@qq.com> - 1.11.1.1-4
changelog:
  - Python-ninja should never obsolate ninja-build.
  - Rename /usr/bin/ninja shipped in this package to /usr/bin/python-ninja


author: gengqihu <gengqihu2@h-partners.com> - 23.3.1-1
changelog:
  - update version to 23.3.1
  - Fix parallel pip cache downloads causing crash (#12364)
  - Upgrade urllib3 to 1.26.17 (#12343)
  - Fix zsh completion script (#12173)
  - Fix #12166
  - Move the setuptools settings into pyproject.toml
  - Use `-r=...` instead of `-r ...` for hg
  - Drop isort and flake8 settings from setup.cfg
  - Follow imports for more vendored dependencies
  - Enable mypy's strict equality checks (#12209)
  - Fixed argument name in docstring
  - Allow truststore to not import on Python 3.9 and earlier
  - Vendor truststore
  - Fix formatting, combine numbers not strings!
  - Remove uses of `utcnow` in non-vendored code (#12006)
  - Fix issues raised in code review
  - move test_download_metadata mock pypi index utilities to conftest.py
  - Use strict optional checking in req_install.py (#11379)
  - Fix 'force' remove file without write permissions
  - Dropped unused attribute
  - Fix Pytest --use-venv init
  - Limit the double download fix to wheels
  - Fix slowness on Python 3.11 when updating an existing large environment.
  - Fix `pip completion --zsh`


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-5
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-6
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup


author: Funda Wang <fundawang@yeah.net> - 3.11.6-8
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
    - Quote template strings in venv activation scripts


author: Chenxi Mao <chenxi.mao@suse.com> - 3.10.9-2
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC: Enable link time optimizaitons (LTO) for better performance.


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 2.13.0-1
changelog:
  - Update package with version 2.13.0
    Add an option to have authentication enabled for all endpoints by default
    Websockets: add configurations for ping interval and timeout
    Log extension import time at debug level unless it's actually slow
    Add support for async Authorizers
    Support get file(notebook) md5
    Update kernel env to reflect changes in session
    Support external kernels


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 4.1.2-1
changelog:
  - Upgrade package with version 4.1.2
    Fix highlight sequencing when replacing text in code cells
    Restore notebook scrolling on dragging a cell to the viewport edge
    Fix typing in editable elements inside of open shadow DOM
    Correct Alt + number keyboard shortcuts command map
    Update jupyter-collaboration for the Binder environment
    Add virtual scrollbar component to windowed lists.
    Load custom CSS functionality and documentation
    Add plugin manager and extension locks


author: zhaojingyu <zhaojingyu@kylinos.cn> - 4.1.6-1
changelog:
  - Upgrade package with version 4.1.6
  - Fix outputarea collapse expand
    Disable placeholder for password input


author: muxiaohui <muxiaohui@kylinos.cn> - 4.3.0-1
changelog:
  - Update version to 4.3.0
    Add setting to enable single-click navigation in file browser.
    Adds command to toggle cell outputs.
    Add kernel selection to Galata notebook creation.


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 4.3.5-1
changelog:
  - Upgrade package with version 4.3.5
    Fix scrolling and selection restoration on undo/redo
    Fix windowing crash due to out-of-bounds access
    Increase color contrast of operators in code editor
    Fix jupyverse installation instructions
    Use Zulip for instant messaging


author: yanglu <yanglu72@h-partners.com> - 1.13.2-5
changelog:
  - Type:cves
  - CVE:CVE-2022-30689 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30689 and CVE-2022-30699


author: gaihuiying <eaglegai@163.com> - 1.17.0-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


author: chenhaixing <chenhaixing@huawei.com> - 1.26.12-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix socket timeout value when HTTPConnect is reused
         remove Exclamation mark character from the unreserved characters
         fix _idna_encode handling of x80


author: chengyechun <chengyechun1@huawei.com> - 1.26.17-2
changelog:
  - Type:CVE
  - ID:CVE-2023-45803
  - SUG:NA
  - DESC:fix CVE-2023-45803 Made body stripped form HTTP requests


