# changelog

author: Lubomir Rintel <lkundrak@v3.sk> - 1.10.2-1
changelog:
  - Update to 1.10.2 release (rh #1543498)
  - Don't grab cdc_ether devices on Sierra QMI modems (rh #1712031)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.40.16-5
changelog:
  - support bond port prio property (rh #1920398)
  - team: don't try to connect to teamd in update_connection() (rh #2182029)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-2
changelog:
  - Resolve issues found by rpmdiff
    - add explicit Requires: on subpackages to avoid the need to test
      interoperability between the various combinations of old and new
      subpackages


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-3
changelog:
  - Add a patch to resolve one more issue found by rpmdiff/rpminspect:
    fix getaddrinfo detection to avoid using gethostbyname.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12-6
changelog:
  - Python 2 binary package renamed to python2-pyyaml
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.12-9
changelog:
  - Fix ambiguous Python 2 dependency declarations
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Miro Hrončok <mhroncok@redhat.com> - 3.12-12
changelog:
  - Rename python3-PyYAML to python3-pyyaml
  - Modernize spec
  - Fix python2 invocation

  - Cherry-picked from: https://src.fedoraproject.org/rpms/PyYAML/pull-request/2


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-14
changelog:
  - drop obsolete BuildRoot and Group tags
  - fix spurious acl_check() failure on setfacl --restore (#1451826)


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-15
changelog:
  - setfacl.1: document the meaning of '-' in perms (#1337039)
  - avoid failure of %check when building as root (#1085389)
  - apply patches automatically to ease maintenance


author: Al Stone <ahs3@redhat.com> - 20190108-1
changelog:
  - Update to 20190108 source tree, including patch refeshes.
  - Replace use of strncpy() with memcpy() when moving ASCII bytes around;
    the tables use "strings" but they are seldom null terminated, causing
    GCC9 to complain.  Closes BZ#1674629.


author: Al Stone <ahs3@redhat.com> - 20190509-2
changelog:
  - Added an arm7hl specific fix acenv.h; GCC9 on arm7hl can now deal
    with misalignments so the unaligned patch could be relaxed a bit
  - the templates test was failing because of the backup left behind
    by the patch macro, so change the invocation of the macro.


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 20190509-5.0.1
changelog:
  - Fix upgrade and downgrade warning (xuchunmei)
    * remove %pre to avoid warning when upgrade from old version
    * exec "alternatives --install" to avoid missing of acpixtract and acpidump
      when downgrade to old version
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build (Liwei Gei)
  - ignore mismatched ACPI Warning message at misc tests


author: Sumit Bose <sbose@redhat.com> - 0.8.2-6
changelog:
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1806260]
  - No longer able to delete computer from AD using adcli [#1846882]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1846878]
  - Typo in adcli update --help option [#1791611]
  - Manpage and help does not explain the use of "-C" option [#1791545]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-8
changelog:
  - Add --use-ldaps option to adcli update as well [#1883467]
  - Cannot join a pre-staged Computer Account on AD in Custom OU using Delegated
    user [#1734764]
  - missing documentation for required AD rights for adcli join and net
    join [#1852080]
  - [RFE] Add new mode to just create an AD account to be able to connect to
    LDAP [#1854112]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-10
changelog:
  - [RFE] Adcli and Realm Error Code Optimization Request [#1889386]
  - [RFE] adcli should allow to modify DONT_EXPIRE_PASSWORD attribute [#1769644]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-12
changelog:
  - [RFE] Allow adcli to create AD user with password as well as set or reset
    existing user password [#1952828]
  - [RFE] add option to populate "managed by" computer attribute [#1690920]


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.20-7
changelog:
  - the ownership of the spool directory should be root as at is configured
    with daemon username root
  - document the -n option


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-1
changelog:
  - Update to new 3.10.3 stable version.
  - Remove ppc64/ppc64le related patches.
  - All packages now use -A option to specify the target CPU/Architecture instead of 
  sed substitutions and auto detection. The packages should now be less dependant on the 
  builder machine used.
  - Base package for each architecture should now be configured to be compatible with the 
  most basic machine of given type.
  - In addittion to base package, added some optimized packages for more advanced CPUs for
  most architectures.
  - Dropped sse2/sse3 subpackages for ix86


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-6
changelog:
  * Pass all required compiler/linker flags
  - use annobin plugin
  - generate assembler build notes
  Related: #1624098


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-8
changelog:
  * Update the s390 subpackages:
  - The base pakcage is now optimized to z13
  - New subpackage is introduced: z14
  - All remaining subpackages for s390 are being deprecated
  - Clean up of the spec file 
  - Some commented out subpackages were removed form the spec
  - These subpackages were not built/shipped -> no change from the users point of view
  Resolves: #1782560
  Resolves: #1780286
  Resolves: #1782561


author: Kamil Dudka <kdudka@redhat.com> 2.4.47-19
changelog:
  - fix test-suite failure with perl-5.26.0 (#1473853)
  - apply patches automatically to ease maintenance
  - update URL of the upstream source tarball


author: Steve Grubb <sgrubb@redhat.com> 3.0-0.15.20191104git1c2f876
changelog:
  resolves: rhbz#1757986 - Rebase audit package on 8.2 for updates
  resolves: rhbz#1767054 - move audit rules to shared data directory
  resolves: rhbz#1746018 - Breakup 30-ospp-v42.rules into more granular files
  resolves: rhbz#1740798 - auditctl(8) needs clarification for backlog_limit
  resolves: rhbz#1497279 - Add option to interpret fields in audit syslog plugin


author: Sergio Correia <scorreia@redhat.com> - 3.0.5-1
changelog:
  - Rebase audit package on 8.6
    Resolves: rhbz#1939406
    Resolves: rhbz#1906065
    Resolves: rhbz#1921447
    Resolves: rhbz#1927884
    Resolves: rhbz#1921658


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-2
changelog:
  - Adjust sample-rules dir permissions
    Resolves: rhbz#2054727 - /usr/share/audit/sample-rules is no longer readable by non-root users


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-3
changelog:
  - Fix path normalization in auparse
    Resolves: rhbz#2062612 - auparse missing information when used with --format-text


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-4
changelog:
  - Drop ProtectHome from auditd.service as it interferes with rules
    Resolves: rhbz#2071727 - Default systemd service config blocks audit watch rules in some directories


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-2
changelog:
  - Parse auto_reset_crashkernel in kdump
    resolves: rhbz#2042772
  - Add new directives and options for chrony


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-4
changelog:
  - Fix parsing of /usr/lib/tmpfiles.d/provision.conf
  - Fix parsing of /etc/kernel/cmdline
    resolves: rhbz#2155136, rhbz#2159282


author: Pavel Březina <pbrezina@redhat.com> - 1.1-1
changelog:
  - Rebase to authselect-1.1 (RHBZ #1685516)
  - Notify that oddjob-mkhomedir needs to be enabled manually (RHBZ #1694103)
  - Ask for smartcard insertion when smartcard authentication is required (RHBZ #1674397)
  - Update translations (RHBZ #1689973)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.1-1
changelog:
  - Rebase to authselect-1.2.1 (RHBZ #1810471)
  - CLI commands are now correctly translated (RHBZ #1816009)
  - Remove unsupported features from sssd profile description (RHBZ #1830251)
  - add `with-files-access-provider` to sssd profile (RHBZ #1734094)
  - switch to pam_usertype module (RHBZ #1773567)
  - fix typo in sssd profile description (RHBZ #1787638)
  - add minimal profile (RHBZ #1654018)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.2-2
changelog:
  - try_first_pass option no longer works on some PAM modules in RHEL8 (RHBZ #1949070)
  - Need to localize the description of --debug option in authselect show (RHBZ #1970408)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.5-1
changelog:
  - Rebase to 1.2.5 (RHBZ #2080238)
  - sssd profile with-smartcard no longer prevents local users from accessing cron (RHBZ #2070325)
  - backup-restore now works correctly (RHBZ #2066535)
  - add with-subid to sssd profile (RHBZ #2063750)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-1
changelog:
  - Rebase to 1.2.6 (RHBZ #2142805)
  - Update translations (RHBZ #2139696)
  - Change password hashing algorithm from yescrypt back to sha512 (RHBZ #2151140)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-2
changelog:
  - Fix Japanese translations (RHBZ #2216755)
  - Update translations (RHBZ #2189557)
  - Do not prompt for password twice when changing password of local user (RHBZ #2179607)


author: Ian Kent <ikent@redhat.com> - 5.1.4-93
changelog:
  - bz2165143 - Autofs reports can't connect to sssd, retry for 10 seconds when
    real problem is empty LDAP object
    - improve handling of ENOENT in sss setautomntent().
    - dont immediately call function when waiting.
  - Resolves: rhbz#2165143


author: Ian Kent <ikent@redhat.com> - 5.1.4-102
changelog:
  - bz2177998 - deadlock while reading amd maps
    - fix return status of mount_autofs().
    - don't close lookup at umount.
    - fix deadlock in lookups.
    - dont delay expire.
    - make amd mapent search function name clear.
    - rename statemachine() to signal_handler().
    - make signal handling consistent.
    - fix incorrect print format specifiers in get_pkt().
    - eliminate last remaining state_pipe usage.
    - add function master_find_mapent_by_devid().
    - use device id to locate autofs_point when setting log priotity.
    - add command pipe handling functions.
    - switch to application wide command pipe.
    - get rid of unused field submnt_count.
    - fix mount tree startup reconnect.
    - fix unterminated read in handle_cmd_pipe_fifo_message() (Coverity).
  - Resolves: rhbz#2177998


author: Ian Kent <ikent@redhat.com> - 5.1.4-103
changelog:
  - bz2177998 - deadlock while reading amd maps
    - rebuild to avoid possible NVR problems.
  - Related: rhbz#2177998


author: Ian Kent <ikent@redhat.com> - 5.1.4-104
changelog:
  - bz2208408 - autofs fails to start with combination of +auto.master and
    local direct map lookups after upgrading to 5.1.4-93.el8
    - fix memory leak in sasl_do_kinit() (Coverity).
    - fix fix mount tree startup reconnect.
  - Resolves: rhbz#2208408


author: Ian Kent <ikent@redhat.com> - 5.1.4-105
changelog:
  - bz2207801 - amd map format netgoup selector function not working
    - fix date for revision 104 changelog entry.
    - fix use_ignore_mount_option description.
    - include addtional log info for mounts.
    - fix amd selector function matching.
    - get rid entry thid field.
    - continue expire immediately after submount check.
    - add buffer length checks to autofs mount_mount().
    - eliminate realpath from mount of submount.
    - eliminate root param from autofs mount and umount.
    - remove redundant fstat from do_mount_direct().
    - get rid of strlen call in handle_packet_missing_direct().
    - remove redundant stat call in lookup_ghost().
    - set mapent dev and ino before adding to index.
    - change to use printf functions in amd parser.
    - dont call umount_subtree_mounts() on parent at umount.
    - dont take parent source lock at mount shutdown.
    - eliminate buffer usage from handle_mounts_cleanup().
    - fix possible use after free in handle_mounts_exit().
    - make submount cleanup the same as top level mounts.
    - eliminate some more alloca usage.
    - add soucre parameter to module functions.
    - add ioctlfd open helper.
    - make open files limit configurable.
  - Resolves: rhbz#2207801


author: Ian Kent <ikent@redhat.com> - 5.1.4-106
changelog:
  - bz2214444 - The sss lookup modules handles error return incorrectly
    in some cases
    - fix some sss error return cases.
  - Resolves: rhbz#2214444


author: Ian Kent <ikent@redhat.com> - 5.1.4-107
changelog:
  - bz2216877 - When looking up included maps, sometimes autofs does not
    consult all the included files in order
    - fix incorrect matching of cached wildcard key
  - Resolves: rhbz#2216877


author: Ian Kent <ikent@redhat.com> - 5.1.4-108
changelog:
  - bz2216877 - When looking up included maps, sometimes autofs does not
    consult all the included files in order
    - fix the "fix incorrect matching of cached wildcard key" patch.
  - Related: rhbz#2216877


author: Ian Kent <ikent@redhat.com> - 5.1.4-109
changelog:
  - bz2213267 - filesystems mount and expire immediately
    - fix expire retry looping.
  - Resolves: rhbz#2213267


author: Michal Sekletar <msekleta@redhat.com> - 0.7-21.1
changelog:
  - Fix CVE-2021-3468 (RHEL-18311)
  - Fix CVE-2023-38469 (RHEL-17783)
  - Fix CVE-2023-38470 (RHEL-17795)
  - Fix CVE-2023-38471 (RHEL-17789)
  - Fix CVE-2023-38472 (RHEL-17807)
  - Fix CVE-2023-38473 (RHEL-17801)


author: Kevin Fenzi <kevin@scrye.com> - 1.07.1-1https://bugs.archlinux.org/task/53546
changelog:
  - Update to 1.07.1
  - Fixes a bug that breaks kernel builds ( https://bugs.archlinux.org/task/53546 )


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-4
changelog:
  - Tighten cache protection against record from forwarders (CVE-2021-25220)
  - Include test of forwarders


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-5
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Yara Ahmad <yahmad@redhat.com> - 2.30-121
changelog:
  - Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (#2164700)


author: Xue haolin <xuehaolin@openanolis.org> - 2.30-123.0.1
changelog:
  - Rebrand to Anolis OS.
  - Add loongarch support. (lixing@loongson.cn)
  - Fixup LoongArch wrong debug line. (lixing@loongson.cn)
  - Add LoongArch missing opcode. (lixing@loongson.cn)
  - Fixup gas SIGSEGV for extremely long function name. (lixing@loongson.cn)
  - change loong64 to loongarch64. (lixing@loongson.cn)
  - Add ifunc support. (lixing@loongson.cn)
  - Delete R_LARCH_NONE for eh_frame. (lixing@loongson.cn)
  - Fixup pr21964 bug. (lixing@loongson.cn)
  - Add 3A6000 opcode. (lixing@loongson.cn)
  - Fix some testsuite error. (lixing@loongson.cn)


author: Michal Sekletár <msekleta@redhat.com> - 0.7.3-2
changelog:
  - make biosdevname optional even on Dell servers (#1623621)
  - prevent infinite recursion in smbios_setslot() (#1499458)
  - Netronome biosdevname support (#1649036)


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.2.0-2
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Tomas Orsava <torsava@redhat.com> - 1.2.0-9
changelog:
  - Switch hardcoded python3 shebangs into the %{__python3} macro
  - Add missing BuildRequires on python3-devel so that %{__python3} macro is
    defined


author: Gopal Tiwari <gtiwari@redhat.com> - 5.56-1
changelog:
  + bluez-5.56-1
  - Fixing (#1965057)
  - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56


author: Christian Kellner <ckellner@redhat.com> - 0.1-2
changelog:
  - Set database path to /var/lib/boltd, create it during
    installation, which is needed for the service file to work.


author: Christian Kellner <ckellner@redhat.com> - 0.8-1
changelog:
  - bolt 0.8 upstream release with pre-boot ACL and IOMMU support
    D-Bus Configuration moved from sysconfdir to datadir
    Resolves: #1629715


author: Christian Kellner <ckellner@redhat.com> - 0.8-2
changelog:
  - Rebuilt for fixed gating.yaml (remove missing tier1 gate)
  - Unset env NOTIFY_SOCKET for no socket case in test-unix


author: Marian Csontos <mcsontos@redhat.com> 1.3-1
changelog:
  - Check for duplicates consistently in the clone and edit commands.
  - Apply correct command line precedence to --add-opts and --del-opts.
  - Correctly merge multiple --add/del-opts when editing or cloning.
  - Correctly propagate --add/del-opts in boom edit commands.
  - Enhanced logging of --add/del-opts merge logic.
  - The default Python interpreter is now /usr/bin/python.
  - Fixed re-ordering of options modifications when read from disk.
  - Do not set BootParams attributes for anonymous option words.
  - Make lvm_root_lv validation checks more strict.
  - Improve BootParams.from_entry() parameter recovery debug logging.
  - Include sample OsProfile for Fedora 32.
  - Re-set sandbox state in test suite to ensure run-to-run consistency.
  - Improve compatibility with Red Hat BLS implementation.
  - Allow non-boom managed entries to be listed and displayed.
  - Handle quirks in Red Hat's use of the BLS machine_id key.
  - Allow grub2 bootloader variables to be expanded when cloning entries.
  - Simplify clone_entry logic and make consistent with edit_entry.
  - Ensure stable ordering of legacy boot entry configuration.


author: Colin Walters <walters@verbum.org> - 0.1.7-1
changelog:
  - New upstream version;
    https://github.com/projectatomic/bubblewrap/releases/tag/v0.1.7
  - Resolves: #1411814


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-6
changelog:
  - Resolves: rhbz#1989425 - CVE-2021-3672 c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-7
changelog:
  - Resolves: rhbz#2170867 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-9
changelog:
  - Resolves: rhbz#2238293 - CVE-2020-22217 c-ares: read-heap-buffer-overflow in ares_parse_soa_reply [rhel-8] [rhel-8.9.0.z]


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-81
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-81
changelog:
  - Update to CKBI 2.48 from NSS 3.64
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-82
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Trustis FPS Root CA"
  -    Adding:
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-81
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "DST Root CA X3"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.0
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Adding:
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.2
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-80.0
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: David Howells <dhowells@redhat.com> 0.10.6-1
changelog:
  - Note the correct licence.
  - Handle malformed kernel status correctly.
  - Permit culling to be disabled on the command line with the -N flag.
  - Suspend culling when cache space is short and cache objects are pinned.


author: David Howells <dhowells@redhat.com> 0.10.8-1
changelog:
  - Use systemd interaction macros in specfile installation sections [RH BZ 850053].
  - Fix the service file to use /usr/sbin/ rather than /sbin/.
  - Turn on RELRO and PIE build hardening in RPM builds.


author: Jan Macku <jamacku@redhat.com> - 1.15-1
changelog:
  - spec: sync specfile with Fedora
  - makefile: Use rpmdev-bumpspec's legacy date option
  - Add feature to generate specfile entry, commit and archive


author: Jan Macku <jamacku@redhat.com> - 1.16-1
changelog:
  - alternatives: add --keep-foreign (#57)
  - Translations update from Weblate
  - ci: Onboard chkconfig to Packit
  - zanata: remove zanata related stuff
  - Use make macros
  - alternatives: use one function for path cleaning
  - CI: specify more closely when to run CI
  - Add basic CI and README
  - spec: sync specfile with Fedora


author: Jan Macku <jamacku@redhat.com> - 1.19.2-1
changelog:
  - alternatives: --keep-foreign incorrectly handles non-existent files
  - alternatives: isLink should return 0 in case of lstat error
  - spec: Replace not working awk command with sed (#63)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-2
changelog:
  - move pidfile to /var/run/chrony to allow chronyd to remove it on exit
    (#1584585)
  - avoid blocking in getrandom system call (#1592425)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-3
changelog:
  - fix PIDFile in local chronyd.service on upgrades from chrony < 3.3-2
    (#1614800)
  - add workaround for late reload of unit file (#1614751)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.5-1
changelog:
  - update to 3.5 (#1685469 #1677218)
  - fix shellcheck warnings in helper scripts (#1711948)
  - update ntp2chrony script


author: Miroslav Lichvar <mlichvar@redhat.com> 4.1-1
changelog:
  - update to 4.1 (#1895003 #1847853 #1929157)
  - add NetworkManager dispatcher script to add servers from DHCP even without
    dhclient (#1933139)
  - restrict permissions of /var/lib/chrony and /var/log/chrony (#1939295)
  - reset chrony-helper state after stopping chronyd (#1971697)
  - add gcc-c++ and make to build requirements
  - move default paths in /var/run to /run


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
changelog:
  - update to 4.2 (#2062356)
  - fix chrony-helper to delete sources by their original name (#2061660)
  - update ntp2chrony script (#2018045 #2063766)


author: David King <amigadave@amigadave.com> - 0.16-1
changelog:
  - Update to 0.16 (#1144863)
  - Remove clean section and BuildRoot tag
  - Update URL and Sourc0
  - Use license macro for COPYING
  - Use parallel make flags
  - Preserve timestamps during install


author: Jeff Layton <jlayton@redhat.com> - 6.7-5
changelog:
  - more updates, switch to rst for manpages
  - update mount.cifs manpage to describe defaults better (BZ#1474539)


author: Sachin Prabhu <sprabhu@redhat.com> - 6.8-3
changelog:
  - Add manual gating tests
  - docs: cleanup rst formating
  - mount.cifs.rst: document new (no)handlecache mount option
  - manpage: update mount.cifs manpage with info about rdma option
  - checkopts: add python script to cross check mount options
  - mount.cifs.rst: document missing options, correct wrong ones
  - checkopts: report duplicated options in man page
  - mount.cifs.rst: more cleanups
  - mount.cifs.rst: document vers=3 mount option
  - mount.cifs.rst: document vers=3.02 mount option
  - cifs: Allow DNS resolver key to expire
  - mount.cifs: be more verbose and helpful regarding mount errors
  - Update mount.cifs with vers=default mount option and SMBv3.0.2
  - mount.cifs.rst: update vers=3.1.1 option description
  - getcifsacl: Do not go to parse_sec_desc if getxattr fails.
  - getcifsacl: Improve help usage and add -h option.
  - setcifsacl: fix adding ACE when owner sid in unexpected location
  - cifs.upcall: fix a compiler warning
  - mount.cifs Add various missing parms from the help text
  - mount.cifs: add more options to help message
  - mount.cifs: detect GMT format of snapshot version
  - Update man page for mount.cifs to add new options
  - mount.cifs.rst: mention kernel version for snapshots
  - Fix authors and maintainers


author: Packit <hello@packit.dev> - 297-1
changelog:
  - users: allow administrators to change the user shell
  - Enable Python bridge on Fedora 38 and CentOS/RHEL 9


author: Packit <hello@packit.dev> - 299-1
changelog:
  - Kdump: Show location of kdump to verify the successful configuration test
  - Storage: Support for no-overprovisioning with Stratis
  - Storage: Cockpit can now add caches to encrypted Stratis pools


author: Packit <hello@packit.dev> - 300-1
changelog:
  - Celebrating the Nürnberg life release!
  - Storage: Support for growing block devices of a Stratis pool


author: Kamil Dudka <kdudka@redhat.com> - 8.30-8
changelog:
  - df --local: recognize afs, auristorfs, and smb3 as remote fs (#1798030)
  - fix formatting of sha512sum(1) man page (#1688744)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-9
changelog:
  - split: fix --number=K/N to output correct part of file (#1921246)
  - rm: do not skip files upon failure to remove an empty dir (#1905481)
  - use statx instead of stat when available (#1760300)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-13
changelog:
  - ls, stat: avoid triggering automounts (#2044981)
  - make `df --direct` work again (#2058686)
  - doc: improve description of the --kibibytes option of ls (#1527391)


author: Stanislaw Gruszka <sgruszka@redhat.com> - 3.18_2018.05.31-2
changelog:
  - Update wireless-regdb to 2018.05.31
  - Remove python2 dependency
  - Use sforshee signed reulatory.bin (required by modern kernels)


author: Ondřej Pohořelský <opohorel@redhat.com> - 1.11-17.20190603git
changelog:
  - update to the latest release
  - add sed require
  - remove %clean section
  - remove obsolete Group tag
  - fix upstream URL
  - Resolves: rhbz#1696449, rhbz#1703982


author: Tomáš Mráz <tmraz@redhat.com> - 20200527-2.git63fc906
changelog:
  - explicitly enable DHE-DSS in gnutls config if enabled in policy
  - use grubby with --update-kernel=ALL to avoid breaking kernelopts
  - OSPP subpolicy: Allow GCM for SSH protocol
  - openssh: Support newly standardized ECDHE-GSS and DHE-GSS key exchanges
  - if the policy in FIPS mode is not a FIPS policy print a message
  - openssl: Add SignatureAlgorithms support
  - custom crypto policies: enable completely overriding contents of the list
    value
  - added ECDHE-ONLY.pmod policy module example
  - openssh: make LEGACY policy to prefer strong public key algorithms
  - various python code cleanups
  - update-crypto-policies: dump the current policy to
    /etc/crypto-policies/state/CURRENT.pol
  - split scripts into their own subpackage


author: Tomáš Mráz <tmraz@redhat.com> - 20200610-1.git0ac8b1f
changelog:
  - fallback to FIPS policy instead of the default-config in FIPS mode
  - java: Document properly how to override the crypto policy
  - krb5: No support for 3des anymore
  - reorder the signature algorithms to follow the order in default openssl list


author: Alexander Sosedkin <asosedkin@redhat.com> - 20210617-1.gitc776d3e
changelog:
  - implement scoped policies, e.g., cipher@SSH = ... (#1960266)
  - implement algorithm globbing, e.g., cipher@SSH = -*-CBC
  - deprecate derived properties:
    tls_cipher, ssh_cipher, ssh_group, ike_protocol
  - deprecate sha1_in_dnssec property
  - deprecate unscoped form of protocol property
  - update documentation
  - expand upstream test coverage
  - openssl: set MinProtocol / MaxProtocol separately for TLS and DTLS (#1946522)
  - support AES-192 ciphers in custom policies for non-TLS scenarios (#1876846)
  - stop claiming Camellia is disabled (#1925104)
  - disable CBC ciphers in FUTURE for everything but Kerberos (#1933016)
  - drop SHA224 from signature algorithms in FIPS:OSPP (#1934755)
  - condition ecdh-sha2-nistp384 on SECP384R1


author: Alexander Sosedkin <asosedkin@redhat.com> - 20211116-1.gitae470d6
changelog:
  - OSPP: relax -ECDSA-SHA2-512, -FFDHE-*
  - fips-mode-setup, fips-finish-install: call zipl more often (s390x-specific)
  - libssh: enable diffie-hellman-group14-sha256 support
  - openssl: fix disabling ChaCha20


author: Alexander Sosedkin <asosedkin@redhat.com> - 20221215-1.gitece0092
changelog:
  - bind: expand the list of disableable algorithms
  - tests/java: fix java.security.disableSystemPropertiesFile=true
  - stop accidentally creating /etc/crypto-policies/back-ends/.config symlink


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-4
changelog:
  - patch: Fix reencryption for custom devices with data segments
    set to use cipher_null.
  - Resolves: #1927409


author: Ondrej Kozina <okozina@redhat.com> - 2.3.7-1
changelog:
  - update to cryptsetup 2.3.7
  - fixes CVE-2021-4122
  - patch: Fix suboptimal optimization in bundled argon2.
  - patch: Fix bogus memory allocation/device read with
           invalid LUKS2 headers
  - patch: Fix typo in luksRepair prompt.
  - Resolves: #2021815 #2022301 #2031859


author: Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-4
changelog:
  - patch: Remove LUKS2 encryption data size restriction.
  - patch: Abort encryption when header and data devices are same.
  - Resolves: #2150254


author: Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-6
changelog:
  - patch: Delegate FIPS mode detection to configured crypto backend
  - patch: Disallow use of internal kenrel crypto driver names in "capi"
  - patch: Also disallow active devices with internal kernel names
  - patch: Fix init_by_name to allow unknown cipher format in dm-crypt
  - patch: Fix reencryption to fail properly for unknown cipher
  - patch: Fix activation of LUKS2 with capi format cipher and kernel
  - Resolves: #2212772 #2193342


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-46
changelog:
  - 2074684 - lp to a remote server takes a long time
  - 2074736 - CUPS is too chatty about "Removing document files." in debug mode


author: Bo Liu <liub03@inspur.com> - 7.61.1-31.0.3.2
changelog:
  - url: only reuse connections with same GSS delegation (CVE-2023-27536)
  - fix host name wildcard checking (CVE-2023-28321)


author: Simo Sorce <simo@redhat.com> - 2.1.27-0.4rc7
changelog:
  - Add patch form Upstream PR559 to use RC4 implementation from OpenSSL
  - Resolves bz#1618744
  - Fix multilib issue bz#1663120


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-22
changelog:
  - Use hangup signal instead of termination signal to
    kill sesssion monitoring script to appeach tcsh.
    Related: #2089362


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-23
changelog:
  - Address race for very short running sessions in SSH
    session monitoring script.
    Related: #2089362


author: Ray Strode <rstrode@redhat.com> - 1.12.8-25
changelog:
  - Ensure only one dbus-daemon is spawned for all shells sharing
    a single connection.
    Resolves: #2189201


author: Zhao Hang <wb-zh951434@alibaba-inc.com> - 1.12.8-26.0.1
changelog:
  - Add doc sub package, requires and provides
  - Fix build failure(Chang Gao)
  - Fix CVE-2023-34969 (Bo Liu)


author: Till Maas <opensource@till.name> - 0.104-2
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-9
changelog:
  - Python 2 binary package renamed to python2-dbus
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-10
changelog:
  - Also add Provides for the old name without %_isa
  - Use %python_provide for the python3 subpackage and drop manual Provide which
    conflicts with %python_provide in the python2 subpackage.


author: Peter Jones <pjones@redhat.com> - 8-1
changelog:
  - Update to dbxtool 8
  - Make a "make coverity" rule to scan the source
    Results at: https://scan.coverity.com/projects/rhboot-dbxtool
  - Don't try to apply anything if PK and KEK aren't enrolled
  - Add --force and --quiet for the PK/KEK checker, and use them in the
    systemd service.
    Resolves: rhbz#1489942
  - Add a .syntastic_c_config for vim's Syntastic modules
  - Use tsearch()/tfind()/tdestroy() from libc instead of ccan htables
  - Don't open the dbx file with O_RDWR|O_CREAT, use O_RDONLY.
  - Lots of minor bug fixes gcc -Wextra and friends found.


author: Peter Jones <pjones@redhat.com> - 8-2
changelog:
  - Don't use -f in dbxtool.service; that'll make it do the thing we're
    trying to avoid.
    Resolves: rhbz#1489942


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-30
changelog:
  - Add 0111-multipathd-factor-out-the-code-to-flush-a-map-with-n.patch
  - Add 0112-libmultipath-return-success-if-we-raced-to-remove-a-.patch
  - Add 0113-multipathd-Handle-losing-all-path-in-update_map.patch
  - Resolves: bz #2110485


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-31
changelog:
  - Add 0114-multipathd-ignore-duplicated-multipathd-command-keys.patch
    * Fixes bz #2133996
  - Add 0115-multipath-tools-use-run-instead-of-dev-shm.patch
    * Fixes bz #2133990
  - Resolves: bz #2133990, #2133996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-32
changelog:
  - Add 0116-kpartx-hold-device-open-until-partitions-have-been-c.patch
    * Fixes bz #2128885
  - Add 0117-libmultipath-cleanup-remove_feature.patch
  - Add 0118-libmultipath-cleanup-add_feature.patch
  - Add 0119-multipath-tests-tests-for-adding-and-removing-featur.patch
  - Add 0120-libmultipath-fix-queue_mode-feature-handling.patch
  - Add 0121-multipath-tests-tests-for-reconcile_features_with_qu.patch
  - Add 0122-libmultipath-prepare-proto_id-for-use-by-non-scsi-de.patch
  - Add 0123-libmultipath-get-nvme-path-transport-protocol.patch
  - Add 0124-libmultipath-enforce-queue_mode-bio-for-nmve-tcp-pat.patch
    * Fixes bz #2022359
  - Resolves: bz #2022359, #2128885


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-33
changelog:
  - Add 0125-multipath-add-historical-service-time-to-the-man-pag.patch
    * Fixes bz #2141996
  - Modify tests/multipath_conf_syntax/main.sh
    * fix unrelated test error
  - Resolves: bz #2141996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-34
changelog:
  - Add 0126-libmultipath-copy-mpp-hwe-from-pp-hwe.patch
    * Fixes bz #2126714
  - Cleanup multiple CI tests
  - Resolves: bz #2126714


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-35
changelog:
  - Add 0127-libmultipath-don-t-leak-memory-on-invalid-strings.patch
  - Add 0128-libmutipath-validate-the-argument-count-of-config-st.patch
  - Resolves: bz #2155560


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-36
changelog:
  - Add 0129-libmultipath-select-resize-action-even-if-reload-is-.patch
  - Add 0130-libmultipath-cleanup-ACT_CREATE-code-in-select_actio.patch
  - Add 0131-libmultipath-keep-renames-from-stopping-other-multip.patch
  - Resolves: bz #2166468


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-37
changelog:
  - Fix bugzilla linked to the changes (was previously linked to
    the wrong bug, 2162537)
  - Resolves: bz #2166468


author: Marian Csontos <mcsontos@redhat.com> - 0.8.5-3
changelog:
  - Remove obsolete pool-inactive option from thin_trim man page.
  - Check input file exists eralier, and prevent writing incorrect metadata.


author: Marian Csontos <mcsontos@redhat.com> - 0.9.0-1
changelog:
  - Update to upstream version 0.9.0.
  - Fix important issues found by static analysis.
  - Update crc32c to version 0.5 supporting non x86 architectures.
  - New tools thin_metadata_pack and thin_metadata_unpack.


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-11
changelog:
  - [doc] Describe how gpg keys are stored for `repo_ggpcheck`
  - Add only relevant pkgs to upgrade transaction (RhBug:2097757)


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-12
changelog:
  - Allow passing plugin parameters with dashes in names (RhBug:1980712)
  - Fix upgrade from file to noarch pkg (RhBug:2006018)
  - Add support for group upgrade rollback (RhBug:2016070)
  - Expose plugin unload method to API (RhBug:2047251)
  - Add doc related to --destdir and --downloadonly options (RhBug:2100811)
  - Set default value for variable to prevent crash (RhBug:2091636)
  - Don't include resolved advisories for obsoletes with sec. filters (RhBug:2101421)


author: Nicola Sella <nsella@redhat.com> - 4.7.0-13
changelog:
  - Add support for rollback of group upgrade rollback (RhBug:2016070)
  - Move system-upgrade plugin to core (RhBug:2054235)
  - Fix plugins unit tests + unload plugins upon their deletion (RhBug:2134309)


author: Nicola Sella <nsella@redhat.com> - 4.7.0-15
changelog:
  - Ignore processing variable files with unsupported encoding (RhBug:2141215)
  - Better explain traceback of rpm.error with dnf


author: Jaroslav Rohel <jrohel@redhat.com> - 4.7.0-17
changelog:
  - Omit src RPMs from check-update (RhBug:2151910,2203069)
  - automatic: Fix online detection with proxy (RhBug:2022440,2189851)


author: Lukas Hrazky <lhrazky@redhat.com> - 4.0.21-12
changelog:
  - [repomanage] Use modules only from repo they are handling
  - [repomanage] Add new option --oldonly
  - Skip all non rpm tsi for transaction_action plugins
  - Update translations


author: Lukas Hrazky <lhrazky@redhat.com> - 4.0.21-13
changelog:
  - [copr] Fix 'dnf copr enable' on Fedora 35
  - [copr] Disable dnf playground command
  - [copr] Fix baseurl for centos stream chroot
  - [copr] Silence a deprecation warning in plugins/copr.py
  - [copr] Shorter verification that the project exists
  - [copr] Better error message for dnf copr enable
  - [copr] allow specifying protocol as part of --hub


author: Nicola Sella <nsella@redhat.com> - 4.0.21-17
changelog:
  - offline-upgrade: add support for security filters (RhBug:1939975,2139324)
  - Move system-upgrade plugin to core (RhBug:2054235)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.0-1
changelog:
  - New version
    Resolves: rhbz#1333781
  - Switched to autotools
  - Various spec file cosmetic fixes (e.g. used optflags)


author: Pavel Valena <pvalena@redhat.com> - 049-209.git20220815
changelog:
  - fix(95iscsi): Fix network setup
  - fix(dracut-systemd): correct service dependencies
  - feat(lvm): add new module lvmthinpool-monitor
  - fix(dracut-shutdown): add cleanup handler on failure


author: Pavel Valena <pvalena@redhat.com> - 049-218.git20221019
changelog:
  - Dracut: only login to one target at a time
  - iscsi: don't continue waiting if the root device is present
  - network: stop waiting for interfaces if root device is
  - iscsiroot: parse_iscsi_root overwrites command line args
  - iscsiroot: there's never more than one target per call
  - iscsiroot: try targets only once
  - iscsiroot: remove bashisms
  - fixup "Dracut: only login to one target at a time"
  - 35network-legacy: only skip waiting for interfaces if netroot


author: Pavel Valena <pvalena@redhat.com> - 049-221.git20221214
changelog:
  - fix(80lvmthinpool-monitor): use systemsctl instead of
  - fix(squash): build ld cache for squash loader
  - fix(network-manager): write DHCP filename option to dhcpopts


author: Lukas Czerner <lczerner@redhat.com> 1.45.4-1
changelog:
  - Rebase to the release 1.45.4 (#1783777)
  - provide rhel6/7 compatible fs_type in mke2fs.conf (#1780279)
  - fix crafted ext4 partition leads to out-of-bounds write (#1768709)
  - include note about supported rhel8 features and options (#1788573)


author: Peter Jones <pjones@redhat.com> - 3-2
changelog:
  - Always provide macros for efi_arch and efi_alt_arch (and their _upper
    variants), and make efi_has_arch and efi_has_alt_arch 0 when they will be
    wrong.  This ensures everything can always expand when we're on a non-efi
    architecture.


author: Peter Jones <pjones@redhat.com> - 15-1
changelog:
  - Update to efibootmgr 15
  - Make efibootmgr use EFIDIR / efibootmgr.efidir like fwupdate does
  - make --loader default build-time configurable
  - sanitize set_mirror()/get_mirror()
  - Add support for parsing loader options as UCS2
  - GCC 7 fixes
  - Don't use -fshort-wchar since we don't run on EFI machines.
  - Also rebuild for efivar-31-1.fc26 to get symbol versioning right.
    Resolves: rhbz#1468841


author: Peter Jones <pjones@redhat.com> - 35-1
changelog:
  - Update to efivar 35
  - fixes for older compilers
  - efi_get_variable_exists()
  - Lots of stuff to make CI work.
  - use usleep() to avoid hitting the kernel rate limiter on efivarfs
  - better EFI_GUID macro
  - add efi_guid_fwupdate (0abba7dc-e516-4167-bbf5-4d9d1c739416)


author: Peter Jones <pjones@redhat.com> - 36-1
changelog:
  - Update to efivar 36 (and some change)
    Resolves: rhbz#1635019
  - Add NVDIMM support
  - Re-written linux interface parser to handle how devices are
    partitioned better, and for cleaner code, with one file per device
    type.
  - lots of verbosity updates
  - better CI
  - analysis with clang's analyzer as well as coverity
  - Better handling of immutable bits in sysfs
  - LIBEFIVAR_OPS=help
  - lots of code cleanups.
  - Add emmc device support
  - Add SAS port expander support
  - Support for ACPI root nodes that are less common
    (i.e. ACPI Generic Container and Embedded Controller PNP nodes)
  - Make abbreviated device paths if we can't parse a device's info
  - Don't require NVME to have an EUI


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Mark Wielaard <mjw@redhat.com> - 0.186-1
changelog:
  - Upgrade to upstream 0.186
    - debuginfod-client: Default $DEBUGINFOD_URLS is computed from
      drop-in files /etc/debuginfod/*.urls rather than
      hardcoded into the /etc/profile.d/debuginfod*
      scripts.
      Add $DEBUGINFOD_MAXSIZE and $DEBUGINFOD_MAXTIME settings
      for skipping large/slow transfers.
      Add $DEBUGINFOD_RETRY for retrying aborted lookups.
    - debuginfod: Supply extra HTTP response headers, describing
      archive/file names that satisfy the requested buildid content.
      Support -d :memory: option for in-memory databases.
      Protect against loops in federated server configurations.
      Add -r option to use -I/-X regexes for grooming stale files.
      Protect against wasted CPU from duplicate concurrent requests.
      Limit the duration of groom ops roughly to rescan (-t) times.
      Add --passive mode for serving from read-only database.
      Several other performance improvements & prometheus metrics.
    - libdw: Support for the NVIDIA Cuda line map extensions.
      DW_LNE_NVIDIA_inlined_call and DW_LNE_NVIDIA_set_function_name
      are defined in dwarf.h. New functions dwarf_linecontext and
      dwarf_linefunctionname.
    - translations: Update Japanese translation.


author: Mark Wielaard <mjw@redhat.com> - 0.187-4
changelog:
  - Upgrade to elfutils 0.187
    - debuginfod: Support -C option for connection thread pooling.
    - debuginfod-client: Negative cache file are now zero sized instead
      of no-permission files.
    - addr2line: The -A, --absolute option, which shows file names
      includingthe full compilation directory is now the
      default.  To get theold behavior use the new option --relative.
    - readelf, elflint: Recognize FDO Packaging Metadata ELF notes
    - libdw, debuginfo-client: Load libcurl lazily only when files need
      to be fetched remotely. libcurl is now never loaded when
      DEBUGINFOD_URLS is unset. And whenDEBUGINFOD_URLS is set,
      libcurl is only loaded when the debuginfod_begin function is
      called.
  - Add elfutils-0.187-csh-profile.patch
  - Add elfutils-0.187-debuginfod-client-fd-leak.patch
  - Add elfutils-0.187-mhd_no_dual_stack.patch
  - Add elfutils-0.187-mhd_epoll.patch
  - Add an explicit versioned requires from elfutils-debuginfod-client
    on elfutils-libs and elfutils-libelf.
  - Remove brew testsuite workarounds


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8.1
changelog:
  - Fix etags local command injection vulnerability (#2184369)
  - Fix htmlfontify.el command injection vulnerability (#2184368)
  - Fix ruby-mode.el local command injection vulnerability (#2184367)
  - Fix ob-latex.el command injection vulnerability (#2184377)


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-5
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-11
changelog:
  - CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
  - Resolves: CVE-2022-43680


author: Chris Leech <cleech@redhat.com> - 1.0.32-6
changelog:
  - remove fcoe from SUPPORTED_DRIVERS in /etc/sysconfig/fcoe
  - add qedf to SUPPORTED_DRIVERS in /etc/sysconf/fcoe
  - added upstream fix for large fcoe ctrl numbers


author: Ondrej Vasik <ovasik@redhat.com> - 3.6-1
changelog:
  - own /usr/share/bash-completion{,/completions,/helpers} (#1504616)
  - create and own /usr/lib/debug/.dwz dir to prevent
    dangling symlink (#1508610)


author: Ondrej Vasik <ovasik@redhat.com> - 3.7-1
changelog:
  - own /usr/share/locale and /usr/lib/modules
  - own /usr/lib/sysimage
  - improve filesystem content file to include symlinks and rootdir


author: Tomas Mraz <tmraz@redhat.com> - 1.2.0-1
changelog:
  - add lib subpackage to avoid multilib on the base package
  - add ability to compute hmacs on multiple files at once
  - improved debugging with FIPSCHECK_DEBUG


author: Eric Garver <egarver@redhat.com> - 0.9.3-12
changelog:
  - feat(config): add CleanupModulesOnExit configuration option
  - change default CleanupModulesOnExit=yes


author: Akira TAGOH <tagoh@redhat.com> - 2.13.0-6
changelog:
  - Add Suggests: dejavu-sans-fonts to address pulling the unpredicted
    font package as dependency. (#1321551)


author: Akira TAGOH <tagoh@redhat.com> - 2.13.1-3
changelog:
  - Stop cleaning up .uuid file even when a directory is empty.
    resolves: rhbz#1653171
  - Use Rachana instead of Meera for serif subsitution.
    resolves: rhbz#1650491


author: Marek Kasik <mkasik@redhat.com> - 2.10.4-1
changelog:
  - Update to 2.10.4
  - Test bitmap size earlier for PNGs
  - Fix memory leak in pngshim.c
  - Enable man pages for demos
  - Resolves: #1887084, #1890211


author: Akira TAGOH <tagoh@redhat.com> - 2.10.4-3
changelog:
  - Enable HarfBuzz support
  - Add bootstrap without HarfBuzz
  - Resolves: #1853937
  - Resolves: #1906714


author: Pavel Reichl <preichl@redhat.com> - 2.9.7-16
changelog:
  - Back-port max_pages support,
  - caching symlinks in kernel page cache,
  - and in-kernel readdir caching
  - Fixed rhbz#2080000


author: Richard Hughes <richard@hughsie.com> 1.5.4-1
changelog:
  - Rebase package to include support for latest OEM hardware and to
    support deploying UEFI SecureBoot dbx updates.
  - Resolves: #1870811


author: Richard Hughes <richard@hughsie.com> 1.5.5-2
changelog:
  - Do not invalidate all remote timestamps during package install to fix rpm -V.
  - Backport some important high priority fixes from upstream.
  - Resolves: #1926382


author: Richard Hughes <richard@hughsie.com> 1.5.9-3
changelog:
  - Rebase to include the SBAT metadata section to allow fixing BootHole
  - Resolves: rhbz#1933012
  - Resolves: rhbz#1932953
  - Resolves: rhbz#1932909
  - Resolves: rhbz#1932882
  - Resolves: rhbz#1932579
  - Resolves: rhbz#1932553
  - Resolves: rhbz#1932423


author: Richard Hughes <richard@hughsie.com> 1.7.1-1
changelog:
  - New upstream release
  - Backport upstream changes
  - Include support for Dell TBT4 Docking stations
  - Resolves: rhbz#1969472
  - Resolves: rhbz#1976408


author: Richard Hughes <richard@hughsie.com> 1.7.1-2
changelog:
  - Disable the Logitech bulkcontroller plugin to avoid adding a dep to protobuf-c
    which lives in AppStream, not BaseOS.
  - Resolves: rhbz#2029333


author: Richard Hughes <richard@hughsie.com> 1.7.4-1
changelog:
  - Include support for Lenovo TBT4 Docking stations
  - Do not cause systemd-modules-load failures
  - Resolves: rhbz#2038258
  - Resolves: rhbz#2037294


author: Peter Jones <pjones@redhat.com> - 10-4
changelog:
  - Roll in some bugfixes that'll be in fwupdate-11 upstream.
    This helps fix a couple of vendors machines.