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-6
changelog:
  - coro: support live patch for libcare
  - tests/acpi: Update expected ACPI tables for vcpu hotplug(Update BinDir)
  - arm/virt: Require mc->has_hotpluggable_cpus for cold-plugged vcpu
  - arm/virt: Consider has_ged when set mc->has_hotpluggable_cpus
  - arm/virt-acpi: Require possible_cpu_arch_ids for build_cpus_aml()
  - acpi/ged: Remove cpuhp field of ged
  - acpi/ged: Init cpu hotplug only when machine support it
  - intc/gicv3: Fixes for vcpu hotplug
  - arm/kvm: Set psci smccc filter only with vcpu hotplug
  - accel/kvm: Use correct id for parked vcpu
  - arm/virt: Fix adjudgement of core_id for vcpu hotplugged
  - arm/virt.c: Convey local_err when set psci-conduit
  - system/cpus: Fix resume_all_vcpus() under vCPU hotplug condition
  - system/cpus: Fix pause_all_vcpus() under concurrent environment
  - acpi/cpu: Fix cpu_hotplug_hw_init()
  - arm/cpu: Some fixes for arm_cpu_unrealizefn()
  - system/physmem: Fix possible double free when destroy cpu as
  - hw/arm/virt: Expose cold-booted CPUs as MADT GICC Enabled
  - tcg/mttcg: enable threads to unregister in tcg_ctxs[]
  - hw/arm: Support hotplug capability check using _OSC method
  - target/arm/kvm,tcg: Register/Handle SMCCC hypercall exits to VMM/Qemu
  - target/arm/kvm: Write CPU state back to KVM on reset
  - target/arm: Add support of *unrealize* ARMCPU during vCPU Hot-unplug
  - physmem,gdbstub: Common helping funcs/changes to *unrealize* vCPU
  - hw/arm: Changes required for reset and to support next boot
  - arm/virt: Update the guest(via GED) about CPU hot-(un)plug events
  - hw/intc/arm-gicv3*: Changes required to (re)init the vCPU register info
  - hw/arm,gicv3: Changes to update GIC with vCPU hot-plug notification
  - arm/virt: Changes to (un)wire GICC<->vCPU IRQs during hot-(un)plug
  - arm/virt: Add/update basic hot-(un)plug framework
  - hw/acpi: Update ACPI GED framework to support vCPU Hotplug
  - arm/virt: Release objects for *disabled* possible vCPUs after init
  - hw/acpi: Make _MAT method optional
  - hw/arm: MADT Tbl change to size the guest with possible vCPUs
  - hw/acpi: Update GED _EVT method AML with cpu scan
  - hw/acpi: ACPI/AML Changes to reflect the correct _STA.{PRES,ENA} Bits to Guest
  - arm/virt: Make ARM vCPU *present* status ACPI *persistent*
  - arm/virt/acpi: Build CPUs AML with CPU Hotplug support
  - tests/acpi/bios-tables-test: Allow changes to virt/DSDT file
  - acpi/cpu: Add cpu_cppc building support
  - arm/virt/acpi: Factor out CPPC building from DSDT CPU aml
  - hw/acpi: Update CPUs AML with cpu-(ctrl)dev change
  - arm/virt: Create GED dev before *disabled* CPU Objs are destroyed
  - arm/virt: Add cpu hotplug events to GED during creation
  - hw/acpi: Init GED framework with cpu hotplug events
  - hw/acpi: Use qemu_present_cpu() API in ACPI CPU hotplug init
  - hw/acpi: Add ACPI CPU hotplug init stub
  - arm/acpi: Enable ACPI support for vcpu hotplug
  - hw/acpi: Move CPU ctrl-dev MMIO region len macro to common header file
  - arm/virt: Init PMU at host for all possible vcpus
  - arm/virt,gicv3: Changes to pre-size GIC with possible vcpus @machine init
  - arm/virt,kvm: Pre-create disabled possible vCPUs @machine init
  - accel/kvm: Extract common KVM vCPU {creation,parking} code
  - arm/virt,target/arm: Machine init time change common to vCPU {cold|hot}-plug
  - hw/arm/virt: Move setting of common CPU properties in a function
  - cpus-common: Add common CPU utility for possible vCPUs
  - arm/virt,target/arm: Add new ARMCPU {socket,cluster,core,thread}-id property


author: Keqian Zhu <zhukeqian1@huawei.com> - 11:8.2.0-7
changelog:
  - arm/virt: Use max_cpus to calculate redist1_count
  - arm/virt: Use separate filed to identify cpu-hotplug enable