author: Weitao Zhou <zhouwt@linux.alibaba.com> 11-3.0.1
changelog:
  - Disable -Wno-address-of-packed-member to fix build failed with gcc9.2
  - Support loongarch64 platform(Liwei Ge)


author: Charles R. Anderson <cra@wpi.edu> - 2008_10_13-10
changelog:
  - Patch to apply CFLAGS/LDFLAGS to final link so RPM_OPT_FLAGS are picked up (rhbz#1548426)
  - Use CC=gcc explicitly
  - Regenerate fxload-noa3load.patch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.1.4-7
changelog:
  - Revert previous change of adding 'awk*' symlinks for info pages (bug #1486924)
  - Added patch to correctly fix the info pages issue (bug #1486924)
  - specfile content refactored for better readability
  - Package now provides its ABI version via gawk(abi)
  - Added test for usage of correct gawk(abi) into %check section


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-1
changelog:
  - Update to latest stable release from upstream [new API version - 2.0]
  - Added latest relevant patches from upstream's gawk-4.2-stable branch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-2
changelog:
  - 'noarch' removed from *-devel subpackage
  - added arch requirement for *-devel subpackage
  - updated the build process to use %make_build macro


author: Marek Polacek <polacek@redhat.com> 8.5.0-13
changelog:
  - require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
  - backport Default widths with -fdec-format-defaults patch (#2074614)


author: Marek Polacek <polacek@redhat.com> 8.5.0-17
changelog:
  - fix deserialization for std::normal_distribution (#2130392,
    PR libstdc++/105502)
  - initialize std::normal_distribution::_M_saved (PR libstdc++/99536)
  - reject std::make_shared<T[]> (PR libstdc++/99006)


author: Xue haolin <xuehaolin@openanolis.org> 8.5.0-18.0.1
changelog:
  - Rebrand for Anolis OS. (xuehaolin@openanolis.org)
  - Add loongarch support. (lixing@loongson.cn)
  - Fixup LoongArch configure file error. (lixing@loongson.cn)
  - rename mt file for LoongArch. (lixing@loongson.cn)
  - Fixup LoongArch atomic_exchange error. (lixing@loongson.cn)
  - Remove loongarch64 arch (wb-zh951434@alibaba-inc.com)


author: Jakub Jelinek <jakub@redhat.com> 10.1.1-2
changelog:
  - update from releases/gcc-10 branch
    - PRs c++/90212, c++/90479, c++/90915, c++/91529, c++/92103, c++/92633,
  	c++/92652, c++/92838, c++/93310, c++/93467, c++/93698, c++/93822,
  	c++/94128, c++/94817, c++/94829, c++/94885, c++/94937, c++/94955,
  	c++/95003, c++/95020, c++/95050, c++/95066, c++/95087, c++/95137,
  	c++/95158, c++/95181, c++/95197, c++/95222, c++/95241, c++/95319,
  	c++/95328, c++/95344, c++/95345, c++/95346, c++/95350, c++/95371,
  	c++/95386, c++/95440, c++/95508, c++/95560, c++/95562, c/95040,
  	c/95580, d/94970, d/95166, d/95167, d/95168, debug/95080,
  	fortran/39695, fortran/50392, fortran/59107, fortran/92993,
  	fortran/93366, fortran/93497, fortran/94109, fortran/94361,
  	fortran/94397, fortran/94672, fortran/95088, fortran/95090,
  	fortran/95091, fortran/95106, fortran/95373, fortran/95500,
  	fortran/95503, fortran/95530, fortran/95537, fortran/95544,
  	fortran/95611, gcov-profile/95332, ipa/94947, ipa/95113,
  	libfortran/95104, libfortran/95119, libfortran/95191,
  	libfortran/95390, libgomp/92854, libstdc++/77691, libstdc++/92894,
  	libstdc++/93983, libstdc++/94906, libstdc++/94933, libstdc++/95289,
  	libstdc++/95322, libstdc++/95578, lto/94848, lto/95190,
  	middle-end/94940, middle-end/95108, middle-end/95551,
  	middle-end/95622, sanitizer/94910, sanitizer/95634, target/91695,
  	target/94591, target/94735, target/94959, target/95169, target/95212,
  	target/95220, target/95255, target/95258, target/95355, target/95420,
  	target/95525, target/95528, testsuite/95361, testsuite/95575,
  	web/95380
  - correct instructions for creation of newlib tarball, filter out sun-rpc
    licensed code that is never used during the package build


author: Jakub Jelinek <jakub@redhat.com> 10.2.1-1
changelog:
  - update from releases/gcc-10 branch
    - GCC 10.2 release
    - PRs bootstrap/94998, c++/90916, c++/95477, c++/95505, c++/95518,
  	c++/95519, c++/95711, c++/95719, c++/95736, c++/95789, c++/95813,
  	c++/95976, c++/96052, c++/96063, c++/96077, c++/96104, c++/96105,
  	c++/96179, c/95141, d/95173, d/95250, debug/95343, fortran/71706,
  	fortran/88379, fortran/93337, fortran/95340, fortran/95366,
  	fortran/95587, fortran/95687, fortran/95688, fortran/95689,
  	fortran/95707, fortran/95708, fortran/95709, fortran/95743,
  	fortran/95812, fortran/95826, fortran/95827, fortran/95828,
  	fortran/95829, fortran/95880, fortran/95881, fortran/95978,
  	ipa/12345, ipa/93223, ipa/96040, ipa/96130, libstdc++/91153,
  	libstdc++/91807, libstdc++/94087, libstdc++/94627, libstdc++/94936,
  	libstdc++/95282, libstdc++/95851, libstdc++/95915, lto/91576,
  	lto/95604, middle-end/94600, middle-end/94964, middle-end/95114,
  	middle-end/95118, middle-end/95270, middle-end/95493,
  	middle-end/95690, middle-end/95810, middle-end/95903,
  	middle-end/96194, target/12345, target/93224, target/93492,
  	target/94791, target/94891, target/95018, target/95105, target/95347,
  	target/95581, target/95683, target/95713, target/95726, target/95874,
  	target/96001, target/96125, target/96174, testsuite/96180,
  	tree-optimization/90838, tree-optimization/94969,
  	tree-optimization/95049, tree-optimization/95110,
  	tree-optimization/95133, tree-optimization/95308,
  	tree-optimization/95487, tree-optimization/95638,
  	tree-optimization/95717, tree-optimization/95804,
  	tree-optimization/95857, tree-optimization/96075,
  	tree-optimization/96133, tree-optimization/96146
    - disable s390x multilibs also for ELN
    - disable -flto in %{optflags}, lto bootstrap will be enabled the GCC way
      later


author: Jakub Jelinek <jakub@redhat.com> 10.2.1-2
changelog:
  - update from releases/gcc-10 branch
    - PRs c++/95591, c++/95599, c++/95823, c++/95824, c++/95895, c/96377,
  	d/96140, fortran/89574, fortran/93567, fortran/93592, fortran/95585,
  	fortran/95612, fortran/95980, fortran/96018, fortran/96086,
  	fortran/96220, fortran/96319, lto/45375, middle-end/96335,
  	target/95435, target/96190, target/96236, target/96260, target/96402,
  	tree-optimization/96058
  - emit debug info for C/C++ external function declarations used in the TU
    (PR debug/96383)
  - discard SHN_UNDEF global symbols from LTO debuginfo (PR lto/96385)
  - strip also -flto=auto from optflags


author: Jakub Jelinek <jakub@redhat.com> 10.2.1-3
changelog:
  - update from releases/gcc-10 branch
    - PRs c++/95428, c++/96082, c++/96106, c++/96164, c++/96199, c++/96497,
  	c/96545, c/96549, c/96571, d/96250, d/96254, d/96301, debug/96354,
  	fortran/93553, fortran/96312, fortran/96486, ipa/95320, ipa/96291,
  	ipa/96482, libstdc++/89760, libstdc++/95749, libstdc++/96303,
  	libstdc++/96484, libstdc++/96718, lto/95362, lto/95548,
  	middle-end/96426, middle-end/96459, target/93897, target/95450,
  	target/96191, target/96243, target/96446, target/96493, target/96506,
  	target/96525, target/96530, target/96536, target/96562, target/96682,
  	tree-optimization/96483, tree-optimization/96535,
  	tree-optimization/96722, tree-optimization/96730,
  	tree-optimization/96758
  - mangle some further symbols needed for debug info during early dwarf
    (#1862029, PR debug/96690)
  - during %check perform tests whether annobin is usable with the newly built
    compiler or whether it might need to be rebuilt
  - disable graphite for ELN


author: Chunmei Xu <xuchunmei@linux.alibaba.com> 10.2.1-3.1
changelog:
  - Rebuild for Alibaba Cloud Linux
  - set gcc date to 20200828
  - append libc_version info to GCC version string
  - remove nvptx build
  - disable multilib
  - remove BuildRequires: libzstd-devel


author: Weitao Zhou <yunqi.zwt@alibaba-inc.com> 10.2.1-3.4
changelog:
  - Handle more SVE vector constants on aarch64
  - Append alicloud_base_release to gcc version
  - Add support for Neoverse N2 CPU aarch64


author: <fjanus@redhat.com> - 1.18-2
changelog:
  - Add backward compatibility patch
  - Resolves: #2097704
  - Backport from upstream commit: 00ba17479ff31c6825f0e6f28b965f11525e83f6


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 1:1.18-2.0.1
changelog:
  - remove char *parseopt_program_doc and *parseopt_program_args in parseopt.c for compatible gcc10 build


author: Tomas Popela <tpopela@redhat.com> - 2.42.6-3
changelog:
  - Backport fixes for CVE-2021-46829 and CVE-2021-44648
  - Resolves: rhbz#2115213
  - Resolves: rhbz#2044346


author: Andrew Price <anprice@redhat.com> - 3.2.0-9
changelog:
  - gfs2_jadd: Handle out-of-space issues
  - gfs2_jadd: error handling overhaul
    Resolves: rhbz#1833141
  - gfs2.5: Update some mentions of gfs2_tool
    Resolves: rhbz#1818983


author: Andrew Price <anprice@redhat.com> - 3.2.0-11
changelog:
  - gfs2_jadd: Use fallocate to preallocate journals
  - gfs2_jadd: Don't fsync after each block written
    Resolves: rhbz#1942434


author: Rongwei Wang <rongwei.wang@linux.alibaba.com> - 2.28-225.0.4.6
changelog:
  - elf: Properly align PT_LOAD segments
  - Sync loongarch64 code to lnd.35. (lixing@loongson.cn)
  - Add patch for gb18030-2022 from upstream bug#30243 (fundawang@yeah.net)


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-57
changelog:
  - fixes bugs bz#1600379 bz#1689375 bz#1782428 bz#1798897 bz#1815462 
    bz#1889966 bz#1891403 bz#1901468 bz#1903911 bz#1908635 bz#1917488 bz#1918018 
    bz#1919132 bz#1925425 bz#1927411 bz#1927640 bz#1928676 bz#1942816 bz#1943467 
    bz#1945143 bz#1946171 bz#1957191 bz#1957641


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-60
changelog:
  - fixes bugs bz#1668303 bz#1853631 bz#1901468 bz#1904137 bz#1911665 
    bz#1962972 bz#1973566 bz#1994593 bz#1995029 bz#1997447 bz#2006205


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-9
changelog:
  - Move the .hmac files to the fipscheck subfolder
  - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location
  Resolves: rhbz#1980758


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-13
changelog:
  - Fix: previous commit removed one function from the library and thus broke the ABI
  - function gmpn_preinv_divrem_1 should now not be removed
  Related: rhbz#2044216


author: Daiki Ueno <dueno@redhat.com> - 3.6.16-1
changelog:
  - Update to upstream 3.6.16 release (#1956783)
  - Fix potential use-after-free in key_share handling (#1927597)
  - Fix potential use-after-free in pre_shared_key handling (#1927593)
  - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
  - Fix cert expiration issue in tests (#1908110)


author: Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
changelog:
  - Fix x86_64 CPU feature detection when AVX is not available (#2131152)
  - Fix timing side-channel in TLS RSA key exchange (#2162598)


author: David King <amigadave@amigadave.com> - 1.68.0-6
changelog:
  - Add Requires on python-markdown for g-ir-doc-tool (#1979144)
  - Add license texts and documentation files (#1979144)


author: Robbie Harwood <rharwood@redhat.com> - 2.02-143
changelog:
  - x86-efi: Fix an incorrect array size in kernel allocation
  - Also merge with 8.7
  - Resolves: #2031288


author: Bo Ren <rb01097748@alibaba-inc.com> - 2.02-148.0.1.1
changelog:
  - Build pc-modules package on x86_64 (geliwei@openanolis.org)
  - Add loongarch64 base support (zhangwenlong@loongson.cn)(chenguoqi@loongson.cn)
  - Fix a bug in bls_make_list, blscfg. (zhonglingh@linux.alibaba.com)
  - Delete LoongArch64 support old version due to compile error(yangqiming@loongson.cn)
  - Add LoongArch64 support(yangqiming@loongson.cn)
  - LoongArch64 support fdt and phy-addr BIOS(yangqiming@loongson.cn)
  - Remove dtb dir with correct argument (Liwei Ge)


author: Tomas Popela <tpopela@redhat.com> - 40.0-6
changelog:
  - Require the Source Code Pro font instead of only recommending it to not break
    systems updated from 9.0.0.
    Resolves: rhbz#2093975


author: Jakub Martisko <jamartis@redhat.com> - 1.9-5
changelog:
  - Fix wrong skip size in gzexe
  - Add new test dealing with the ^^ (needs autoreconf)
  - Enable make check (needs less)
    Resolves: 1705413

   * Tue Aug 07 2018 Jakub Martisko <jamartis@redhat.com> - 1.9-4
   - Fix FTBFS bug (gnulib problems)
   - more details: https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
     Resolves 1611722


author: Francisco Javier Tsao Santín <tsao@gpul.org> - 1:1.3-1
changelog:
  - Patch by Todd Lewis that adds option -x to exclude files with pcre lib 
  - This patch solves RH Bugzilla ID's 955246 1322198


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1:1.3-4
changelog:
  - remove manually added pcre2 requires (this is autogenerated)
  - removed BuildRoot, %defattr() and Group (new Fedora Packaging Guildline)
  - do not use straight gcc and add use %{__global_ldflags}
  - use %_licensedir is no longer needed
  - minor cleanups:
  -- reformat %description to 80 col
  -- added full URLs in Source fields
  -- more macros
  -- a bit simpler %prep


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Michal Grzedzicki <mge@fb.com> - 9.54-4
changelog:
  - backport fix for --dco-identify real max sectors calculation from upstream version 9.62 (#1959918)


author: Mike FABIAN <mfabian@redhat.com> - 60.2-4
changelog:
  - Add negative-daylight-savings.patch from upstream.
    (see http://bugs.icu-project.org/trac/ticket/13566 and
    http://bugs.icu-project.org/trac/changeset/40954)


author: Parag Nemade <pnemade AT redhat DOT com> - 60.2-7
changelog:
  - Resolves:rh#1602551 - Fix specfile by adding compile options
  - also add BuildRequires for gcc and gcc-c++
  - Correct the upstream URL


author: Mike FABIAN <mfabian@redhat.com> - 60.3-1
changelog:
  - Update to 60.3 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677093


author: Mike FABIAN <mfabian@redhat.com> - 60.3-2
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808238


author: Jan Macku <jamacku@redhat.com> - 10.00.10-1
changelog:
  - Allow updating rfkill switch status while in readonly root mode
  - service: Prevent variables from globbing
  - Allow updating mlocate.db while in readonly root mode


author: Jan Macku <jamacku@redhat.com> - 10.00.16-1
changelog:
  - rename_device: also support dracut-style kernel cmdline configuration
  - ifup-routes: Log when using `ip $type replace`
  - ifup-routes: Use `ip route repace` to avoid race


author: Jan Macku <jamacku@redhat.com> - 10.00.17-1
changelog:
  - ifup-routes: Revert quotes
  - ifup-routes: Use `ip replace` only on type `route`
  - ci: introduce GA ci from master to rhel8-branch
  - ci: Setup packit for RHEL8 branch
  - ci: Get rid of old ci files (travis and zanata)


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6-10
changelog:
  - SPEC file cleanup
  - Added licence tag
  - Removal of old and unneeded macros
  - Use of newest python macros
  - Removed Python 2 dependency
  - Added patch for Python 3 build


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-2.el8
changelog:
  - vdpa: Enable user to set mtu of the vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to set mac address of vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to query vdpa device config layout (Andrea Claudi) [2036880]
  - vdpa: align uapi headers (Andrea Claudi) [2036880]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-3.el8
changelog:
  - tc: u32: add json support in `print_raw`, `print_ipv4`, `print_ipv6` (Andrea Claudi) [1989591]
  - tc: u32: add support for json output (Andrea Claudi) [1989591]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-4.el8
changelog:
  - vdpa: Update man page with added support to configure max vq pair (Andrea Claudi) [2056827]
  - vdpa: Support reading device features (Andrea Claudi) [2056827]
  - vdpa: Support for configuring max VQ pairs for a device (Andrea Claudi) [2056827]
  - vdpa: Allow for printing negotiated features of a device (Andrea Claudi) [2056827]
  - vdpa: Remove unsupported command line option (Andrea Claudi) [2056827]
  - uapi: update vdpa.h (Andrea Claudi) [2056827]
  - Update kernel headers and import virtio_net (Andrea Claudi) [2056827]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-2.el8
changelog:
  - macvlan: Add bclim parameter (Andrea Claudi) [2188134]
  - Update kernel headers (Andrea Claudi) [2188134]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-4.el8
changelog:
  - ip vrf: make ipvrf_exec SELinux-aware (Andrea Claudi) [1780023]
  - lib: add SELinux include and stub functions (Andrea Claudi) [1780023]
  - ss: make SELinux stub functions conformant to API definitions (Andrea Claudi) [1780023]
  - ss: make is_selinux_enabled stub work like in SELinux (Andrea Claudi) [1780023]


author: Liwei Ge <geliwei@openanolis.org> - 6.2.0-5.0.1
changelog:
  - delete the rt_dsfield file due to three Aones (hengqi@linux.alibaba.com)
  - [kernelself-tests]net.fib_rule_tests.sh: TEST rule4 del by pref, rule6 del by pref FAIL


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-3
changelog:
  - Fix loading of sets with dependencies on other sets (RHBZ#1647096), and
    hardcode 6.38-1.el7 for ipset-service upgrade and downgrade triggers, so that
    we don't run into issues with z-stream updates


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649090):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649085)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649085)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649085)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649085)
    - Make error reporting consistent, introduce different severities (RHBZ#1683711)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1683713)
    - Fix covscan SC2166 warning in init script (RHBZ#1649085)


author: Phil Sutter <psutter@redhat.com> - 1.8.4-16
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection
  - nft: cache: Make nft_rebuild_cache() respect fake cache
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-17
changelog:
  - extensions: dccp: Fix for DCCP type 'INVALID'
  - tests: shell: Merge and extend return codes test
  - nft: Fix command name in ip6tables error message
  - extensions: libxt_CT: add translation for NOTRACK
  - extensions: libipt_icmp: Fix translation of type 'any'
  - tests/shell: Test for fixed extension registration
  - libxtables: Register multiple extensions in ascending order
  - libxtables: Simplify pending extension registration
  - libxtables: Make sure extensions register in revision order


author: Phil Sutter <psutter@redhat.com> - 1.8.4-18
changelog:
  - xtables-translate: Fix translation of odd netmasks
  - nft: Fix bitwise expression avoidance detection
  - xtables-monitor: 'LL=0x304' is not very convenient, print LOOPBACK instead.
  - xtables-monitor: print packet first
  - xtables-monitor: fix packet family protocol
  - xtables-monitor: fix rule printing
  - xtables-monitor: Fix ip6tables rule printing


author: Phil Sutter <psutter@redhat.com> - 1.8.4-20
changelog:
  - extensions: SECMARK: Use a better context in test case
  - extensions: sctp: Translate --chunk-types option
  - extensions: sctp: Fix nftables translation
  - extensions: SECMARK: Implement revision 1
  - nft: cache: Retry if kernel returns EINTR


author: Phil Sutter <psutter@redhat.com> - 1.8.4-21
changelog:
  - extensions: hashlimit: Fix tests with HZ=100
  - ebtables: Dump atomic waste
  - doc: ebtables-nft.8: Adjust for missing atomic-options


author: Phil Sutter <psutter@redhat.com> - 1.8.4-23
changelog:
  - libxtables: Fix unsupported extension warning corner case
  - tests: shell: Check overhead in iptables-save and -restore
  - nft: Fix EPERM handling for extensions without rev 0
  - Improve error messages for unsupported extensions
  - xshared: Fix response to unprivileged users
  - libxtables: Register only the highest revision extension
  - Use proto_to_name() from xshared in more places
  - libxtables: Boost rule target checks by announcing chain names
  - libxtables: Implement notargets hash table
  - nft: Reject standard targets as chain names when restoring
  - xshared: Merge and share parse_chain()
  - xshared: Prefer xtables_chain_protos lookup over getprotoent
  - nft: Speed up immediate parsing
  - nft: Simplify immediate parsing