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-11
changelog:
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()
  - hw/nvme: fix -Werror=maybe-uninitialized
  - block/virtio-blk: Fix memory leak from virtio_blk_zone_report
  - hw/net/virtio-net: fix qemu set used ring flag even vhost started
  - hw/scsi/scsi-generic: Fix io_timeout property not applying
  - tests: bios-tables-test: Rename smbios type 4 related test functions


author: zhangxianting <zhangxianting@uniontech.com> - 11:8.2.0-12
changelog:
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately
  - kvm/arm: Fix compatibility of cold-plug CPU with SVE
  - arm/virt/acpi: Extend cpufreq to support max_cpus
  - kvm/arm: Fix SVE related logic for vcpu hotplug feature
  - arm/virt: Don't modify smp.max_cpus when vcpu hotplug disabled
  - acpi/cpu: Fix detection of present cpu


author: Song Gao <gaosong@loongson.cn> - 11:8.2.0-13
changelog:
  - target/loongarch: Fix qemu-system-loongarch64 assert
  - target/loongarch: Fix qemu-loongarch64 hang when executing 'll.d $t0, $t0, 0'
  - target/loongarch: Fix tlb huge page loading issue
  - target/loongarch/kvm: Add software breakpoint support
  - target/loongarch/kvm: sync kernel header files
  - hw/intc/loongarch_extioi: Add virt extension support
  - target/loongarch/kvm: Add pmu support
  - target/loongarch/kvm: Fix vm restore failed
  - target/loongarch/kvm: Add pv steal time support
  - target/loongarch/kvm: fpu save the vreg registers high


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-14
changelog:
  - target/riscv/cpu.c: fix Zvkb extension config
  - target/i386: Add new Hygon 'Dharma' CPU model
  - target/i386: Add Hygon Dhyana-v3 CPU model
  - ui/gtk: Fix mouse/motion event scaling issue with GTK display backend
  - hw/ufs: Fix buffer overflow bug
  - arm/virt: Set vcpus_count of CPU as 1 to compatible with libvirt
  - ppc/pnv: I2C controller is not user creatablei


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-15
changelog:
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - migration/dirtyrate: Fix segmentation fault
  - target/hexagon: idef-parser fix leak of init_list


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-16
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100 
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-17
changelog:
  - cvm : bug fix for undefined reference to 'virtcca_cvm_allowed' while compiling
  - cvm : bug-fix for incorrect device name check for vhost-user-fs
  - target/i386: add control bits support for LAM
  - target/i386: add support for LAM in CPUID enumeration
  - Add support for the virtcca cvm feature.
  - target/sparc: use signed denominator in sdiv helper
  - crypto: Introduce SM4 symmetric cipher algorithm
  - ppc/vof: Fix unaligned FDT property access
  - vl: fix "type is NULL" in -vga help
  - hw/display/bcm2835_fb: fix fb_use_offsets condition
  - aspeed/smc: Fix possible integer overflow
  - hw/nvme: fix number of PIDs for FDP RUH update
  - hw/nvme: fix memory leak in nvme_dsm
  - hvf: arm: Do not advance PC when raising an exception
  - physmem: Bail out qemu_ram_block_from_host() for invalid ram addrs