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-16
changelog:
  - Moved upstream from https://fedorahosted.org/iptraf-ng/ to 
    https://github.com/iptraf-ng/iptraf-ng/ with release v1.1.4
    Fixes error in patch Patch03 - this fixes 1283773


author: Thomas Woerner <twoerner@redhat.com> 2.2.6-1
changelog:
  - New upstream version 2.2.6
    - Located at github
    - Fixes (RHBZ#1294913 and RHBZ#1375395)
  - Additional upstream patch (no_debug) to drop some debugging remains
  - Additional proposed patch to fix segmentation fault with -1 -C (RHBZ#599181)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 20180629-11.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Fix ping: process interrupts in ping*_receive_error_msg (forrest_ly)


author: Kairui Song <kasong@redhat.com> 2:1.4.0-3
changelog:
  - Update document and remove dead options to fix manpage scan warning (bz1612706)
  - Fix gating test error (bz1680619)


author: Chris Leech - 6.2.0.878-5.gitd791ce0
changelog:
  - 1849931, 1869438 go back to MD5 CHAP only by default
    new CHAP modes can cause issue with some targets,
    so SHA1/SHA256/SHA3-256 modes must be configured to enable now


author: Chris Leech <cleech@redhat.com> - 0.94-1
changelog:
  - new upstream location, update to 0.94
  - new devel package, upstream open-iscsi is dropping it's internal copy


author: Xin Long <lxin@redhat.com> - 2.11-3
changelog:
  - Deal with warnings under gcc 8
  - Call va_end after va_copy in json_vsprintf
  - Fix bogus date in jansson.spec


author: Anna Khaitovich <akhaitov@redhat.com> - 0.13.1-0.3
changelog:
  - Don't package empty /usr/share/doc/json-c
  - Resolves: rhbz#1741076
  - Do not use --enable-rdrand
  - Resolves: rhbz#1806532


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.19.1.el8_8]
changelog:
  - crypto: jitter - correct health test during initialization (Vladis Dronov) [2215079 2214270]
  - rbd: get snapshot context after exclusive lock is ensured to be held (Ilya Dryomov) [2216769 2214973]
  - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting (Ilya Dryomov) [2216769 2214973]
  - PCI: hv: Add a per-bus mutex state_lock (Vitaly Kuznetsov) [2216543 2184863]
  - Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Fix a race condition bug in hv_pci_query_relations() (Vitaly Kuznetsov) [2216543 2184863]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.20.1.el8_8]
changelog:
  - block: make sure local irq is disabled when calling __blkcg_rstat_flush (Ming Lei) [2220810 2208904]
  - blk-cgroup: Flush stats before releasing blkcg_gq (Ming Lei) [2220810 2208904]
  - PCI: vmd: Add quirk to configure PCIe ASPM and LTR (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Create feature grouping for client products (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Use PCI_VDEVICE in device list (Myron Stowe) [2211198 2136922]
  - PCI/ASPM: Add pci_enable_link_state() (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Fix secondary bus reset for Intel bridges (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Disable MSI remapping after suspend (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Add DID 8086:7D0B and 8086:AD0B for Intel MTL SKUs (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Use devm_kasprintf() instead of simple kasprintf() (Myron Stowe) [2211198 2136922]
  - powerpc/pseries: unregister VPA when hot unplugging a CPU (Mamatha Inamdar) [2193375 2143007]
  - net/sched: cls_tcindex: downgrade to imperfect hash (Davide Caratti) [2192307 2192308] {CVE-2023-1829}
  - powerpc/papr_scm: Update the NUMA distance table for the target node (Mamatha Inamdar) [2212451 2183474]
  - hvcs: Synchronize hotplug remove with port free (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use vhangup in hotplug remove (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Get reference to tty in remove (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use driver groups to manage driver attributes (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use dev_groups to manage hvcs device attributes (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Fix hvcs port reference counting (Mamatha Inamdar) [2212373 2167962]
  - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() (Mamatha Inamdar) [2212373 2167962]
  - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity (Tomas Henzl) [2216498 2160149]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.21.1.el8_8]
changelog:
  - ipmi: msghandler: kABI implementation was wrong (Tony Camuso) [2213189 2182345]
  - ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Add a timer between request retries (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Remove rtc_us_timer (Tony Camuso) [2211667 2174220]
  - ipmi_ssif: Rename idle state and check (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: resend_msg() cannot fail (Tony Camuso) [2211667 2174220]
  - ipmi/watchdog: use strscpy() to instead of strncpy() (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Convert to i2c's .probe_new() (Tony Camuso) [2211667 2174220]
  - ipmi: fix use after free in _ipmi_destroy_user() (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Increase the message retry time (Tony Camuso) [2211667 2174220]
  - ipmi: Fix some kernel-doc warnings (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Use EPOLLIN instead of POLLIN (Tony Camuso) [2211667 2174220]
  - ipmi: fix msg stack when IPMI is disconnected (Tony Camuso) [2211667 2174220]
  - ipmi: fix memleak when unload ipmi driver (Tony Camuso) [2211667 2174220]
  - ipmi: fix long wait in unload when IPMI disconnect (Tony Camuso) [2211667 2174220]
  - ipmi: kcs: Poll OBF briefly to reduce OBE latency (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Add SSIF BMC driver (Tony Camuso) [2211667 2174220]
  - ipmi: Remove unused struct watcher_entry (Tony Camuso) [2211667 2174220]
  - ipmi: kcs: aspeed: Update port address comments (Tony Camuso) [2211667 2174220]
  - ipmi: Add __init/__exit annotations to module init/exit funcs (Tony Camuso) [2211667 2174220]
  - ipmi:ipmb: Don't call ipmi_unregister_smi() on a register failure (Tony Camuso) [2211667 2174220]
  - ipmi:ipmb: Fix a vague comment and a typo (Tony Camuso) [2211667 2174220]
  - ipmi: Fix comment typo (Tony Camuso) [2211667 2174220]
  - char: ipmi: modify NPCM KCS configuration (Tony Camuso) [2211667 2174220]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.22.1.el8_8]
changelog:
  - mm: avoid unnecessary page fault retires on shared memory types (Nico Pache) [2221100 2213877]
  - mm: remove redundant check about FAULT_FLAG_ALLOW_RETRY bit (Nico Pache) [2221100 2213877]
  - mm: Allow the [page|pfn]_mkwrite callbacks to drop the mmap_sem (Nico Pache) [2221100 2213877]
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ricardo Robaina) [2196352 2196353] {CVE-2023-2002}
  - mm/memcg: Fix mem_cgroup_id_get_online() underflow problem (Waiman Long) [2221010]
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216989 2214027] {CVE-2023-35788}
  - netfilter: conntrack: gre: don't set assured flag for clash entries (Florian Westphal) [2223542]
  - netfilter: conntrack: allow insertion clash of gre protocol (Florian Westphal) [2223542]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.23.1.el8_8]
changelog:
  - ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (Petr Oros) [2224515 2153356]
  - ceph: fix use-after-free bug for inodes when flushing capsnaps (Xiubo Li) [2218271 2209299]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.24.1.el8_8]
changelog:
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/amd: Cache debug register values in percpu variables (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/microcode/AMD: Track patch allocation size explicitly (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/microcode: Print previous version of microcode after reload (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Load microcode during restore_processor_state() (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/speculation: Restore speculation related MSRs during S3 resume (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: remove leftover comment for filechk utility (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/rdrand: Sanity-check RDRAND output (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - firmware: refactor firmware/Makefile (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: remove redundant 'set -e' from filechk_offsets (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: do not redirect the first prerequisite for filechk (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: move bin2c back to scripts/ from scripts/basic/ (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - libceph: harden msgr2.1 frame segment length checks (Ilya Dryomov) [2227073 2222256]
  - iavf: fix reset task race with iavf_remove() (Petr Oros) [2228161 2223604]
  - iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies (Petr Oros) [2228161 2223604]
  - Revert "iavf: Do not restart Tx queues after reset task failure" (Petr Oros) [2228161 2223604]
  - Revert "iavf: Detach device during reset task" (Petr Oros) [2228161 2223604]
  - iavf: Wait for reset in callbacks which trigger it (Petr Oros) [2228161 2223604]
  - iavf: use internal state to free traffic IRQs (Petr Oros) [2228161 2223604]
  - iavf: Fix out-of-bounds when setting channels on remove (Petr Oros) [2228161 2223604]
  - iavf: Fix use-after-free in free_netdev (Petr Oros) [2228161 2223604]
  - iavf: make functions static where possible (Petr Oros) [2228161 2223604]
  - iavf: fix err handling for MAC replace (Petr Oros) [2228161 2223604]
  - iavf: remove some unused functions and pointless wrappers (Petr Oros) [2228161 2223604]
  - iavf: remove mask from iavf_irq_enable_queues() (Petr Oros) [2228161 2223604]
  - iavf: send VLAN offloading caps once after VFR (Petr Oros) [2228161 2223604]
  - i40e: Wait for pending VF reset in VF set callbacks (Ivan Vecera) [2228163 2203921]
  - i40e: Add helper for VF inited state check with timeout (Ivan Vecera) [2228163 2203921]
  - ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() (Mark Langsdorf) [2218025 2215625]
  - locking/semaphore: Add might_sleep() to down_*() family (Mark Langsdorf) [2218025 2215625]
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (Davide Caratti) [2219660 2218676] {CVE-2023-3090}
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Phil Sutter) [2216165 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Phil Sutter) [2216165 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Phil Sutter) [2216165 2214963] {CVE-2023-3390}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.25.1.el8_8]
changelog:
  - netfilter: nft_set_pipapo: fix improper element removal (Phil Sutter) [2227508 2225276] {CVE-2023-4004}
  - perf/x86/rapl: Add support for Intel Emerald Rapids (Michael Petlan) [2230162 2165766]
  - perf/x86/intel/cstate: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/intel: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/intel/uncore: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/msr: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/msr: Add Sapphire Rapids CPU support (Michael Petlan) [2230152 2156802]
  - netfilter: xt_owner: Add supplementary groups option (Phil Sutter) [2229715 2136194]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.26.1.el8_8]
changelog:
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Cathy Avery) [2230743 1986067]
  - kernfs: Improve kernfs_notify() poll notification latency (Ian Kent) [2208540]
  - crypto: rng - Fix lock imbalance in crypto_del_rng (Herbert Xu) [2232215]
  - net: stmmac: propagate feature flags to vlan (Corinna Vinschen) [2219907 2174701]
  - scsi: storvsc: Handle SRB status value 0x30 (Cathy Avery) [2231988 2218133]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.27.1.el8_8]
changelog:
  - gfs2: Fix freeze consistency check in gfs2_trans_add_meta (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: gfs2_freeze_lock_shared cleanup (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Replace sd_freeze_state with SDF_FROZEN flag (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rework freeze / thaw logic (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Reconfiguring frozen filesystem already rejected (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename gfs2_freeze_lock{ => _shared } (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename the {freeze,thaw}_super callbacks (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename remaining "transaction" glock references (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: init system threads before freeze lock (Bob Peterson) [2231825 2095340]
  - cifs: fix bogus cifs_mount error handling in RHEL8 (Jeffrey Layton) [2229128 2215018]
  - cifs: missing null pointer check in cifs_mount (Jay Shin) [2229128 2215018]
  - x86/cpu: Add CPU model numbers for Meteor Lake (Prarit Bhargava) [2230158 2156826]
  - redhat/configs: enable CONFIG_INTEL_UNCORE_FREQ_CONTROL for x86_64 (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Return error on write frequency (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Add client processors (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: add Emerald Rapids support (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Use sysfs_emit() to instead of scnprintf() (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Prevent driver loading in guests (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: fix uncore_freq_common_init() error codes (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Split common and enumeration part (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Display uncore current frequency (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Use sysfs API to create attributes (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Move to uncore-frequency folder (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-frequency: use default_groups in kobj_type (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-frequency: Move to intel sub-directory (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Add Sapphire Rapids server support (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: make uncore_root_kobj static (David Arcari) [2230158 2156826]
  - platform/x86: Convert to new CPU match macros (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Add release callback (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Fix static checker issue and potential race condition (David Arcari) [2230158 2156826]
  - MAINTAINERS: Update for the intel uncore frequency control (David Arcari) [2230158 2156826]
  - platform/x86: Add support for Uncore frequency control (David Arcari) [2230158 2156826]
  - scsi: storvsc: Remove errant duplicate code (Cathy Avery) [2233227 2211725]
  - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices (Cathy Avery) [2233227 2211725]
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225647 2225103] {CVE-2023-3776}
  - iavf: remove active_cvlans and active_svlans bitmaps (Stefan Assmann) [2232399 2153349]
  - iavf: refactor VLAN filter states (Stefan Assmann) [2232399 2153349]
  - iavf: do not track VLAN 0 filters (Stefan Assmann) [2232399 2153349]
  - iavf: fix non-tunneled IPv6 UDP packet type and hashing (Stefan Assmann) [2232399 2153349]
  - iavf: fix inverted Rx hash condition leading to disabled hash (Stefan Assmann) [2232399 2153349]
  - net/sched: move struct tc_mqprio_qopt_offload from pkt_cls.h to pkt_sched.h (Stefan Assmann) [2232399 2153349]
  - iavf/iavf_main: actually log ->src mask when talking about it (Stefan Assmann) [2232399 2153349]
  - iavf: Fix VF driver counting VLAN 0 filters (Stefan Assmann) [2232399 2153349]
  - iavf: Change information about device removal in dmesg (Stefan Assmann) [2232399 2153349]
  - iavf: Replace __FUNCTION__ with __func__ (Stefan Assmann) [2232399 2153349]
  - net: Remove the obsolte u64_stats_fetch_*_irq() users (drivers). (Stefan Assmann) [2232399 2153349]
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221725 2221046] {CVE-2023-35001}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc2.an8]
changelog:
  - anolis: kbuild: fix error remind bug for libelf check (Yuanhe Shu)
  - anolis: configs: enable RCU_TORTURE_TEST for arm64 (Erwei Deng)
  - erofs: use kill_anon_super() to kill super in fscache mode (Jia Zhu)
  - hardirq/nmi: Allow nested nmi_enter() (Peter Zijlstra)
  - cachefiles: make on-demand request distribution fairer (Xin Yin)
  - anolis: cachefiles: refactor cachefiles_ondemand_daemon_read() (Jingbo Xu)
  - cachefiles: fix error return code in cachefiles_ondemand_copen() (Sun Ke)
  - anolis: erofs: update page for .readpages() in fscache mode (Jingbo Xu)
  - anolis: cachefiles: fix volume key setup for cachefiles_open (Jingbo Xu)
  - anolis: cachefiles: replace BUG_ON() with WARN_ON() (Jingbo Xu)
  - xfs: Sanity check flags of Q_XQUOTARM call (Jan Kara)
  - anolis: configs: enable CONFIG_LOCK_TORTURE_TEST for arm64 (Erwei Deng)
  - vfio/pci: Handle concurrent vma faults (liuxinwei)
  - anolis: revert: pci: shorten waiting time in pci_reset_secondary_bus (Yang Su)
  - io_uring: don't convert to jiffies for waiting on timeouts (Jens Axboe)
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) {CVE-2022-0001,CVE-2022-0002}
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) {CVE-2022-0001,CVE-2022-0002}
  - xen/blkfront: fix leaking data in shared pages (Ziyang Zhang) {CVE-2022-26365}
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie) {CVE-2022-3542}
  - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() (Gu Mi)
  - scsi: qla2xxx: Set the qpair in SRB to NULL when SRB is released (Gu Mi)
  - scsi: qla2xxx: Move ABTS code behind qpair (Gu Mi)
  - scsi: qla2xxx: Fix out of order Termination and ABTS response (Gu Mi)
  - scsi: qla2xxx: Add logic to detect ABTS hang and response completion (Gu Mi)
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti) {CVE-2022-2503}
  - bitops: protect variables in set_mask_bits() macro (Miklos Szeredi)
  - anolis: mm: kidled: improve efficiency of scanning valid PFNs (Rongwei Wang)
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Pawan Gupta)
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Pawan Gupta)
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Pawan Gupta)
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Pawan Gupta)
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Pawan Gupta)
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra) {CVE-2022-1729}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc3.an8]
changelog:
  - anolis: sched/fair: fix sched_group_identity_enabled read error (Cruz Zhao)
  - mm: fix a race on nr_swap_pages (Zhaoyang Huang)
  - anolis: sched/fair: fix group identity fast path omits select_idle_core() (Cruz Zhao)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.an8]
changelog:
  - xfs: fix an ABBA deadlock in xfs_rename (Darrick J. Wong)
  - xfs: Fix deadlock between AGI and AGF when target_ip exists in xfs_rename() (kaixuxia)
  - iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate (Ritesh Harjani)
  - ext4: prevent partial update of the extent blocks (Zhang Yi)
  - ext4: check for inconsistent extents between index and leaf block (Zhang Yi)
  - ext4: check for out-of-order index extents in ext4_valid_extent_entries() (Zhang Yi)
  - ext4: add check to prevent attempting to resize an fs with sparse_super2 (Josh Triplett)
  - ext4: add reserved GDT blocks check (Zhang Yi)
  - anolis: mm: avoid shmem_getpage_gfp sleep in atomic (Rongwei Wang)
  - anolis: mm: gup:remove FOLL_GET_PGSTABLE flag checking (Simon Guo)
  - anolis: psi: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: io_uring: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: erofs: make fscache and RAFS mode mutually exclusive (Jingbo Xu)
  - anolis: erofs: force bootstrap_path to be regular file (Jingbo Xu)
  - anolis: erofs: make bootstrap_path mandatory in RAFS mode (Jingbo Xu)
  - anolis: erofs: fix erofs_is_fscache_mode() (Jingbo Xu)
  - net: Fix gro aggregation for udp encaps with zero csum (Daniel Borkmann)
  - anolis: rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs (leoliu)
  - USB: HCD: Fix URB giveback issue in tasklet function (leoliu-oc)
  - anolis: iommu: SMMU will be passthrough on PHYTIUM FT2000 & FT2500 Socs due to hardware limitation (Gu Mi)
  - printk: Drop console_sem during panic (Stephen Brennan)
  - printk: Avoid livelock with heavy printk during panic (Stephen Brennan)
  - printk: disable optimistic spin during panic (Stephen Brennan)
  - printk: Add panic_in_progress helper (Stephen Brennan)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.1.an8]
changelog:
  - anolis: bpf: add reserve fields for bpf structures (Tianchen Ding)
  - xprtrdma: fix incorrect header size calculations (Colin Ian King) {CVE-2022-0812}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds) {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds) {CVE-2022-4378}
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries (Paolo Bonzini) {CVE-2022-39189}
  - nvme: ensure subsystem reset is single threaded (Keith Busch) {CVE-2022-3169}
  - nvme: Wait for reset state when required (Keith Busch) {CVE-2022-3169}
  - nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled (Rafael J. Wysocki) {CVE-2022-3169}
  - PCI/ASPM: Add pcie_aspm_enabled() (Rafael J. Wysocki) {CVE-2022-3169}
  - nvme-pci: use host managed power state for suspend (Keith Busch) {CVE-2022-3169}
  - nvme: introduce nvme_sync_io_queues (Chao Leng) {CVE-2022-3169}
  - nvme: include admin_q sync with nvme_sync_queues (Edmund Nadolski) {CVE-2022-3169}
  - nvme-pci: Sync queues on reset (Keith Busch) {CVE-2022-3169}
  - nvme: export get and set features (Keith Busch) {CVE-2022-3169}
  - nvme: Prevent resets during paused controller state (Keith Busch) {CVE-2022-3169}
  - nvme: restrict management ioctls to admin (Keith Busch) {CVE-2022-3169}
  - sch_sfb: Don't assume the skb is still around after enqueueing to child (Toke Høiland-Jørgensen) {CVE-2022-3586}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL (James Morse)
  - arm64: Use the clearbhb instruction in mitigations (James Morse)
  - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)
  - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)
  - arm64: Mitigate spectre style branch history side channels (James Morse)
  - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)
  - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)
  - arm64: Add percpu vectors for EL1 (James Morse)
  - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)
  - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)
  - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)
  - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)
  - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)
  - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)
  - arm64: entry: Move the trampoline data page before the text page (James Morse)
  - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)
  - arm64: entry: Make the trampoline cleanup optional (James Morse)
  - arm64: entry.S: Add ventry overflow sanity checks (James Morse)
  - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)
  - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)
  - arm64: Add part number for Arm Cortex-A77 (Rob Herring)
  - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (Ard Biesheuvel)
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)
  - ARM: fix Thumb2 regression with Spectre BHB (Russell King (Oracle))
  - ARM: Spectre-BHB: provide empty stub for non-config (Randy Dunlap)
  - ARM: fix build warning in proc-v7-bugs.c (Russell King (Oracle))
  - ARM: Do not use NOCROSSREFS directive with ld.lld (Nathan Chancellor)
  - ARM: fix co-processor register typo (Russell King (Oracle))
  - kbuild: add CONFIG_LD_IS_LLD (Sami Tolvanen)
  - ARM: fix build error when BPF_SYSCALL is disabled (Emmanuel Gil Peyrot)
  - ARM: include unprivileged BPF status in Spectre V2 reporting (Russell King (Oracle))
  - ARM: Spectre-BHB workaround (Russell King (Oracle))
  - ARM: use LOADADDR() to get load address of sections (Russell King (Oracle))
  - ARM: early traps initialisation (Russell King (Oracle))
  - ARM: report Spectre v2 status through sysfs (Russell King (Oracle))
  - arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit() (Mark Rutland)
  - arm/arm64: Provide a wrapper for SMCCC 1.1 calls (Steven Price)
  - xen/netfront: fix leaking data in shared pages (Roger Pau Monne) {CVE-2022-33740}
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman) {CVE-2022-32981}
  - floppy: disable FDRAWCMD by default (Willy Tarreau) {CVE-2022-33981,CVE-2022-1836}
  - x86/speculation: Add LFENCE to RSB fill sequence (Pawan Gupta) {CVE-2022-26373}
  - x86/speculation: Add RSB VM Exit protections (Daniel Sneddon) {CVE-2022-26373}
  - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf) {CVE-2022-26373}
  - x86/entry: Add kernel IBRS implementation (Peter Zijlstra) {CVE-2022-26373}
  - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra) {CVE-2022-26373}
  - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra) {CVE-2022-26373}
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko) {CVE-2022-33744}
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau) {CVE-2022-32296}
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau) {CVE-2022-32296}
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau) {CVE-2022-32296}
  - tcp: add small random increments to the source port (Kangjie Xu) {CVE-2022-32296}
  - tcp: resalt the secret every 10 seconds (Eric Dumazet) {CVE-2022-32296}
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau) {CVE-2022-32296}
  - tcp: change source port randomizarion at connect() time (Willy Tarreau) {CVE-2022-32296}
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet) {CVE-2022-3521}
  - af_key: Do not call xfrm_probe_algs in parallel (Herbert Xu) {CVE-2022-3028}
  - mISDN: fix use-after-free bugs in l1oip timer handlers (Duoming Zhou) {CVE-2022-3565}
  - vsock: Fix memory leak in vsock_connect() (Peilin Ye) {CVE-2022-3629}
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
  - netfilter: nf_conntrack_irc: Fix forged IP logic (David Leadbeater) {CVE-2022-2663}
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz) {CVE-2022-42895}
  - igmp: Add ip_mc_list lock in ip_check_mc_rcu (Liu Jian) {CVE-2022-20141}
  - net/x25: Fix null-ptr-deref caused by x25_disconnect (Duoming Zhou) {CVE-2022-1516}
  - arm64: fix oops in concurrently setting insn_emulation sysctls (haibinzhang (张海斌))
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write (Hyunwoo Kim) {CVE-2022-40307}
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song) {CVE-2022-3628}
  - usb: mon: make mmapped memory read only (Tadeusz Struk) {CVE-2022-43750}
  - r8152: Rate limit overflow messages (Andrew Gaul) {CVE-2022-3594}
  - atm: idt77252: fix use-after-free bugs caused by tst_timer (Duoming Zhou) {CVE-2022-3635}
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (Hyunwoo Kim) {CVE-2022-39842}
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (Chen-Yu Tsai) {CVE-2022-20369}
  - sr9700: sanity check for packet length (Oliver Neukum) {CVE-2022-26966}
  - parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled (Helge Deller)
  - pci_iounmap'2: Electric Boogaloo: try to make sense of it all (Linus Torvalds)
  - asm-generic/io.h: Fix !CONFIG_GENERIC_IOMAP pci_iounmap() implementation (Lorenzo Pieralisi)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.2.an8]
changelog:
  - anolis: nfsd: remove nfsd_reply_cache_shutdown() in nfsd_exit_net (Yuanhe Shu)
  - RDMA/core: Don't infoleak GRH fields (Leon Romanovsky) {CVE-2021-3923}
  - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang) {CVE-2020-14331}
  - btrfs: fix race between quota disable and quota assign ioctls (Filipe Manana) {CVE-2023-1611}
  - Fix double fget() in vhost_net_set_backend() (Al Viro)
  - seq_buf: Fix overflow in seq_buf_putmem_hex() (Yun Zhou) {CVE-2023-28772}
  - drm/nouveau/mmu: add more general vmm free/node handling functions (Ben Skeggs) {CVE-2023-0030}
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (ly929421) {CVE-2023-1118}
  - USB: core: Prevent nested device-reset calls (Alan Stern) {CVE-2022-4662}
  - Bluetooth: L2CAP: Fix u8 overflow (zzzzzzzzzy9) {CVE-2022-45934}
  - drm/amdkfd: Check for null pointer after calling kmemdup (Jiasheng Jiang) {CVE-2022-3108}
  - l2tp: Serialize access to sk_user_data with sk_callback_lock (Jakub Sitnicki) {CVE-2022-4129}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy) {CVE-2022-3564}
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima) {CVE-2022-3524}
  - nfc: fix refcount leak in llcp_sock_connect() (Xiaoming Ni)
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Luiz Augusto von Dentz) {CVE-2022-20566}
  - netfilter: nf_tables: fix null deref due to zeroed list head (张钰 10307750)
  - nfc: fix refcount leak in llcp_sock_bind() (Xiaoming Ni)
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) {CVE-2023-0590}
  - nfc: fix memory leak in llcp_sock_connect() (Xiaoming Ni)
  - net/sched: tcindex: update imperfect hash filters respecting rcu (Pedro Tammela) {CVE-2023-1281}
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23454}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jann Horn) {CVE-2022-2964}
  - net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski) {CVE-2023-26545}
  - sctp: fail if no bound addresses can be used for a given scope (Marcelo Ricardo Leitner) {CVE-2023-1074}
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) {CVE-2023-0394}
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) {CVE-2022-47929}
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23455}
  - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) {CVE-2023-23559}
  - net: mvpp2: fix mvpp2 debugfs leak (Russell King (Oracle)) {CVE-2022-3535}
  - memcg: enable accounting of ipc resources (Vasily Averin) {CVE-2021-3759}
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Jann Horn) {CVE-2022-42703}
  - hv_netvsc: Add check for kvmalloc_array (Jiasheng Jiang) {CVE-2022-3107}
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout (feng.wei) {CVE-2022-1975}
  - anolis: x86/kasan: Map shadow for percpu pages on demand (Xuchun Shang)
  - anolis: x86/kasan: Add helpers to align shadow addresses up and down (Xuchun Shang)
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni) {CVE-2023-0461}
  - x86/mm: Randomize per-cpu entry area (Peter Zijlstra) {CVE-2023-0597}
  - anolis: random32: put prandom_init in a earlier step (Xuchun Shang) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on direct GDT (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Add within_area() to check data breakpoints (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area (Andy Lutomirski) {CVE-2023-0597}
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise (Ingo Molnar) {CVE-2023-0597}
  - xen/netback: don't call kfree_skb() with interrupts disabled (Juergen Gross)
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz) {CVE-2022-42896}
  - net: sched: sch_teql: fix null-pointer dereference (Pavel Tikhomirov)
  - tcp/dccp: fix possible race __inet_lookup_established() (Eric Dumazet)
  - power: supply: wm8350-power: Add missing free in free_charger_irq (Jiasheng Jiang) {CVE-2022-3111}
  - media: em28xx: initialize refcount before kref_get (Dongliang Mu) {CVE-2022-3239}
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) {CVE-2022-41218}
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne) {CVE-2023-0266}
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858}
  - xen/netfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33741}
  - tcp: Fix data races around icsk->icsk_af_ops. (Kuniyuki Iwashima) {CVE-2022-3566}
  - anolis: bond: broadcast ARP or ND messages to all slaves (Tony Lu)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.3.an8]
changelog:
  - nvme-pci: rerun irq setup on IO queue init errors (Keith Busch)
  - nvme-pci: refactor nvme_disable_io_queues (Christoph Hellwig)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.4.an8]
changelog:
  - iommu/vt-d: Fix agaw for a supported 48 bit guest address width (Gu Mi)
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso) {CVE-2023-32233}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.5.an8]
changelog:
  - iomap: Support inline data with block size < page size (Matthew Wilcox (Oracle))
  - iomap: support reading inline data from non-zero pos (Gao Xiang)
  - iomap: Don't create iomap_page objects for inline files (Andreas Gruenbacher)
  - selinux: fix race condition when computing ocontext SIDs (gcc_2023)
  - virtio_blk: fix the discard_granularity and discard_alignment queue limits (Christoph Hellwig)
  - virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero (Xie Yongji)
  - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (Ye Bin)
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (Eric Whitney)
  - ext4: fix corruption when online resizing a 1K bigalloc fs (Baokun Li)
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg)
  - ext4: reduce computation of overhead during resize (Kiselev, Oleg)
  - ext4: fix extent status tree race in writeback error recovery path (Eric Whitney)
  - ext4: update s_overhead_clusters in the superblock during an on-line resize (Theodore Ts'o)
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense (Theodore Ts'o)
  - ext4: fix avefreec in find_group_orlov (Pan Dong)
  - isolcpus: Affine unbound kernel threads to housekeeping cpus (Marcelo Tosatti)
  - kthread: Switch to cpu_possible_mask (Marcelo Tosatti)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello) {CVE-2023-1077}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - kernel/relay.c: fix read_pos error when multiple readers (Pengcheng Yang) {CVE-2023-3268}
  - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry (Zheng Wang) {CVE-2022-3707}
  - usb: gadget: rndis: prevent integer overflow in rndis_set_response() (Dan Carpenter) {CVE-2022-20423}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang) {CVE-2023-1989}
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang) {CVE-2023-30772}
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function (Miaoqian Lin) {CVE-2023-23000}
  - HID: check empty report_list in hid_validate_values() (Pietro Borrello) {CVE-2023-1073}
  - staging: rtl8712: fix use after free bugs (Dan Carpenter) {CVE-2022-4095}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang) {CVE-2023-1855}
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim) {CVE-2022-41850}
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang) {CVE-2023-1990}
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) {CVE-2023-0458}
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang) {CVE-2023-1670}
  - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors (shi.xue) {CVE-2020-0404}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong) {CVE-2023-28328}
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen) {CVE-2023-2194}
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin) {CVE-2022-36280}
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco) {CVE-2023-0045}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - tap: tap_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - tun: tun_chr_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - net: add sock_init_data_uid() (Pietro Borrello) {CVE-2023-1076}
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Hangyu Hua) {CVE-2023-35788}
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim) {CVE-2023-1829}
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei) {CVE-2023-26607}
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu) {CVE-2023-2985}
  - rds: rds_rm_zerocopy_callback() use list_first_entry() (Pietro Borrello) {CVE-2023-1078}
  - arm64: PCI: Preserve firmware configuration when desired (Benjamin Herrenschmidt)
  - arm64: PCI: Allow resource reallocation if necessary (Benjamin Herrenschmidt)
  - xen/blkfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33742.}
  - virtio_net: suppress cpu stall when free_unused_bufs (Wenliang Wang)
  - virtio_net: split free_unused_bufs() (Xuan Zhuo)
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li) {CVE-2023-2513}
  - ext4: correct max_inline_xattr_value_size computing (Baokun Li) {CVE-2023-2513}
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li) {CVE-2023-2513}
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li) {CVE-2023-2513}
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer) {CVE-2023-2269}
  - ext4: avoid cycles in directory h-tree (Jan Kara) {CVE-2022-1184}
  - ext4: verify dir block before splitting it (Jan Kara) {CVE-2022-1184}
  - ovl: enable RCU'd ->get_acl() (Miklos Szeredi)
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs" (Jingbo Xu)
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()" (Jingbo Xu)
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command (fupan)