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-18
changelog:
  - hw/loongarch/virt: Fix FDT memory node address width
  - hw/loongarch: Fix fdt memory node wrong 'reg'
  - load_elf: fix iterator's type for elf file processing
  - migration/colo: Fix bdrv_graph_rdlock_main_loop: Assertion `!qemu_in_…
  - target/i386: no single-step exception after MOV or POP SS
  - char-stdio: Restore blocking mode of stdout on exit
  - backends/cryptodev-builtin: Fix local_error leaks
  - target/loongarch: fix a wrong print in cpu dump
  - virtio-pci: fix use of a released vector
  - target/arm: Disable SVE extensions when SVE is disabled
  - hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE
  - target/i386: Introduce SapphireRapids-v3 to add missing features
  - virtio-net: Ensure queue index fits with RSS (CVE-2024-6505)
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
  - update io/trace-events. Parameters should remain consistent.
  - update docs/tools/virtfs-proxy-helper.rst. This place is spelled wrong.
  - kvm: Add support for CSV2 reboot
  - target/i386/kvm: Fix the resettable info when emulate Hygon CSV2 guest
  - target/i386: get/set/migrate GHCB state
  - target/i386: csv: Add support for migrate VMSA for CSV2 guest
  - migration/ram: Accelerate the loading of CSV guest's encrypted pages
  - migration/ram: Accelerate the transmission of CSV guest's encrypted pages
  - target/i386: csv: add support to load incoming encrypted pages queued in the CMD list
  - target/i386: csv: add support to queue the incoming page into a list
  - target/i386: csv: add support to encrypt the outgoing pages in the list queued before.
  - target/i386: csv: add support to queue the outgoing page into a list
  - target/i386: csv: Read cert chain from file when prepared for CSV live migration
  - target/i386: Introduce header file csv.h
  - migration/ram: Fix calculation of gfn correpond to a page in ramblock
  - target/i386: sev: Clear shared_regions_list when reboot CSV Guest
  - migration/ram: Force encrypted status for VGA vram
  - target/i386: sev: Return 0 if sev_send_get_packet_len() fails
  - kvm: Add support for userspace MSR filtering and handling of MSR_KVM_MIGRATION_CONTROL.
  - migration/ram: Force encrypted status for flash0 & flash1 devices.
  - migration/ram: add support to send encrypted pages
  - migration: add support to migrate shared regions list
  - kvm: Add support for SEV shared regions list and KVM_EXIT_HYPERCALL.
  - target/i386: sev: add support to load incoming encrypted page
  - target/i386: sev: add support to encrypt the outgoing page
  - target/i386: sev: do not create launch context for an incoming guest
  - target/i386: sev: provide callback to setup outgoing context
  - confidential guest support: introduce ConfidentialGuestMemoryEncryptionOps for encrypted VMs
  - migration.json: add AMD SEV specific migration parameters
  - doc: update AMD SEV to include Live migration flow
  - crypto/tlscredspsk: Free username on finalize
  - hw/nvme: fix leak of uninitialized memory in io_mgmt_recv
  - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
  - cvm : Implement command blacklist for cvm security enhancement
  - crypto: Introduce SM3 hash hmac pbkdf algorithm
  - virtio-net: Use virtual time for RSC timers
  - vvfat: Fix bug in writing to middle of file
  - hw/core/ptimer: fix timer zero period condition for freq > 1GHz
  - hw/misc: support vpsp


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-19
changelog:
  - mac_dbdma: Remove leftover `dma_memory_unmap` calls(CVE-2024-8612)
  - softmmu: Support concurrent bounce buffers(CVE-2024-8612)
  - system/physmem: Per-AddressSpace bounce buffering
  - system/physmem: Propagate AddressSpace to MapClient helpers


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-20
changelog:
  - Added CoDA feature support in the context of CVM. When virtcca cvm is enabled, the iommu is tagged as secure.
  - hw/block: fix uint32 overflow
  - hw/ufs: add basic info of query response upiu
  - crypto: avoid leak of ctx when bad cipher mode is given Fixes: Coverity CID 1546884


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-21
changelog:
  - tests: bump QOS_PATH_MAX_ELEMENT_SIZE again
  - softmmu/physmem: fix memory leak in dirty_memory_extend()
  - crypto: run qcrypto_pbkdf2_count_iters in a new thread
  - hw/audio/virtio-sound: fix heap buffer overflow
  - hw/intc/arm_gic: fix spurious level triggered interrupts
  - ui/sdl2: set swap interval explicitly when OpenGL is enabled
  - target/riscv/kvm: tolerate KVM disable ext errors
  - virtio: remove virtio_tswap16s() call in vring_packed_event_read()
  - block: fix -Werror=maybe-uninitialized false-positive
  - hw/remote/vfio-user: Fix config space access byte order
  - hw/loongarch/virt: Fix memory leak
  - hw/intc/riscv_aplic: APLICs should add child earlier than realize
  - stdvga: fix screen blanking
  - ui/gtk: Draw guest frame at refresh cycle
  - target/i386: fix size of EBP writeback in gen_enter()
  - virtio-net: drop too short packets early
  - target/ppc: Fix lxv/stxv MSR facility check
  - target/ppc: Fix lxvx/stxvx facility check
  - virtio-snd: add max size bounds check in input cb(CVE-2024-7730)