author: Qinyun Tan <qinyuntan@linux.alibaba.com> [4.19.91-27.6.an8]
changelog:
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Peter Ujfalusi)
  - driver core: auxiliary bus: Fix calling stage for auxiliary bus init (Dave Jiang)
  - driver core: auxiliary bus: Fix auxiliary bus shutdown null auxdrv ptr (Dave Jiang)
  - anolis: config: Add AUXILIARY_BUS support in anolis defconfig (cuishw)
  - Add auxiliary bus support (Dave Ertman)
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan) {CVE-2023-3776}
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
  - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS (Yunjian Wang) {CVE-2023-3812}
  - anolis: configs: disable CONFIG_BPFILTER (Tianchen Ding)
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Pablo Neira Ayuso)
  - anolis: Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE" (tangbin)
  - anolis: mm: unlock zdm_lock after delete zdm (Ning Zhang)
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung) {CVE-2023-31436}
  - perf script python: Add Python3 support to tests/attr.py (Tony Jones)
  - nvme-pci: Fix controller freeze wait disabling (Keith Busch)
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng) {CVE-2023-3090}
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) {CVE-2023-3611}
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones) {CVE-2023-3609}
  - gfs2: Don't deref jdesc in evict (Bob Peterson) {CVE-2023-3212,CVE-2023-3212}
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu) {CVE-2023-3111}
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik) {CVE-2023-3111}
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus) {CVE-2023-34256}
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai) {CVE-2023-31084}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - KVM: nVMX: add missing consistency checks for CR0 and CR4 (Paolo Bonzini) {CVE-2023-30456}
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - bpf: fix buggy r0 retval refinement for tracing helpers (Daniel Borkmann)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15_rc3.an8]
changelog:
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - devlink: Extend devlink port documentation for subfunctions (Parav Pandit)
  - devlink: Add devlink port documentation (Parav Pandit)
  - devlink: Support get and set state of port function (Parav Pandit)
  - devlink: Support add and delete devlink port (Parav Pandit)
  - devlink: Introduce PCI SF port flavour and port attribute (Parav Pandit)
  - devlink: Prepare code to fill multiple port function attributes (Parav Pandit)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15_rc3.1.an8]
changelog:
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - anolis: Revert "selftest: kvm: Add amx selftest" (Guanjun)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id (D. Wythe) {CVE-2023-31248}
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - tipc: set con sock in tipc_conn_alloc (Xin Long) {CVE-2023-1382,CVE-2023-1382}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)
  - anolis: Revert "anolis: io_uring: lift nice value of sqthread" (Ferry Meng)
  - anolis: mm/lru: align lruvec lock to a cache line (Rongwei Wang)
  - cgroup: always put cset in cgroup_css_set_put_fork (John Sperbeck)
  - anolis: Revert "anolis: xfs: account extra freespace btree splits for multiple allocations" (Gao Xiang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15.an8]
changelog:
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - anolis: net/smc: fix hung state in inet sock (D. Wythe)
  - anolis: net/smc: avoid applications receiving clc msg (D. Wythe)
  - anolis: net/smc: Improve print and remove module params of reserve_mode (Wen Gu)
  - anolis: net/smc: validate rdma writable by rtoken_idx (Guangguan Wang)
  - anolis: net/smc: fix dup smc diag info (D. Wythe)
  - anolis: net/smc: Fix potential memory leaks and exceptions in inet (D. Wythe)
  - anolis: net/smc: fix ebpf panic (D. Wythe)
  - anolis: net/smc: fix bpf compile error (D. Wythe)
  - anolis: net/smc: fix potential reference count leak in smc (D. Wythe)
  - anolis: net/smc: protect connection state transitions in listen work (D. Wythe)
  - anolis: net/smc: optimize mutex_fback_rsn from mutex to spinlock (D. Wythe)
  - anolis: net/smc: refactor sock_flag/sock_set_flag (D. Wythe)
  - anolis: net/smc: add default name for smc negotiator (D. Wythe)
  - anolis: net/smc: do not check diff_cons when rmb_desc is null (Guangguan Wang)
  - anolis: net/smc: Expand the statistical range of ringbufs (Wen Gu)
  - anolis: net/smc: Expand the upper limit of SMCR/D ringbuf to 2MB (Wen Gu)
  - anolis: net/smc: Split wr_rx_buf into SMC_WR_BUF_CNT (Wen Gu)
  - anolis: net/smc: Adjust reserved-ports range and add warning print (Wen Gu)
  - anolis: net/smc: Fix fallback count overflow issue (Wen Gu)
  - anolis: net/smc: sock_hold in conns_lock protect area when smc_lgr_find_conn (Guangguan Wang)
  - anolis: net/smc: protect rdma_write processing from deleting rkey (Guangguan Wang)
  - anolis: net/smc: do not validate rkey by testing rkey value (Guangguan Wang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15.1.an8]
changelog:
  - anolis: configs: Enable CRYPTO_OFB for fips mode (Tianjia Zhang)
  - anolis: erofs: fix EROFS completely broken due to RAFS v6 support (Gao Xiang)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)
  - anolis: RDMA/erdma: Add erdma to arm64 defconfig (Kai Shen)
  - perf build: Install libsymbol locally when building (Ian Rogers)
  - tool lib symbol: Add Makefile/Build (Ian Rogers)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16_rc1.an8]
changelog:
  - anolis: net/smc: enlarge testlink llc wait time to 4 * HZ (Guangguan Wang)
  - ext4: don't allow journal inode to have encrypt flag (Eric Biggers)
  - fs: ext4: initialize fsdata in pagecache_write() (Alexander Potapenko)
  - ext4: use memcpy_to_page() in pagecache_write() (Chaitanya Kulkarni)
  - mm/highmem: Lift memcpy_[to|from]_page to core (Ira Weiny)
  - ext4: correct inconsistent error msg in nojournal mode (Baokun Li)
  - ext4: goto right label 'failed_mount3a' (Jason Yan)
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin)
  - ext4: avoid unaccounted block allocation when expanding inode (Jan Kara)
  - ext4: initialize quota before expanding inode in setproject ioctl (Jan Kara)
  - ext4: fix error code return to user-space in ext4_get_branch() (Luís Henriques)
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin)
  - ext4: check and assert if marking an no_delete evicting inode dirty (Zhang Yi)
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode (Baokun Li)
  - ext4: add helper to check quota inums (Baokun Li)
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (Baokun Li)
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Gaosheng Cui)
  - ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (Baokun Li)
  - ext4: silence the warning when evicting inode with dioread_nolock (Zhang Yi)
  - ext4: fix use-after-free in ext4_ext_shift_extents (Baokun Li)
  - ext4,f2fs: fix readahead of verity data (Matthew Wilcox (Oracle))
  - ext4: fix BUG_ON() when directory entry has invalid rec_len (Luís Henriques)
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)
  - anolis: net/smc: Fix missing mutex_unlock when finding SMCv2 device (Wen Gu)
  - fuse: nlookup missing decrement in fuse_direntplus_link (ruanmeisi)
  - anolis: net: txgbe: fix ethtool self test failed when sriov is enabled (DuanqiangWen)
  - anolis: net: txgbe: fix set tx-frames-irq failed (DuanqiangWen)
  - anolis: net: txgbe: add tx_multicast tx_broadcast statistics (DuanqiangWen)
  - anolis: net: txgbe: add 1000M autoneg on/off switch (DuanqiangWen)
  - anolis: net: txgbe: fix rxhash bug (DuanqiangWen)
  - anolis: net: txgbe: add rx fc count (DuanqiangWen)
  - anolis: net: txgbe: add protect for vr reset (DuanqiangWen)
  - anolis: net: txgbe: add lldp support (DuanqiangWen)
  - anolis: net: txgbe: add sriov support (DuanqiangWen)
  - anolis: net: txgbe: fix open/close notify sleep too long (DuanqiangWen)
  - anolis: spec: add some examples to make it more easily to use. (Qiao Ma)
  - anolis: spec: support for diy build mode (Qiao Ma)
  - anolis: spec: add extra check for official build mode (Qiao Ma)
  - anolis: spec: remove sign modules related codes (Qiao Ma)
  - x86/kprobes: Fix JNG/JNLE emulation (Nadav Amit)
  - x86/kprobes: Update kcb status flag after singlestepping (Masami Hiramatsu (Google))
  - x86/kprobes: Move 'inline' to the beginning of the kprobe_is_ss() declaration (Wei Yongjun)
  - x86/kprobes: Fix to identify indirect jmp and others using range case (Masami Hiramatsu)
  - x86/kprobes: Use int3 instead of debug trap for single-step (Masami Hiramatsu)
  - x86/kprobes: Identify far indirect JMP correctly (Masami Hiramatsu)
  - x86/kprobes: Retrieve correct opcode for group instruction (Masami Hiramatsu)
  - x86/kprobes: Do not decode opcode in resume_execution() (Masami Hiramatsu)
  - kprobes/x86: Fix fall-through warnings for Clang (Gustavo A. R. Silva)
  - anolis: arm64: Insert dsb instruction before and after writing cpuectlr register (Feng Su)
  - anolis: arm64: Remove some unsafe cpuectlr interfaces (Feng Su)
  - anolis: DRM: Phytium Add Phytium Display Engine support. (Li Shuo)
  - anolis: RDMA/erdma: Clear doorbell records when create_qp (kai.sk)
  - anolis: net/smc: fix hung under state SMC_APPFINCLOSEWAIT (D. Wythe)
  - anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending (D. Wythe)
  - anolis: net/smc: refactoring lgr pending lock (D. Wythe)
  - anolis: net/smc: Use diff TCP EXPR MAGIC to avoid network middleware do simple echo (D. Wythe)
  - fuse: in fuse_flush only wait if someone wants the return code (ningmingxiao)
  - cgroup: rstat: retrieve current bstat to delta directly (Wei Yang)
  - cgroup: rstat: use same convention to assign cgroup_base_stat (Wei Yang)
  - arm64: support copy_mc_[user]_highpage() (Tong Tiangen)
  - arm64: add uaccess to machine check safe (Tong Tiangen)
  - arm64: add support for machine check error safe (Tong Tiangen)
  - uaccess: add generic fallback version of copy_mc_to_user() (Tong Tiangen)
  - arm64: mte: Clean up user tag accessors (Robin Murphy)
  - linkage: add SYM_FUNC_ALIAS{,_LOCAL,_WEAK}() (Mark Rutland)
  - arm64: extable: cleanup redundant extable type EX_TYPE_FIXUP (Tong Tiangen)
  - arm64: extable: move _cond_extable to _cond_uaccess_extable (Tong Tiangen)
  - arm64: extable: make uaaccess helper use extable type EX_TYPE_UACCESS_ERR_ZERO (Tong Tiangen)
  - arm64: asm-extable: add asm uacess helpers (Mark Rutland)
  - arm64: asm-extable: move data fields (Mark Rutland)
  - arm64: extable: add new extable type EX_TYPE_KACCESS_ERR_ZERO support (Tong Tiangen)
  - anolis: net/smc: Fix connection leak of SMC_PEERFINCLOSEWAIT (Wen Gu)
  - anolis: net/smc: Add interface implementation of loopback device (Wen Gu)
  - anolis: net/smc: Modify cursor update logic when using mappable DMB (Wen Gu)
  - anolis: net/smc: Avoid data copy from sndbuf to peer RMB in SMC-D (Wen Gu)
  - anolis: net/smc: Introudce interfaces for DMB attach and detach (Wen Gu)
  - anolis: net/smc: Introduce an interface for getting DMB attribute (Wen Gu)
  - anolis: net/smc: Introduce SMC-D loopback device (Wen Gu)
  - anolis: net/smc: Extract v2 check helper from SMC-D device registration (Wen Gu)
  - anolis: net/smc: Decouple ism_dev from SMC-D DMB registration (Wen Gu)
  - anolis: net/smc: Decouple ism_dev from SMC-D device dump (Wen Gu)
  - anolis: net/smc: fix for credit leak when get free slot but the connection is killed (Guangguan Wang)
  - anolis: sched/core: introduce ht-aware-quota (Cruz Zhao)
  - cgroup: rstat: support cgroup1 (Johannes Weiner)
  - anolis: sched: introduce per cgroup sibidle (Cruz Zhao)
  - anolis: sched: account sibidle for core scheduling (Cruz Zhao)
  - anolis: sched: introduce sysctl_sched_acpu_enabled (Cruz Zhao)
  - anolis: sched: introduce ACPU accounting (Tianchen Ding)
  - anolis: configs: enable page table bind related configuration (Kaihao Bai)
  - anolis: mm: support allocating page table pages binded with local numa node (Kaihao Bai)
  - sched: adjust sleeper credit for SCHED_IDLE entities (Josh Don)
  - sched: reduce sched slice for SCHED_IDLE entities (Josh Don)
  - sched: Account number of SCHED_IDLE entities on each cfs_rq (Josh Don)
  - mm: memcontrol: make the slab calculation consistent (Muchun Song)
  - mm: memcontrol: convert NR_FILE_PMDMAPPED account to pages (Muchun Song)
  - mm: memcontrol: convert NR_SHMEM_PMDMAPPED account to pages (Muchun Song)
  - mm: memcontrol: convert NR_SHMEM_THPS account to pages (Muchun Song)
  - mm: memcontrol: convert NR_FILE_THPS account to pages (Muchun Song)
  - mm: memcontrol: convert NR_ANON_THPS account to pages (Muchun Song)
  - mm: memcontrol: optimize per-lruvec stats counter memory usage (Muchun Song)
  - mm: memcontrol: account pagetables per node (Shakeel Butt)
  - mm: move lruvec stats update functions to vmstat.h (Shakeel Butt)
  - anolis: configs: enable CONFIG_EROFS_FS_ZIP_DEFLATE=y (Gao Xiang)
  - erofs: allow empty device tags in flatdev mode (Jingbo Xu)
  - erofs: fix memory leak of LZMA global compressed deduplication (Gao Xiang)
  - erofs: DEFLATE compression support (Gao Xiang)
  - anolis: hwmon: Phytium tachometer driver (wangzhimin)
  - anolis:irqchip:Phytium pd2008 PCIe legacy INTx interrupt controller (wangzhimin)
  - anolis: mailbox: mailbox driver support for Phytium desktop and embedded CPUs (Chen Ziqiang)
  - ext4: continue to expand file system when the target size doesn't reach (Jerry Lee 李修賢)
  - ext4: place buffer head allocation before handle start (Jinke Han)
  - ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate (Zhang Yi)
  - ext4: don't increase iversion counter for ea_inodes (Lukas Czerner)
  - ext4: make ext4_lazyinit_thread freezable (Lalith Rajendran)
  - ext4: fix null-ptr-deref in ext4_write_info (Baokun Li)
  - ext4: avoid crash when inline data creation follows DIO write (Jan Kara)
  - jbd2: add miss release buffer head in fc_do_one_pass() (Ye Bin)
  - jbd2: fix potential use-after-free in jbd2_fc_wait_bufs (Ye Bin)
  - jbd2: fix potential buffer head reference count leak (Ye Bin)
  - jbd2: wake up journal waiters in FIFO order, not LIFO (Andrew Perepechko)
  - anolis: mm: prezero: adapt to high-order pcp (Xu Yu)
  - ext4: make directory inode spreading reflect flexbg size (Jan Kara)
  - ext4: limit the number of retries after discarding preallocations blocks (Theodore Ts'o)
  - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (Luís Henriques)
  - ext4: avoid remove directory when directory is corrupted (Ye Bin)
  - ext4: make sure ext4_append() always allocates new block (Lukas Czerner)
  - ext4: fix warning in ext4_iomap_begin as race between bmap and write (Ye Bin)
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (Zhihao Cheng)
  - ext4: recover csum seed of tmp_inode after migrating to extents (Li Lingfeng)
  - jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() (Zhang Yi)
  - anolis: config: Enable inspur drm module (Guixin Liu)
  - anolis: inspur-drm: Add X86_64 dependency (Guixin Liu)
  - anolis: spi: add support for Phytium SPI (Malloy Liu)
  - anolis: can: can driver for phytium CPUs (Chen Siyu)
  - anolis: gpio: GPIO driver support for Phytium CPUs (Wei Tian)
  - anolis:usb:Phytium Pe220x usb2.0 OTG USB Controller (wangzhimin)
  - anolis: ep: Phytium pd2008 pcie endpoint driver (wangzhimin)
  - anolis: input: add phytium ps-2 controller support (Jiakun Shuai)
  - anolis: nand: add phytium 5.10 nand controller driver (Jiakun Shuai)
  - anolis:net:add dwmac phytium driver for d2000 (wangzhimin)
  - anolis: keypad: Driver for the Phytium keypad port. (Li Shuo)
  - io_uring: break iopolling on signal (Pavel Begunkov)
  - io_uring: break out of iowq iopoll on teardown (Pavel Begunkov)
  - io_uring: always lock in io_apoll_task_func (Pavel Begunkov)
  - io_uring: correct check for O_TMPFILE (Aleksa Sarai)
  - io_uring: gate iowait schedule on having pending requests (Jens Axboe)
  - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq (Jens Axboe)
  - io_uring: don't audit the capability check in io_uring_create() (Ondrej Mosnacek)
  - io_uring: add reschedule point to handle_tw_list() (Jens Axboe)
  - io_uring: Use io_schedule* in cqring wait (Andres Freund)
  - io_uring: wait interruptibly for request completions on exit (Jens Axboe)
  - io_uring: ensure IOPOLL locks around deferred work (Jens Axboe)
  - io_uring/net: disable partial retries for recvmsg with cmsg (Jens Axboe)
  - io_uring/net: clear msg_controllen on partial sendmsg retry (Jens Axboe)
  - io_uring/net: save msghdr->msg_control for retries (Jens Axboe)
  - io_uring: hold uring mutex around poll removal (Jens Axboe)
  - io_uring: avoid null-ptr-deref in io_arm_poll_handler (Fedor Pchelkin)
  - io_uring/poll: allow some retries for poll triggering spuriously (Jens Axboe)
  - io_uring: remove MSG_NOSIGNAL from recvmsg (David Lamparter)
  - io_uring/rsrc: disallow multi-source reg buffers (Pavel Begunkov)
  - io_uring: add a conditional reschedule to the IOPOLL cancelation loop (Jens Axboe)
  - io_uring: mark task TASK_RUNNING before handling resume/task work (Jens Axboe)
  - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work (Jens Axboe)
  - io_uring: ensure that io_init_req() passes in the right issue_flags (Jens Axboe)
  - io_uring: add missing lock in io_get_file_fixed (Bing-Jhong Billy Jheng)
  - sched/core: introduce sched_core_idle_cpu() (Cruz Zhao)
  - anolis: sched/core: introduce sysctl_sched_core (Cruz Zhao)
  - anolis: sched/core: introduce PR_SCHED_CORE_CLEAR (Cruz Zhao)
  - anolis: Revert "anolis: sched: Add a switch to control core scheduling" (Cruz Zhao)
  - anolis: RDMA/erdma: Prevent RQE out of range from HW (Kai Shen)
  - anolis: newfeature: ccp: add hct module (yangdepei)
  - anolis: bugfix: crypto: fix coredump when the data address from userspace is invalid. (Xiangyu Xu)
  - anolis: bugfix: crypto: ccp: Fix a problem that vq thread may stuck when do multi process test. (Xiangyu Xu)
  - anolis: bugfix: crypto: ccp: Fix sm2 test failed when insmod modules of hygonccp (Xiangyu Xu)
  - anolis: bugfix: crypto: ccp: It prompt failed when encrypted size is 64KB. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Process multiple VQ commands once for SM4/SM4-CTR ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Process multiple VQ commands once for SM3 ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Modify value of COMMANDS_PER_QUEUE from 16 to 8192. (Yabin Li)
  - anolis: bugfix: crypto: ccp: Only handle interrupts by completion, eliminating by empty queue. (Yabin Li)
  - anolis: bugfix: crypto: ccp: It prompt ILLEGAL_MEM_ADDR when using PSPCCP. (Yabin Li)
  - anolis: bugfix: crypto: The output data length is not fixed for SM2 encrypt and decrypt algorithm. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Userspace can exchange context data including iv, etc with kernel space. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Support SM4 algorithm for hygon ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Support SM3 algorithm for hygon ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Support SM2 algorithm for hygon ccp. (Yabin Li)
  - anolis: crypto: avoid invalid op in aead cipher mode (yangdepei)
  - opensource: crypto: AF_ALG -- add asymmetric cipher (Stephan Mueller)
  - opensource: crypto: AF_ALG -- add setpubkey setsockopt call (Stephan Mueller)
  - opensource: crypto: AF_ALG -- add sign/verify API (Stephan Mueller)
  - anolis: configs: enable CONFIG_KEXEC_BZIMAGE_VERIFY_SIG (YiLin.Li)
  - io_uring/rw: remove leftover debug statement (Jens Axboe)
  - io_uring/rw: ensure kiocb_end_write() is always called (Jens Axboe)
  - io_uring: fix double poll leak on repolling (Pavel Begunkov)
  - io_uring: Clean up a false-positive warning from GCC 9.3.0 (Alviro Iskandar Setiawan)
  - io_uring/net: fix fast_iov assignment in io_setup_async_msg() (Stefan Metzmacher)
  - io_uring: io_kiocb_update_pos() should not touch file for non -1 offset (Jens Axboe)
  - io_uring/rw: defer fsnotify calls to task context (Jens Axboe)
  - io_uring: do not recalculate ppos unnecessarily (Dylan Yudaken)
  - io_uring: update kiocb->ki_pos at execution time (Dylan Yudaken)
  - io_uring: remove duplicated calls to io_kiocb_ppos (Dylan Yudaken)
  - io_uring: ensure that cached task references are always put on exit (Jens Axboe)
  - io_uring: lock overflowing for IOPOLL (Pavel Begunkov)
  - io_uring: check for valid register opcode earlier (Jens Axboe)
  - io_uring: fix async accept on O_NONBLOCK sockets (Dylan Yudaken)
  - io_uring: allow re-poll if we made progress (Jens Axboe)
  - io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG) (Jens Axboe)
  - io_uring: add flag for disabling provided buffer recycling (Jens Axboe)
  - io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly (Jens Axboe)
  - io_uring: improve send/recv error handling (Pavel Begunkov)
  - io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL (Jens Axboe)
  - io_uring/io-wq: only free worker if it was allocated for creation (Jens Axboe)
  - io_uring/io-wq: free worker if task_work creation is canceled (Jens Axboe)
  - io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() (Harshit Mogalapalli)
  - io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups (Jens Axboe)
  - eventfd: provide a eventfd_signal_mask() helper (Jens Axboe)
  - eventpoll: add EPOLL_URING_WAKE poll wakeup flag (Jens Axboe)
  - anolis: drm/inspur/inspur-drm: Add inspur drm driver (wangkaiyuan)
  - anolis: config: Enable 3snic module (Guixin Liu)
  - Net: ethernet: Support 3snic 3s9xx network card (Steven Song)
  - anolis: scsi: lack of isci driver leads to boot failed (Gu Mi)
  - xfs: don't reuse busy extents on extent trim (Brian Foster)
  - xfs: shut down the filesystem if we screw up quota reservation (Darrick J. Wong)
  - xfs: remove xfs_setattr_time() declaration (Gaosheng Cui)
  - xfs: use setattr_copy to set vfs inode attributes (Darrick J. Wong)
  - xfs: set prealloc flag in xfs_alloc_file_space() (Dave Chinner)
  - xfs: fallocate() should call file_modified() (Dave Chinner)
  - xfs: remove XFS_PREALLOC_SYNC (Dave Chinner)
  - xfs: don't leak btree cursor when insrec fails after a split (Darrick J. Wong)
  - xfs: purge dquots after inode walk fails during quotacheck (Darrick J. Wong)
  - xfs: don't assert fail on perag references on teardown (Dave Chinner)
  - xfs: reorder iunlink remove operation in xfs_ifree (Dave Chinner)
  - anolis: io_uring: re-add sqthread percpu polling support. (Ferry Meng)
  - io_uring: import 5.15-stable io_uring (Jens Axboe)
  - anolis: mm: thp: fix compile error on MEMCG_DISABLE_SHMEM_THP (Rongwei Wang)
  - anolis: sched: fix compile error if CONFIG_SCHED_SLI not set (Yi Tao)
  - anolis: mm: avoid lru_gen_del_page if kidled is enabled (Kaihao Bai)
  - anolis: mm: coldpgs: delete check of memcg swappiness (Huang Haowei)
  - anolis: mm: pagecache_limit: inherit settings of parent memcg (Xu Yu)
  - anolis: config, modsign: enable CONFIG_SYSTEM_EXTRA_CERTIFICATE to support insert a certificate to the kernel image without recompiling the kernel (YiLin.Li)
  - anolis: kabi: Reserve some space for kABI stability (Guixin Liu)
  - sched/fair: Mark tg_is_idle() an inline in the !CONFIG_FAIR_GROUP_SCHED case (Ingo Molnar)
  - sched: Cgroup SCHED_IDLE support (Josh Don)
  - sched/fair: Reorder throttle_cfs_rq() path (Peng Wang)
  - anolis: sched: Support latency histograms in cpu controller (Yi Tao)
  - anolis: sched, cpuacct: Move scheduling latency data from cpuacct to task_group (Yi Tao)
  - anolis: sched/fair: Support sched_cfs_statistics in cgroup v2 (Yi Tao)
  - anolis: mm: thp: introduce memcg interface to control THP behavior (Xu Yu)
  - anolis: crypto: iax: fix unexpected softlockup while enabling iax_crypto (Kun(llfl))
  - iommu/vt-d: Fix RID2PASID setup/teardown failure (Lu Baolu)
  - xfs: fix soft lockup via spinning in filestream ag selection loop (Brian Foster)
  - xfs: fix overfilling of reserve pool (Darrick J. Wong)
  - xfs: always succeed at setting the reserve pool size (Darrick J. Wong)
  - xfs: remove infinite loop when reserving free block pool (Darrick J. Wong)
  - xfs: only bother with sync_filesystem during readonly remount (Darrick J. Wong)
  - xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* (Darrick J. Wong)
  - xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() (Dan Carpenter)
  - xfs: fix I_DONTCACHE (Dave Chinner)
  - xfs: only set IOMAP_F_SHARED when providing a srcmap to a write (Darrick J. Wong)
  - mm: Add kvrealloc() (Dave Chinner)
  - task_work: add helper for more targeted task_work canceling (Jens Axboe)
  - kernel: don't call do_exit() for PF_IO_WORKER threads (Jens Axboe)
  - kernel: stop masking signals in create_io_thread() (Jens Axboe)
  - x86/process: setup io_threads more like normal user space threads (Stefan Metzmacher)
  - arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() (Jens Axboe)
  - arch: setup PF_IO_WORKER threads like PF_KTHREAD (Jens Axboe)
  - entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set (Seth Forshee)
  - kernel: allow fork with TIF_NOTIFY_SIGNAL pending (Jens Axboe)
  - coredump: Limit what can interrupt coredumps (Eric W. Biederman)
  - kernel: remove checking for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - task_work: remove legacy TWA_SIGNAL path (Jens Axboe)
  - alpha: fix TIF_NOTIFY_SIGNAL handling (Al Viro)
  - ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling (Vineet Gupta)
  - ia64: don't call handle_signal() unless there's actually a signal queued (Jens Axboe)
  - sparc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - riscv: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - nds32: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - ia64: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - h8300: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - c6x: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - alpha: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - xtensa: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - arm: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - microblaze: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - hexagon: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - csky: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - openrisc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - sh: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - um: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - s390: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - mips: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - powerpc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - parisc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - nios32: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - m68k: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - arm64: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - arc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - x86: Wire up TIF_NOTIFY_SIGNAL (Jens Axboe)
  - task_work: Use TIF_NOTIFY_SIGNAL if available (Jens Axboe)
  - entry: Add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - fs: provide locked helper variant of close_fd_get_file() (Jens Axboe)
  - file: Rename __close_fd_get_file close_fd_get_file (Eric W. Biederman)
  - fs: make do_renameat2() take struct filename (Jens Axboe)
  - signal: Add task_sigpending() helper (Jens Axboe)
  - net: add accept helper not installing fd (Pavel Begunkov)
  - net: provide __sys_shutdown_sock() that takes a socket (Jens Axboe)
  - tools headers UAPI: Sync openat2.h with the kernel sources (Arnaldo Carvalho de Melo)
  - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED (Jens Axboe)
  - Make sure nd->path.mnt and nd->path.dentry are always valid pointers (Al Viro)
  - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* (Al Viro)
  - fs: add support for LOOKUP_CACHED (Jens Axboe)
  - saner calling conventions for unlazy_child() (Al Viro)
  - iov_iter: add helper to save iov_iter state (Jens Axboe)
  - kernel: provide create_io_thread() helper (Jens Axboe)
  - anolis: mm, memcg: increase memsli interface for cgroup v2 (Bo Liu)
  - x86/tdx: Add Quote generation support (Kuppuswamy Sathyanarayanan)
  - x86/coco: Add cc_decrypted_alloc/free() interfaces (Kuppuswamy Sathyanarayanan)
  - x86/tdx: Add TDX Guest event notify interrupt support (Kuppuswamy Sathyanarayanan)
  - xfs: Enforce attr3 buffer recovery order (Dave Chinner)
  - xfs: logging the on disk inode LSN can make it go backwards (Dave Chinner)
  - xfs: remove dead stale buf unpin handling code (Brian Foster)
  - xfs: hold buffer across unpin and potential shutdown processing (Brian Foster)
  - xfs: force the log offline when log intent item recovery fails (Darrick J. Wong)
  - xfs: prevent UAF in xfs_log_item_in_current_chkpt (Darrick J. Wong)
  - xfs: xfs_log_force_lsn isn't passed a LSN (Dave Chinner)
  - anolis: sw64: make rpm package for sw_64 (Gu Mi)
  - anolis: mm/kidled: remove unused variable 'idx' (Joseph Qi)
  - anolis: sw64: fix compile issue dut to lack of WITH Linux-syscall-note (Gu Mi)
  - anolis: sw64: rename perf_reg_name to __perf_reg_name (Gu Mi)
  - anolis:  mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t * (Gu Mi)
  - anolis: arm64: turning off mitigations for Spectre-BHB and Variant-4 in cmdline (Bitao Hu)
  - anolis: mm, kidled: set age value in the flags of head pages (Ning Zhang)
  - selftests/bpf: Limit unroll_count for pyperf600 test (Yonghong Song)
  - anolis: sched/fair: place id_commit_make_up() correctly (Tianchen Ding)
  - netfilter: nf_tables: don't skip expired elements during walk (Florian Westphal) {CVE-2023-4563}
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) {CVE-2023-40283}
  - ext4: only update i_reserved_data_blocks on successful block allocation (Baokun Li)
  - ext4: correct inline offset when handling xattrs in inode body (Eric Whitney)
  - SCSI: SSSRAID: Introduce map_queue in sssraid module (Steven Song)
  - anolis: x86/hygon: x86_cap_flags should now be written as it is RO (Zelin Deng)
  - anolis: KVM: Fix the issue of Windows VMs crashing starting via QEMU (Guanjun)
  - LoongArch: Fix module relocation error with binutils 2.41 (Juxin Gao)
  - dm raid: protect md_stop() with 'reconfig_mutex' (Yu Kuai)
  - dm raid: clean up four equivalent goto tags in raid_ctr() (Yu Kuai)
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (Yu Kuai)
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka)
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang)
  - dm thin: fix deadlock when swapping to thin device (Coly Li)
  - dm: add cond_resched() to dm_wq_work() (Pingfan Liu)
  - dm cache: add cond_resched() to various workqueue loops (Mike Snitzer)
  - dm thin: add cond_resched() to various workqueue loops (Mike Snitzer)
  - dm cache: set needs_check flag after aborting metadata (Mike Snitzer)
  - dm thin: resume even if in FAIL mode (Luo Meng)
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng)
  - dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (Mike Snitzer)
  - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata (Zhihao Cheng)
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)
  - dm raid: fix address sanitizer warning in raid_status (Mikulas Patocka)
  - dm raid: fix address sanitizer warning in raid_resume (Mikulas Patocka)
  - dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (Luo Meng)
  - dm writecache: set a default MAX_WRITEBACK_JOBS (Mikulas Patocka)
  - dm: return early from dm_pr_call() if DM device is suspended (Mike Snitzer)
  - fuse: revalidate: don't invalidate if interrupted (Miklos Szeredi)
  - Loongarch: Fix build erorr when enable kprobe (Juxin Gao)
  - LoongArch: Add kretprobes support (Juxin Gao)
  - LoongArch: Add kprobes support (Juxin Gao)
  - LoongArch: Simulate branch and PC* instructions (Juxin Gao)
  - LoongArch: Fix the write_fcsr() macro (Qi Hu)
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis) {CVE-2023-4128}
  - net: rpl: fix rpl header size calculation (Alexander Aring) {CVE-2023-2156}
  - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (Lin Ma) {CVE-2023-3773}
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan) {CVE-2023-3776}
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
  - anolis: erofs: ensure that the post-EOF tails are all zeroed (Gao Xiang)
  - anolis: erofs: fix -EFAULT error due to KVEC iovec (Huang Jianan)
  - anolis: erofs: introduce erofs_is_rafsv6_mode() helper (Jingbo Xu)
  - anolis: erofs: disable flatdev in rafsv6 mode (Jingbo Xu)
  - anolis: erofs: initialize bootstrap prior to reading superblock (Jingbo Xu)
  - anolis: erofs: no bother sb_set_blocksize() in rafsv6 mode (Jingbo Xu)
  - anolis: erofs: move option exclusion check to .get_tree() (Jingbo Xu)
  - anolis: erofs: fix erofs_is_fscache_mode() (Jingbo Xu)
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)
  - perf/x86/amd/core: Always clear status for idx (Breno Leitao)
  - anolis: alinux: tcm: add Hygon TCM2 driver (chench)
  - drm/amdkfd: Check for null pointer after calling kmemdup (Jiasheng Jiang) {CVE-2022-3108}
  - anolis: KVM: SVM: Force flush caches before reboot CSV guest (hanliyang)
  - anolis: KVM: SVM: Add support for rebooting CSV2 guest (hanliyang)
  - anolis: KVM: x86: Introduce control_{pre,post}_system_reset ioctl interfaces (hanliyang)
  - anolis: arm64: add cpuectlr sysfs interface (Feng Su)
  - anolis: Revert "anolis: drivers: arm64: add prefetch tuning sysctl interface by module mode" (Feng Su)
  - anolis: spec: fix a bash gramma problem (Qiao Ma)
  - anolis: spec: add dependency of kernel-modules-{extra, internal} for kernel.rpm (Qiao Ma)
  - anolis: spec: split comments into new lines (Qiao Ma)
  - anolis: spec: use * to adapt for gz and zstd compressions (Qiao Ma)
  - anolis: spec: do not use lto optimize (Qiao Ma)
  - anolis: spec: remove modules.builtin.alias.bin after built kernel (Qiao Ma)
  - anolis: spec: update rpm-config dependency for anolis 23 (Qiao Ma)
  - ext4: do not mark inode dirty every time in delalloc append write scenario (Liu Song)
  - anolis: PHYTIUM: ft2000: Add CONFIG_ARM_SMMU dependency for SMMU HW workaround (Shawn Wang)
  - anolis: add AER config dependency sanity check to fix build error (Shuai Xue)
  - anolis: mm: fix compile error if CONFIG_KIDLED disabled (Kaihao Bai)
  - ext4: don't set up encryption key during jbd2 transaction (Eric Biggers)
  - ext4: disable fast-commit of encrypted dir operations (Eric Biggers)
  - ext4: fix leaking uninitialized memory in fast-commit journal (Eric Biggers)
  - ext4: update 'state->fc_regions_size' after successful memory allocation (Ye Bin)
  - ext4: fix potential memory leak in ext4_fc_record_regions() (Ye Bin)
  - ext4: fix potential memory leak in ext4_fc_record_modified_inode() (Ye Bin)
  - ext4: fix miss release buffer head in ext4_fc_write_inode (Ye Bin)
  - nvdimm: Support sizeof(struct page) > MAX_STRUCT_PAGE_SIZE (Dan Williams)
  - libnvdimm/pfn_dev: increase MAX_STRUCT_PAGE_SIZE (Alexander Potapenko)
  - erofs: fix wrong primary bvec selection on deduplicated extents (Gao Xiang)
  - erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF (Chunhai Guo)
  - erofs: avoid useless loops in z_erofs_pcluster_readmore() when reading beyond EOF (Chunhai Guo)
  - erofs: fix compact 4B support for 16k block size (Gao Xiang)
  - erofs: kill hooked chains to avoid loops on deduplicated compressed images (Gao Xiang)
  - erofs: initialize packed inode after root inode is assigned (Jingbo Xu)
  - erofs: stop parsing non-compact HEAD index if clusterofs is invalid (Gao Xiang)
  - erofs: get rid of a useless DBG_BUGON (Gao Xiang)
  - erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms (Gao Xiang)
  - erofs: move zdata.h into zdata.c (Gao Xiang)
  - erofs: remove tagged pointer helpers (Gao Xiang)
  - erofs: avoid tagged pointers to mark sync decompression (Gao Xiang)
  - erofs: validate the extent length for uncompressed pclusters (Gao Xiang)
  - erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails (Gao Xiang)
  - erofs: Fix pcluster memleak when its block address is zero (Chen Zhongjin)
  - erofs: clean up cached I/O strategies (Gao Xiang)
  - erofs: fix general protection fault when reading fragment (Yue Hu)
  - erofs: fix up inplace decompression success rate (Gao Xiang)
  - erofs: shouldn't churn the mapping page for duplicated copies (Gao Xiang)
  - erofs: fix illegal unmapped accesses in z_erofs_fill_inode_lazy() (Yue Hu)
  - erofs: clean up unnecessary code and comments (Gao Xiang)
  - erofs: fold in z_erofs_reload_indexes() (Yue Hu)
  - erofs: introduce partial-referenced pclusters (Gao Xiang)
  - erofs: support on-disk compressed fragments data (Yue Hu)
  - erofs: support interlaced uncompressed data for compressed files (Yue Hu)
  - erofs: fix pcluster use-after-free on UP platforms (Gao Xiang)
  - erofs: introduce multi-reference pclusters (fully-referenced) (Gao Xiang)
  - erofs: record the longest decompressed size in this round (Gao Xiang)
  - erofs: introduce z_erofs_do_decompressed_bvec() (Gao Xiang)