author: lifeifei <lifeifei@kylinos.cn> - 2.19-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add the socket option IPV6_MULTICAST_LOOP to prevent the interface from autoconfiguring using RA messages sent by itself.


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 1.1.0-12
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: yanglongkang <yanglongkang@h-partners.com> - 0.6.8-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport libtraceevent patch to adapt to kernel ftrace ring buffer change


author: renhongxun <renhongxun@h-partners.com> - 0.6.8-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:clear the link to rasdaemon.service when uninstalling rasdaemon
         and ensure rasdaemon restart once be upgraded


author: luoshengwei <luoshengwei@huawei.com> - 0.8.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cpu isolate errors when some cpus are offline
    before the service started


author: wangkai <13474090681@163.com> - 7.2.7-1
changelog:
  - Update to 7.2.7
  - Fix CVE-2021-32626 CVE-2021-32627 CVE-2021-32762 CVE-2021-32675
    CVE-2021-41099 CVE-2021-32628 CVE-2021-32687 CVE-2022-24735
    CVE-2022-24736 CVE-2022-3647 CVE-2022-3734 CVE-2022-35977
    CVE-2023-25155 CVE-2024-46981


author: zhouyihang <zhouyihang3@h-partners.com> - 0.9.1-4
changelog:
  - Type:requirements
  - Id:NA
  - SUG:NA
  - DESC:use libsoup2 instead of libsoup3 for build when no libsoup3 provided


author: Funda Wang <fundawang@yeah.net> - 3.2.7-6
changelog:
  - fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
    CVE-2024-12088, CVE-2024-12747


author: pengyi <pengyi37@huawei.com> - 8.2210.0-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:omprog bugfix: invalid status handling at called program
         core bugfix: template system may generate invalid json


author: linzhuorong <linzhuorong@huawei.com> - 8.2210.0-3
changelog:
  - Type:NA
  - ID:NA
  - SUG:NA
  - DESC: imjournal: add second fallback to _COMM
          bugfix: prevent pot. segfault when switchung to
          core/bugfix: using $uuid msg prop can deadlock rsyslog on shutdown
          GNUTls Driver: Fix memory leaks in gtlsInitCred


author: zhangyaqi <zhangyaqi@kylinos.cn> - 8.2312.0-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leak in omazureeventhubs on accepted PN_DELIVERY event


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2312.0-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix passing the value to EscapeChar
         Do not free the uninitialized cstring
         Keep original free pattern
         network subsystem: improve connection failure error message
         Fix runConf NULL pointer refence
         rainerscript: do not try to call a function if it does not exist
         nsd_ptcp regression fix: remove debugging messages emited to stderr
         Fix legacy $ActionQueueDiscardMark parameter


author: jinlun<jinlun@huawei.com> - 40.7-1
changelog:
  - update version to 40.7
    - Allow chronyd-restricted read chronyd key files
    - Allow systemd-sleep set attributes of efivarfs files
    - Make name_zone_t and named_var_run_t a part of the mountpoint attribute
    - Update cifs interfaces to include fs_search_auto_mountpoints()
    - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
    - Add map_read map_write to kernel_prog_run_bpf
    - Add policy for nvme-stas
    - Make new virt drivers permissive
    - Allow named and ndc use the io_uring api
    - Allow sssd send SIGKILL to passket_child running in ipa_otpd_t


author: yaqiangchen <chenyaqiang@huawei.com> - 14.4.2.0-29
changelog:
  - Fix CVE-2021-33844,CVE-2023-32627,CVE-2021-23159,CVE-2023-34432
  - CVE-2023-34318,CVE-2021-23172,CVE-2021-3643,CVE-2021-23210
  - CVE-2022-31650,CVE-2023-26590,CVE-2022-31651,CVE-2023-32627
  - CVE-2017-18189