  - erofs: try to leave (de)compressed_pages on stack if possible (Gao Xiang)
  - erofs: introduce struct z_erofs_decompress_backend (Gao Xiang)
  - erofs: get rid of `z_pagemap_global' (Gao Xiang)
  - erofs: clean up `enum z_erofs_collectmode' (Gao Xiang)
  - erofs: get rid of `enum z_erofs_page_type' (Gao Xiang)
  - erofs: rework online page handling (Gao Xiang)
  - erofs: switch compressed_pages[] to bufvec (Gao Xiang)
  - erofs: introduce `z_erofs_parse_in_bvecs' (Gao Xiang)
  - erofs: drop the old pagevec approach (Gao Xiang)
  - erofs: introduce bufvec to store decompressed buffers (Gao Xiang)
  - erofs: introduce `z_erofs_parse_out_bvecs()' (Gao Xiang)
  - erofs: clean up z_erofs_collector_begin() (Gao Xiang)
  - erofs: get rid of unneeded `inode', `map' and `sb' (Gao Xiang)
  - erofs: refine managed inode stuffs (Gao Xiang)
  - erofs: avoid consecutive detection for Highmem memory (Gao Xiang)
  - erofs: wake up all waiters after z_erofs_lzma_head ready (Yuwen Chen)
  - erofs: fix 'backmost' member of z_erofs_decompress_frontend (Weizhao Ouyang)
  - erofs: simplify z_erofs_pcluster_readmore() (Gao Xiang)
  - erofs: get rid of label `restart_now' (Gao Xiang)
  - erofs: get rid of `struct z_erofs_collection' (Gao Xiang)
  - erofs: fix buffer copy overflow of ztailpacking feature (Gao Xiang)
  - erofs: refine on-disk definition comments (Gao Xiang)
  - erofs: remove obsoleted comments (Gao Xiang)
  - erofs: do not prompt for risk any more when using big pcluster (Yue Hu)
  - erofs: fix use-after-free of on-stack io[] (Hongyu Jin)
  - erofs: rename ctime to mtime (David Anderson)
  - erofs: clean up z_erofs_extent_lookback (Gao Xiang)
  - erofs: silence warnings related to impossible m_plen (Gao Xiang)
  - erofs: clean up preload_compressed_pages() (Gao Xiang)
  - erofs: get rid of `struct z_erofs_collector' (Gao Xiang)
  - erofs: fix ztailpacking on > 4GiB filesystems (Gao Xiang)
  - erofs: fix small compressed files inlining (Gao Xiang)
  - erofs: add on-disk compressed tail-packing inline support (Yue Hu)
  - erofs: support inline data decompression (Yue Hu)
  - erofs: support unaligned data decompression (Gao Xiang)
  - erofs: introduce z_erofs_fixup_insize (Gao Xiang)
  - erofs: tidy up z_erofs_lz4_decompress (Gao Xiang)
  - erofs: Replace zero-length array with flexible-array member (Gao Xiang)
  - erofs: remove useless cache strategy of DELAYEDALLOC (Yue Hu)
  - erofs: get rid of ->lru usage (Gao Xiang)
  - anolis: meminfo: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: sysfs/cpu: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: arm64: cpuinfo: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: x86: cpuinfo: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: configs: support EROFS LZMA compression (Gao Xiang)
  - erofs: lzma compression support (Gao Xiang)
  - lib/xz: Add MicroLZMA decoder (Lasse Collin)
  - lib/xz: Move s->lzma.len = 0 initialization to lzma_reset() (Lasse Collin)
  - erofs: rename some generic methods in decompressor (Gao Xiang)
  - erofs: introduce readmore decompression strategy (Gao Xiang)
  - mm: Implement readahead_control pageset expansion (David Howells)
  - mm/readahead: Handle ractl nr_pages being modified (Matthew Wilcox (Oracle))
  - fs: Document file_ra_state (Matthew Wilcox (Oracle))
  - mm/filemap: Pass the file_ra_state in the ractl (Matthew Wilcox (Oracle))
  - erofs: introduce the secondary compression head (Gao Xiang)
  - erofs: get compression algorithms directly on mapping (Gao Xiang)
  - erofs: remove the fast path of per-CPU buffer decompression (Yue Hu)
  - erofs: clear compacted_2b if compacted_4b_initial > totalidx (Yue Hu)
  - erofs: add support for the full decompressed length (Gao Xiang)
  - erofs: remove the mapping parameter from erofs_try_to_free_cached_page() (Yue Hu)
  - erofs: directly use wrapper erofs_page_is_managed() when shrinking (Yue Hu)
  - anolis: configs: enable CONFIG_SCHED_CORE (Tianchen Ding)
  - anolis: sched: reserve field for core scheduling (Tianchen Ding)
  - anolis: sched: Add a switch to control core scheduling (Tianchen Ding)
  - sched/core: Avoid selecting the task that is throttled to run when core-sched enable (Hao Jia)
  - cgroup: fix display of forceidle time at root (Josh Don)
  - sched/core: Fix comparison in sched_group_cookie_match() (Lin Shengwang)
  - sched/core: Remove superfluous semicolon (Xin Gao)
  - sched/core: add forced idle accounting for cgroups (Josh Don)
  - sched/core: Fix the bug that task won't enqueue into core tree when update cookie (Cruz Zhao)
  - arch/arm64: Fix topology initialization for core scheduling (Phil Auld)
  - sched: Teach the forced-newidle balancer about CPU affinity limitation. (Sebastian Andrzej Siewior)
  - sched/core: Fix forceidle balancing (Peter Zijlstra)
  - sched/core: Accounting forceidle time for all tasks except idle task (Cruz Zhao)
  - sched/core: Forced idle accounting (Josh Don)
  - sched: Make cookie functions static (Shaokun Zhang)
  - tools headers UAPI: Sync linux/prctl.h with the kernel sources (Arnaldo Carvalho de Melo)
  - uapi/linux/prctl: provide macro definitions for the PR_SCHED_CORE type argument (Eugene Syromiatnikov)
  - sched/core: Simplify core-wide task selection (Peter Zijlstra)
  - sched: Fix Core-wide rq->lock for uninitialized CPUs (Peter Zijlstra)
  - admin-guide/hw-vuln: Rephrase a section of core-scheduling.rst (Fabio M. De Francesco)
  - Documentation: Add usecases, design and interface for core scheduling (Joel Fernandes (Google))
  - kselftest: Add test for core sched prctl interface (Chris Hyser)
  - sched: prctl() core-scheduling interface (Chris Hyser)
  - sched: Inherit task cookie on fork() (Peter Zijlstra)
  - sched: Trivial core scheduling cookie management (Peter Zijlstra)
  - sched: Migration changes for core scheduling (Aubrey Li)
  - sched: Trivial forced-newidle balancer (Peter Zijlstra)
  - sched/fair: Snapshot the min_vruntime of CPUs on force idle (Joel Fernandes (Google))
  - sched: Fix priority inversion of cookied task with sibling (Joel Fernandes (Google))
  - sched/fair: Fix forced idle sibling starvation corner case (Vineeth Pillai)
  - sched: Add core wide task selection and scheduling (Peter Zijlstra)
  - sched: Basic tracking of matching tasks (Peter Zijlstra)
  - sched: Introduce sched_class::pick_task() (Peter Zijlstra)
  - sched: Allow sched_core_put() from atomic context (Peter Zijlstra)
  - sched: Optimize rq_lockp() usage (Peter Zijlstra)
  - sched: Core-wide rq->lock (Peter Zijlstra)
  - sched: Prepare for Core-wide rq->lock (Peter Zijlstra)
  - sched: Wrap rq::lock access (Peter Zijlstra)
  - sched: Provide raw_spin_rq_*lock*() helpers (Peter Zijlstra)
  - sched/fair: Add a few assertions (Peter Zijlstra)
  - bpf, arm64: Fix BTI type used for freplace attached functions (Alexander Duyck)
  - bpf, arm64: Fixed a BTI error on returning to patched function (Xu Kuohai)
  - bpf, arm64: Fix bpf trampoline instruction endianness (Xu Kuohai)
  - bpf, arm64: Fix compile error in dummy_tramp() (Xu Kuohai)
  - bpf, arm64: Mark dummy_tramp as global (Nathan Chancellor)
  - bpf, arm64: Add bpf trampoline for arm64 (Xu Kuohai)
  - bpf, arm64: Implement bpf_arch_text_poke() for arm64 (Xu Kuohai)
  - arm64: Add LDR (literal) instruction (Xu Kuohai)
  - bpf: Remove is_valid_bpf_tramp_flags() (Xu Kuohai)
  - bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number (Xu Kuohai)
  - bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset) (Xu Kuohai)
  - arm64, insn: Add ldr/str with immediate offset (Xu Kuohai)
  - bpf, arm64: Replace STACK_ALIGN() with round_up() to align stack size (Tiezhu Yang)
  - anolis: configs: enable EROFS compression (Gao Xiang)
  - erofs: fix 1 lcluster-sized pcluster for big pcluster (Gao Xiang)
  - erofs: enable big pcluster feature (Gao Xiang)
  - erofs: support decompress big pcluster for lz4 backend (Gao Xiang)
  - erofs: support parsing big pcluster compact indexes (Gao Xiang)
  - erofs: support parsing big pcluster compress indexes (Gao Xiang)
  - erofs: adjust per-CPU buffers according to max_pclusterblks (Gao Xiang)
  - erofs: add big physical cluster definition (Gao Xiang)
  - erofs: fix up inplace I/O pointer for big pcluster (Gao Xiang)
  - erofs: introduce physical cluster slab pools (Gao Xiang)
  - erofs: introduce multipage per-CPU buffers (Gao Xiang)
  - erofs: reserve physical_clusterbits[] (Gao Xiang)
  - erofs: Clean up spelling mistakes found in fs/erofs (Ruiqi Gong)
  - erofs: add on-disk compression configurations (Gao Xiang)
  - erofs: introduce on-disk lz4 fs configurations (Gao Xiang)
  - erofs: support adjust lz4 history window size (Huang Jianan)
  - erofs: complete a missing case for inplace I/O (Gao Xiang)
  - erofs: avoid memory allocation failure during rolling decompression (Huang Jianan)
  - erofs: force inplace I/O under low memory scenario (Gao Xiang)
  - erofs: simplify try_to_claim_pcluster() (Gao Xiang)
  - erofs: insert to managed cache after adding to pcl (Gao Xiang)
  - erofs: get rid of magical Z_EROFS_MAPPING_STAGING (Gao Xiang)
  - erofs: remove a void EROFS_VERSION macro set in Makefile (Vladimir Zapolskiy)
  - anolis: sched: Add monitoring indicators for group identity (Yihao Wu)
  - nvme-tcp: fence TCP socket on receive error (Chris Leech)
  - nvme-tcp: fix a possible UAF when failing to allocate an io queue (Sagi Grimberg)
  - nvme-tcp: fix possible circular locking when deleting a controller under memory pressure (Sagi Grimberg)
  - nvme-tcp: fix possible hang caused during ctrl deletion (Sagi Grimberg)
  - nvme-tcp: handle number of queue changes (Daniel Wagner)
  - nvme-tcp: fix regression that causes sporadic requests to time out (Sagi Grimberg)
  - nvme-tcp: fix UAF when detecting digest errors (Sagi Grimberg)
  - nvme-tcp: check if the queue is allocated before stopping it (Maurizio Lombardi)
  - nvme-tcp: fix memory leak when freeing a queue (Maurizio Lombardi)
  - nvme-tcp: Do not reset transport on data digest errors (Daniel Wagner)
  - nvme-tcp: pair send_mutex init with destroy (Keith Busch)
  - nvme-tcp: fix error codes in nvme_tcp_setup_ctrl() (Dan Carpenter)
  - nvme-tcp: check sgl supported by target (Max Gurtovoy)
  - nvme-tcp: fix crash triggered with a dataless request submission (Sagi Grimberg)
  - nvme-tcp: fix wrong setting of request iov_iter (Sagi Grimberg)
  - anolis: spec: extends DIST_OFFICIAL_BUILD to DIST_BUILD_MODE (Qiao Ma)
  - anolis: KVM: SVM: Export MSR_AMD64_SEV_ES_GHCB to userspace for CSV2 guest (hanliyang)
  - anolis: KVM: x86: Restore control registers in __set_sregs() to support CSV2 guest live migration (hanliyang)
  - anolis: KVM: SVM: Keep track EFER even though the VM is CSV2 guest (hanliyang)
  - anolis: KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_VMSA command (hanliyang)
  - anolis: KVM: SVM: Add KVM_SEV_SEND_UPDATE_VMSA command (hanliyang)
  - anolis: x86/cpufeatures: Add CSV3 CPU feature (hanliyang)
  - anolis: x86/cpufeatures: Add CPUID_8C86_0000_EDX CPUID leaf (hanliyang)
  - anolis: x86/csv2: Keep in atomic context when holding ghcb page if the #VC comes from userspace (hanliyang)
  - anolis: crypto: ccp: Implement CSV_DOWNLOAD_FIRMWARE ioctl command (hanliyang)
  - anolis: crypto: ccp: Implement CSV_PLATFORM_SHUTDOWN ioctl command (hanliyang)
  - anolis: crypto: ccp: Implement CSV_PLATFORM_INIT ioctl command (hanliyang)
  - anolis: crypto: ccp: Support DOWNLOAD_FIRMWARE when detect CSV (hanliyang)
  - anolis: configs: adjust some crypto related configs (Qiao Ma)
  - anolis: configs: adjust block related configs (Qiao Ma)
  - anolis: configs: disable CONFIG_SLAB_MERGE_DEFAULT (Qiao Ma)
  - anolis: configs: disable CONFIG_CAN (Qiao Ma)
  - anolis: configs: align net/ieee802154 related config with x86 (Qiao Ma)
  - anolis: configs: enable CONFIG_6LOWPAN for arm64 (Qiao Ma)
  - anolis: configs: align net/mac80211 configs with x86 (Qiao Ma)
  - anolis: configs: align arm64 wireless related configs with x86 (Qiao Ma)
  - anolis: kconfig: only include loongarch platform drivers for LOONGARCH (Qiao Ma)
  - anolis: arm64: kfence: allow allocating kfence pool after system boot stage (Kaihao Bai)
  - Revert "anolis: arm64: always allocate kfence area to avoid splitting linear mapping" (Kaihao Bai)
  - anolis: arm64: fix judgement of pte valid (Kaihao Bai)
  - anolis: arm64: add switch of command line to control split mapping (Kaihao Bai)
  - anolis: arm64: avoid speculative access after memory failure (Kaihao Bai)
  - anolis: arm64: add the helper to set no-present page table (Kaihao Bai)
  - anolis: arm64: support splitting the dynamic allocation range of kfence (Kaihao Bai)
  - anolis: arm64: support splitting page table of rodata_full enabled (Kaihao Bai)
  - anolis: arm64: support splitting the block mapping kernel page table (Kaihao Bai)
  - anolis: arm64: add page table entry tlb flush helper (Kaihao Bai)
  - anolis: arm64: reposition function and flags and make them visible (Kaihao Bai)
  - anolis: mm: duptext: refresh duptext for unstable pages (Xu Yu)
  - anolis: mm: duptext: introduce duptext_nodes interface (Xu Yu)
  - anolis: mm: duptext: use hpage in __dup_page (Xu Yu)
  - anolis: selftests/bpf: add test for rich_container (Tianchen Ding)
  - anolis: libbpf: Add support for CGROUP_RICH_CONTAINER program type (Yi Tao)
  - anolis: bpf: Sync linux/bpf.h to tools (Yi Tao)
  - anolis: meminfo: Add meminfo support for bpf rich container (Yi Tao)
  - anolis: sysfs/cpu: Add online cpus support for bpf rich container (Yi Tao)
  - anolis: arm64: cpuinfo: Add cpuinfo support for bpf rich container (Yi Tao)
  - anolis: x86: cpuinfo: Add cpuinfo support for bpf rich container (Yi Tao)
  - anolis: bpf, cgroup: Introduce CGROUP_RICH_CONTAINER program type (Yi Tao)
  - xfs: use deferred frees for btree block freeing (Dave Chinner)
  - xfs: fix confusing xfs_extent_item variable names (Darrick J. Wong)
  - xfs: pass xfs_extent_free_item directly through the log intent code (Darrick J. Wong)
  - xfs: validate block number being freed before adding to xefi (Dave Chinner)
  - xfs: refactor data device extent validation (Darrick J. Wong)
  - xfs: remove unused parameter from refcount code (Darrick J. Wong)
  - xfs: reduce the size of struct xfs_extent_free_item (Darrick J. Wong)
  - xfs: fix agf/agfl verification on v4 filesystems (Dave Chinner)
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Darrick J. Wong)
  - xfs: create slab caches for frequently-used deferred items (Darrick J. Wong)
  - xfs: rename _zone variables to _cache (Darrick J. Wong)
  - xfs: remove kmem_zone typedef (Darrick J. Wong)
  - xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes (Darrick J. Wong)
  - anolis: Loongarch: synchronize vector extensions support upstream (Juxin Gao)
  - anolis: Loongarch: Fix modpost warning when build (Juxin Gao)
  - anolis: LoongArch: fix CONFIG_TRACE_IRQFLAGS_SUPPORT not defined (Yingkun Meng)
  - anolis: LoongArch: fix CONFIG_ZONE_DMA32 not defined (Hongchen Zhang)
  - anolis: LoongArch: fix percpu area not allocated as expected (Hongchen Zhang)
  - anolis: irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. (Chong Qiao)
  - anolis: ipmi_si: ls2k500 kcs driver add wait bmc reboot done and rebind support. (Chong Qiao)
  - PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown (Huacai Chen)
  - anolis: Revert "PCI: Add quirk for LS7A to avoid reboot failure" (Juxin Gao)
  - anolis: LoongArch: defconfig: Enable a large number of configurations (Juxin Gao)
  - anolis: LoongArch: fix ls2k500 bmc not work when installing iso (Chong Qiao)
  - anolis: pci: irq: Add early_param pci_irq_limit to limit pci irq numbers (Juxin Gao)
  - anolis: LoongArch: kdump: Add high memory reservation (Youling Tang)
  - anolis: LoongArch: defconfig: enable CONFIG_FB_LS2K500=m. (Chong Qiao)
  - anolis: ipmi: add ls2k500 bmc ipmi support. (Chong Qiao)
  - anolis: fbdev: add ls2k500sfb driver for ls2k500 bmc. (Chong Qiao)
  - anolis: LoongArch: fix __ffs not defined compile error (Hongchen Zhang)
  - anolis: LoongArch: defconfig: Add PCI hotplug support (yangyinglu)
  - anolis: LoongArch: defconfig: Add memory hotplug support (yangyinglu)
  - anolis: LoongArch: LSVZ: Support PV IPI to reduce VM exit (Juxin Gao)
  - anolis: spec: add make help messages (Qiao Ma)
  - anolis: spec: add function to build rpm package (Qiao Ma)
  - anolis: spec: intree kernel build related files (Qiao Ma)
  - anolis: spec: add function to generate kernel.spec (Qiao Ma)
  - anolis: spec: add script to generate kernel changelogs (Qiao Ma)
  - anolis: spec: prepare for making kernel.spec intree (Qiao Ma)
  - selftests: add selftests for cachestat (Nhat Pham)
  - cachestat: wire up cachestat for other architectures (Nhat Pham)
  - cachestat: implement cachestat syscall (Nhat Pham)
  - workingset: refactor LRU refault to expose refault recency check (Nhat Pham)
  - workingset: fix confusion around eviction vs refault container (Johannes Weiner)
  - coresight: tmc: Explicit type conversions to prevent integer overflow (Ruidong Tian)
  - coresight: cti: Remove atomic type from enable_req_count (James Clark)
  - coresight: cti: Add PM runtime call in enable_store (Mao Jinlong)
  - coresight: cti: Prevent negative values of enable count (James Clark)
  - coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR (Junhao He)
  - coresight: perf: Release Coresight path when alloc trace id failed (Ruidong Tian)
  - coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() (Dan Carpenter)
  - coresight: etm_pmu: Set the module field (Suzuki K Poulose)
  - coresight: etm4x: Do not access TRCIDR1 for identification (Suzuki K Poulose)
  - coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug (Steve Clevenger)
  - coresight: tmc: Don't enable TMC when it's not ready. (Yabin Cui)
  - coresight: perf: Output trace id only once (Suzuki K Poulose)
  - coresight: Fix uninitialised variable use in coresight_disable (Suzuki K Poulose)
  - coresight: core: Use IDR for non-cpu bound sources' paths. (Mao Jinlong)
  - anolis: perf: ignore exited thread when synthesize thread map (Cruz Zhao)
  - coresight: trace-id: Add debug & test macros to Trace ID allocation (Mike Leach)
  - coresight: events: PERF_RECORD_AUX_OUTPUT_HW_ID used for Trace ID (Mike Leach)
  - coresight: trace id: Remove legacy get trace ID function. (Mike Leach)
  - coresight: etmX.X: stm: Remove trace_id() callback (Mike Leach)
  - coresight: etm3x: Update ETM3 driver to use Trace ID API (Mike Leach)
  - coresight: etm4x: Update ETM4 driver to use Trace ID API (Mike Leach)
  - coresight: stm: Update STM driver to use Trace ID API (Mike Leach)