author: yanglu <yanglu72@h-partners.com> - 7:6.1-2
changelog:
  - Type:cves
  - ID:CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848
  - SUG:NA
  - DESC:fix CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848


author: zhangyao <zhangyao108@huawei.com> - 255-27
changelog:
  - DESC:network networkd address does not set up firewall rules
         add backport-network-networkd-address-don-t-set-up-firewall-rules.patch


author: zhangyao <zhangyao108@huawei.com> - 255-32
changelog:
  - backport upstream patch to solve systemd-shutdown hang all the time caused by fsync blocked by absence of DM mapping table


author: langfei<langfei@huawei.com> - 4.5-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Resolve stap-exporter.service chenge to disable when upgraded systemtap-stap-exporter package


author: langfei<langfei@huawei.com> - 4.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix some test cases fail to be executed, Resolve the sc2168 warning detected by the shellcheck tool.


author: liuchao <liuchao173@huawei.com> - 5.0-1
changelog:
  - Upgrade to 5.0:
    - Performance improvements in uprobe registration and module startup.
    - More probe point process details are printed in "-L" list mode with more "-v".
    - For the case where newer kernels may break systemtap runtime APIs, better pass-4 failure diagnostics are printed.
    - Tapset function print_ubacktrace_fileline() now understands DWARF5.
    - The target(s) of process probes may be specified by path name globs,  as located selected debuginfod servers.
    - The kernel-user message transport system added framing codes, making the transport more reliable, but becoming incompatible across pre-5.0 versions. Use matching versions of stap and staprun.
    - The testsuite Makefile has been simplified to remove concurrency, so "parallel" and "resume" modes are gone.
    - New runtime macro STP_TIMING_NSECS is now supported for reporting probe timing stats in nsecs instead of cycles.  This may become default later.
    - Add new runtime macro STP_FORCE_STDOUT_TTY to override STP_STDOUT_NOT_ATTY.


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: liuchao <liuchao173@huawei.com> - 2.21.0-1
changelog:
  - upgrade to 2.21.0:
    - api: fixed stop method not to require any parameter
    - plugin_scheduler: fix perf fd leaks
    - allow skipping rollback when restarting TuneD or switching profile
    - function_calc_isolated_cores: no errors for offline CPUs
    - sap-hana: new profile sap-hana-kvm-guest
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
    - fixed possible traceback on SIGHUP
    - updated manual pages to be consistent
    - tuned-adm: better error message for unauthorized switch_profile
    - plugin_sysctl: report reapplied sysctls only on different values
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - plugin_cpu: added support for intel_pstate scaling driver
    - plugin_scheduler: do not leak FDs from the perf
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - throughput-performance: set net.core.somaxconn to at least 2048
    - API: added support for moving devices between instances
    - added support for the API access through the Unix Domain Socket
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - do not exit on duplicate config lines


author: ZhaoYu Jiang <jiangzhaoyu@kylinos.cn> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)
    - tuned-ppd: fixed controller init to correctly set_on_battery


author: langfei<langfei@huawei.com> - 2022g-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix Palestine predictions for 2072 through 2075; Ittoqqortoormiit (America/Scoresbysund) zone change.


author: langfei <langfei@huawei.com> - 2024a-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Aysén Region moves from -04/-03 to -03; new zone;
  -	Improve recent commentary for Chilean decrees;
  -	No need for America/Coyhaique in zonenow.tab.


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-41
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


author: yanglu <yanglu72@h-partners.com> -1.20.11-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix regression caused by the fix for CVE-2024-0229 
         fix use after free related to CVE-2024-21886


author: shuaijiakun <shuaijiakun1288@phytium.com.cn> -1.20.11-32
changelog:
  - Type:feature
  - CVE:NA
  - SUG:NA
  - DESC:fix display error for ps23xx when using ast and pe2201 bmc card.


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: yuanchao <1050706328@qq.com> - 0.13.72-4
changelog:
  - backport:disable zzip_use_file_header_zip64_offset,and fix wrong format in changelog,to support clang build