  - coresight: perf: traceid: Add perf ID allocation and notifiers (Mike Leach)
  - coresight: Remove obsolete Trace ID unniqueness checks (Mike Leach)
  - coresight: trace-id: Add API to dynamically assign Trace ID values (Mike Leach)
  - anolis: mm: Readd DMA page copy support for page migration (Shawn Wang)
  - anolis: mm: Add a new dma_migrate_mode parameter for dma_migrate_pages_copy() (Shawn Wang)
  - mm,unmap: avoid flushing TLB in batch if PTE is inaccessible (Huang Ying)
  - migrate_pages: try migrate in batch asynchronously firstly (Huang Ying)
  - migrate_pages: move split folios processing out of migrate_pages_batch() (Huang Ying)
  - migrate_pages: fix deadlock in batched migration (Huang Ying)
  - migrate_pages: move THP/hugetlb migration support check to simplify code (Huang Ying)
  - migrate_pages: batch flushing TLB (Huang Ying)
  - migrate_pages: share more code between _unmap and _move (Huang Ying)
  - migrate_pages: move migrate_folio_unmap() (Huang Ying)
  - migrate_pages: batch _unmap and _move (Huang Ying)
  - migrate_pages: split unmap_and_move() to _unmap() and _move() (Huang Ying)
  - migrate_pages: restrict number of pages to migrate in batch (Huang Ying)
  - migrate_pages: separate hugetlb folios migration (Huang Ying)
  - migrate_pages: organize stats with struct migrate_pages_stats (Huang Ying)
  - mm: migrate: fix return value if all subpages of THPs are migrated successfully (Baolin Wang)
  - mm: migrate: do not retry 10 times for the subpages of fail-to-migrate THP (Baolin Wang)
  - migrate_pages(): fix failure counting for retry (Huang Ying)
  - migrate_pages(): fix failure counting for THP splitting (Huang Ying)
  - migrate_pages(): fix failure counting for THP on -ENOSYS (Huang Ying)
  - migrate_pages(): fix failure counting for THP subpages retrying (Huang Ying)
  - migrate_pages(): fix THP failure counting for -ENOMEM (Huang Ying)
  - migrate_pages(): remove unnecessary list_safe_reset_next() (Huang Ying)
  - migrate: fix syscall move_pages() return value for failure (Huang Ying)
  - mm/migration: remove some duplicated codes in migrate_pages (Miaohe Lin)
  - mm/migration: fix potential page refcounts leak in migrate_pages (Miaohe Lin)
  - mm: compaction: fix the migration stats in trace_mm_compaction_migratepages() (Baolin Wang)
  - mm: migrate: correct the hugetlb migration stats (Baolin Wang)
  - mm: migrate: fix the return value of migrate_pages() (Baolin Wang)
  - mm/migrate: enable returning precise migrate_pages() success count (Yang Shi)
  - anolis: Revert "mm: migrate: introduce batch page migration" (Shawn Wang)
  - anolis: Revert "mm: migrate: batch flushing TLB" (Shawn Wang)
  - anolis: Revert "mm: migrate: batch copying pages" (Shawn Wang)
  - anolis: Revert "anolis: mm: migrate: add interface to enable batch migration" (Shawn Wang)
  - anolis: mm: Remove DMA pages copy support for page migration (Shawn Wang)
  - anolis: Revert "mm: migrate: continue to migrate for non-hugetlb pages" (Shawn Wang)
  - anolis: Revert "mm: migrate: fix potential deadlock in migrate_page_unmap" (Shawn Wang)
  - anolis: Revert "mm: migrate: do not assume that newpage->lru is unchanged" (Shawn Wang)
  - anolis: configs: Enable sssraid module (Guixin Liu)
  - anolis: LoongArch: Fix kdump failure on v40 interface specification (Youling Tang)
  - anolis: LoongArch: configs: Enable kexec/kdump (Youling Tang)
  - LoongArch: kdump: Add crashkernel=YM handling (Youling Tang)
  - LoongArch: kdump: Add single kernel image implementation (Youling Tang)
  - LoongArch: Add support for kernel address space layout randomization (KASLR) (Youling Tang)
  - LoongArch: Add support for kernel relocation (Youling Tang)
  - LoongArch: Add la_abs macro implementation (Juxin Gao)
  - LoongArch: Add JUMP_VIRT_ADDR macro implementation to avoid using la.abs (Youling Tang)
  - LoongArch: Use la.pcrel instead of la.abs when it's trivially possible (Youling Tang)
  - anolis: LoongArch: efistub: Modify the address where efistub jumps to the main kernel (Youling Tang)
  - anolis: LoongArch: kdump: Add memory reservation for old kernel (Youling Tang)
  - anolis: LoongArch: Integrate initrd operation (Juxin Gao)
  - anolis: LoongArch: kexec: Add compatibility with old interfaces (Youling Tang)
  - LoongArch: Flush TLB earlier at initialization (Youling Tang)
  - LoongArch: Add kdump support (Youling Tang)
  - LoongArch: Add kexec support (Youling Tang)
  - anolis: LoongArch: defconfig: enable CONFIG_CACHEFILES (Hongchen Zhang)
  - anolis: i2c: loongson: fix irq not freed when remove module (Hongchen Zhang)
  - LoongArch: Set _PAGE_DIRTY only if _PAGE_MODIFIED is set in {pmd,pte}_mkwrite() (Huacai Chen)
  - LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty() (Huacai Chen)
  - LoongArch: Clear FPU/SIMD thread info flags for kernel thread (Huacai Chen)
  - anolis: LoongArch: Remove generic irq migration (Jianmin Lv)
  - anolis: LoongArch: Fix secondary bridge routing errors (liuyun)
  - anolis: net: stmmac: fix potential double free of dma descriptor resources (Hongchen Zhang)
  - anolis: kabi: Reserve some space for kABI stability (Guixin Liu)
  - anolis: configs: enable CONFIG_LRU_GEN (Kaihao Bai)
  - anolis: mm: fix the symbol lookup error of coldpgs (Kaihao Bai)
  - anolis: mm: kidled: calculate pageflags usage with KIDLED_AGE_WIDTH (Xu Yu)
  - anolis: mm: limit use confliction between kidled/coldpgs and mglru (Kaihao Bai)
  - mm: Multi-gen LRU: remove wait_event_killable() (Kalesh Singh)
  - Multi-gen LRU: fix workingset accounting (Kalesh Singh)
  - mm: multi-gen LRU: fix crash during cgroup migration (Yu Zhao)
  - mm: multi-gen LRU: retry folios written back while isolated (Yu Zhao)
  - mm: multi-gen LRU: move lru_gen_add_mm() out of IRQ-off region (Sebastian Andrzej Siewior)
  - mm/mglru: don't sync disk for each aging cycle (Yu Zhao)
  - mm: multi-gen LRU: design doc (Yu Zhao)
  - mm: multi-gen LRU: admin guide (Yu Zhao)
  - mm: multi-gen LRU: debugfs interface (Yu Zhao)
  - mm: multi-gen LRU: thrashing prevention (Yu Zhao)
  - mm: multi-gen LRU: kill switch (Yu Zhao)
  - mm: multi-gen LRU: optimize multiple memcgs (Yu Zhao)
  - mm: multi-gen LRU: support page table walks (Yu Zhao)
  - mm: multi-gen LRU: exploit locality in rmap (Yu Zhao)
  - mm: multi-gen LRU: minimal implementation (Yu Zhao)
  - mm: multi-gen LRU: groundwork (Yu Zhao)
  - asm-generic/atomic: Add try_cmpxchg() fallbacks (Peter Zijlstra)
  - mm/vmscan.c: refactor shrink_node() (Yu Zhao)
  - mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG (Yu Zhao)
  - mm: x86, arm64: add arch_has_hw_pte_young() (Yu Zhao)
  - mm: VM_BUG_ON lru page flags (Yu Zhao)
  - mm: add __clear_page_lru_flags() to replace page_off_lru() (Yu Zhao)
  - mm/swap.c: don't pass "enum lru_list" to del_page_from_lru_list() (Yu Zhao)
  - mm/swap.c: don't pass "enum lru_list" to trace_mm_lru_insertion() (Yu Zhao)
  - mm: don't pass "enum lru_list" to lru list addition functions (Yu Zhao)
  - include/linux/mm_inline.h: shuffle lru list addition and deletion functions (Yu Zhao)
  - mm/vmscan.c: use add_page_to_lru_list() (Yu Zhao)
  - anolis: x86: adjust the configuration of NR_CPUS (Kaihao Bai)
  - anolis: efi: cper: add ARM64 dependence for YITIAN_CPER_RAWDATA (Shuai Xue)
  - anolis: KVM: SVM: Fix the available ASID range for CSV2 guest (hanliyang)
  - KVM, SEV: Add KVM_EXIT_SHUTDOWN metadata for SEV-ES (Peter Gonda)
  - KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors (Sean Christopherson)
  - KVM: SVM: Do not terminate SEV-ES guests on GHCB validation failure (Tom Lendacky)
  - KVM: SEV: Fall back to vmalloc for SEV-ES scratch area if necessary (Sean Christopherson)
  - KVM: SEV: Return appropriate error codes if SEV-ES scratch setup fails (Sean Christopherson)
  - anolis: kfence: recover kfence_node_map if flush list fail (Tianchen Ding)
  - anolis: kfence: do not re-enable kfence if no areas (Tianchen Ding)
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (Pablo Neira Ayuso) {CVE-2023-4147}
  - netfilter: nft_set_pipapo: fix improper element removal (Florian Westphal) {CVE-2023-4004}
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng) {CVE-2023-3090}
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones) {CVE-2023-3609}
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) {CVE-2023-3611}
  - net/sched: sch_qfq: refactor parsing of netlink parameters (Pedro Tammela) {CVE-2023-3611}
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu) {CVE-2023-3111}
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik) {CVE-2023-3111}
  - anolis: configs: Enable CRYPTO_OFB for fips mode (Tianjia Zhang)
  - gfs2: Don't deref jdesc in evict (Bob Peterson) {CVE-2023-3212}
  - dma-direct: always leak memory that can't be re-encrypted (Christoph Hellwig)
  - dma-direct: factor out dma_set_{de,en}crypted helpers (Christoph Hellwig)
  - usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup (Johan Hovold)
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)
  - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling (Dmitry Osipenko)
  - SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers (Steven Song)
  - crypto: ccp - Add SEV_INIT rc error logging on init (Peter Gonda)
  - KVM: SVM: Zero out the VMCB array used to track SEV ASID association (Sean Christopherson)
  - KVM: SEV: Add cond_resched() to loop in sev_clflush_pages() (Peter Gonda)
  - KVM: SVM: Inject #UD on attempted emulation for SEV guest w/o insn buffer (Sean Christopherson)
  - KVM: SVM: WARN if KVM attempts emulation on #UD or #GP for SEV guests (Sean Christopherson)
  - KVM: x86: Pass emulation type to can_emulate_instruction() (Sean Christopherson)
  - KVM: SVM: Explicitly require DECODEASSISTS to enable SEV support (Sean Christopherson)
  - KVM: SVM: Don't intercept #GP for SEV guests (Sean Christopherson)
  - KVM: SVM: Skip SEV cache flush if no ASIDs have been used (Sean Christopherson)
  - KVM: SVM: Remove an unnecessary prototype declaration of sev_flush_asids() (Sean Christopherson)
  - KVM: SVM: Free sev_asid_bitmap during init if SEV setup fails (Sean Christopherson)
  - anolis: configs: adjust CONFIG_CMA_AREAS for arm64 (Qiao Ma)
  - anolis: configs: enable CONFIG_CMA for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_CRC4 for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_SECURITY_SMACK for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_IP_DCCP for x86 (Qiao Ma)
  - anolis: config: disable CONFIG_IP6_NF_TARGET_HL for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_IP_NF_TARGET_CLUSTERIP for x86 (Qiao Ma)
  - configs: enable CONFIG_ZONE_DEVICE for arm64 (Qiao Ma)
  - Loongarch: Fixed finding zero address exception vector table error (Juxin Gao)
  - KVM: x86: Don't WARN if userspace mucks with RCX during string I/O exit (Sean Christopherson)
  - KVM: SEV-ES: fix another issue with string I/O VMGEXITs (Paolo Bonzini)
  - KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed (Paolo Bonzini)
  - KVM: SEV-ES: keep INS functions together (Paolo Bonzini)
  - KVM: x86: remove unnecessary arguments from complete_emulator_pio_in (Paolo Bonzini)
  - KVM: x86: split the two parts of emulator_pio_in (Paolo Bonzini)
  - KVM: SEV-ES: clean up kvm_sev_es_ins/outs (Paolo Bonzini)
  - KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out (Paolo Bonzini)
  - KVM: SEV-ES: rename guest_ins_data to sev_pio_data (Paolo Bonzini)
  - KVM: SEV-ES: reduce ghcb_sa_len to 32 bits (Paolo Bonzini)
  - KVM: SEV-ES: fix length of string I/O (Paolo Bonzini)
  - netfilter: nf_tables: fix chain binding transaction logic (Pablo Neira Ayuso) {CVE-2023-3610}
  - anolis: Loongarch: Fix a large of build error. (Juxin Gao)
  - LoongArch: Support dbar with different hints (Juxin Gao)
  - bpf: add missing header file include (Juxin Gao)
  - anolis: KVM: SVM: Print Hygon CSV support info if support is detected (hanliyang)
  - anolis: crypto: ccp: Print Hygon CSV API version when CSV support is detected (hanliyang)
  - anolis: x86/cpu: Detect memory encryption features on Hygon CPUs (hanliyang)
  - kallsyms: increase maximum kernel symbol length to 512 (Miguel Ojeda)
  - kallsyms: support "big" kernel symbols (Miguel Ojeda)
  - kallsyms: add static relationship between `KSYM_NAME_LEN{,_BUFFER}` (Miguel Ojeda)
  - kallsyms: avoid hardcoding buffer size (Boqun Feng)
  - kallsyms: use `ARRAY_SIZE` instead of hardcoded size (Boqun Feng)
  - anolis: erofs: fix EROFS completely broken due to RAFS v6 support (Gao Xiang)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)
  - anolis: LoongArch: Fix compile warning about ACPI_VIDEO (Juxin Gao)
  - PCI/ACPI: Guard ARM64-specific mcfg_quirks (Juxin Gao)
  - anolis: LoongArch: Fix compile error because missing __init (Juxin Gao)
  - mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t * (Juxin Gao)
  - anolis: usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 (Hongchen Zhang)
  - anolis: drm/loongson: fix compile warnning (Sui Jingfeng)
  - anolis: drm/loongson: using hdmi hot plug status register (Juxin Gao)
  - anolis: irqchip/loongson: Fix syscore ops registration (Jianmin Lv)
  - anolis: irqchip/loongarch: Fix some issues of irq controllers (Jianmin Lv)
  - anolis: LoongArch: Initialize screen_info variable (Juxin Gao)
  - anolis: LoongArch: Fixed EIOINTC structure members (yangqiming)
  - anolis: LoongArch: Fix virtual machine startup error (Juxin Gao)
  - anolis: loongarch/kvm: ls7a add iocsrw emulation (Juxin Gao)
  - anolis: LoongArch: defconfig: update network configurations (Juxin Gao)
  - anolis: LoongArch: fix signal handler name changed (Hongchen Zhang)
  - anolis: fix compile error introduced by LoongArch commit (Juxin Gao)
  - anolis: LoongArch: pci root bridige set acpi companion only when not acpi_disabled. (Tianli Xiong)
  - anolis: pci: fix X server auto probe fail when both ast and etnaviv drm present (suijingfeng)
  - anolis: LS7A2000: PCIE: Fixup GPU card error (Juxin Gao)
  - anolis: net: ngbe: fix vxlan is not working (DuanqiangWen)
  - KVM: SVM: Move GHCB unmapping to fix RCU warning (Tom Lendacky)
  - KVM: SVM: Make sure GHCB is mapped before updating (Tom Lendacky)
  - KVM: SEV-ES: Set guest_state_protected after VMSA update (Peter Gonda)
  - KVM: SEV: Acquire vcpu mutex when updating VMSA (Peter Gonda)
  - KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs (Sean Christopherson)
  - KVM: x86: Always set kvm_run->if_flag (Marc Orr)
  - KVM: x86: Assume a 64-bit hypercall for guests with protected state (Tom Lendacky)
  - KVM: X86: Fix failure to boost kernel lock holder candidate in SEV-ES guests (Wanpeng Li)
  - KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs (Mingwei Zhang)
  - KVM: SVM: Simplify and harden helper to flush SEV guest page(s) (Sean Christopherson)
  - KVM: SEV: WARN if SEV-ES is marked active but SEV is not (Sean Christopherson)
  - KVM: SVM: Do not set sev->es_active until KVM_SEV_ES_INIT completes (Sean Christopherson)
  - x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses (Joerg Roedel)
  - x86/sev: Remove duplicated assignment to variable info (Colin Ian King)
  - x86/sev: Mark the code returning to user space as syscall gap (Lai Jiangshan)
  - x86/sev-es: Replace open-coded hlt-loop with sev_es_terminate() (Peter Gonda)
  - x86/sev: Allow #VC exceptions on the VC2 stack (Joerg Roedel)
  - x86/sev: Carve out HV call's return value verification (Borislav Petkov)
  - x86/sev: Propagate #GP if getting linear instruction address failed (Joerg Roedel)
  - x86/insn: Extend error reporting from insn_fetch_from_user[_inatomic]() (Joerg Roedel)
  - x86/insn-eval: Make 0 a valid RIP for insn_get_effective_ip() (Joerg Roedel)
  - x86/sev: Fix error message in runtime #VC handler (Joerg Roedel)
  - x86/sev: Move GHCB MSR protocol and NAE definitions in a common header (Brijesh Singh)
  - x86/sev: Use "SEV: " prefix for messages from sev.c (Joerg Roedel)
  - x86/sev-es: Rename sev-es.{ch} to sev.{ch} (Brijesh Singh)
  - x86/sev: Drop redundant and potentially misleading 'sev_enabled' (Sean Christopherson)
  - x86/sev-es: Optimize __sev_es_ist_enter() for better readability (Joerg Roedel)
  - x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate() (Joerg Roedel)
  - x86/boot/compressed/64: Cleanup exception handling before booting kernel (Joerg Roedel)
  - x86/sev-es: Split vc_decode_insn() (Borislav Petkov)
  - x86/sev-es: Remove subtraction of res variable (Borislav Petkov)
  - x86/efi: Restore Firmware IDT before calling ExitBootServices() (Joerg Roedel)
  - x86/boot/compressed/64: Add CPUID sanity check to 32-bit boot-path (Joerg Roedel)
  - x86/boot/compressed/64: Add 32-bit boot #VC handler (Joerg Roedel)
  - x86/boot/compressed/64: Setup IDT in startup_32 boot path (Joerg Roedel)
  - x86/boot/compressed/64: Reload CS in startup_32 (Joerg Roedel)
  - anolis: mm: coldpgs: batch free unref pages (Huang Haowei)
  - anolis: mm: coldpgs: relax in reclaim_coldpgs_read_stats (Huang Haowei)
  - anolis: arm_mpam: Fix schemata's display error of MB when CDP is enabled (Shawn Wang)
  - anolis: LoongArch: kvm: KVM support for 5.10 (Bibo Mao)
  - anolis: LoongArch: kvm: add initial kvm support (yangyinglu)
  - anolis: pci/quirks: ls7a2000: fix pm transition of devices under pcie port (yangyinglu)
  - anolis: LoongArch: Fixed some pcie card not scanning properly (yangyinglu)
  - anolis: pci: fix kabi error caused by pm_suspend_target_state (yangyinglu)
  - anolis: PCI: PM: Fix pcie mrrs restoring (yangyinglu)
  - anolis: PCI: Check if the pci controller can use both CFG0 and CFG1 mode to access configuration space (yangyinglu)
  - anolis: PCI: Check if entry->offset already exist for mem resource (yangyinglu)
  - LoongArch: Export symbol for function smp_send_reschedule() (yangyinglu)
  - anolis: LoongArch: fix compile error when using make allmodconfig (yangyinglu)
  - anolis: LoongArch: remove __ARCH_WANT_NEW_STAT (yangyinglu)
  - anolis: LoongArch: modify defconfig according to other architectures (yangyinglu)
  - anolis: LoongArch: Change definition of cpu_relax() (yangyinglu)
  - anolis: drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000 (yangyinglu)
  - LoongArch: Use alternative to optimize libraries (yangyinglu)
  - LoongArch: Add alternative runtime patching mechanism (yangyinglu)
  - LoongArch: Remove the .fixup section usage (yangyinglu)
  - LoongArch: extable: Add a dedicated uaccess handler (yangyinglu)
  - LoongArch: extable: Add `type` and `data` (yangyinglu)
  - LoongArch: Switch to relative exception (yangyinglu)
  - LoongArch: Consolidate __ex_table construction (yangyinglu)
  - anolis: vfio:mdev:idxd: fix kernel warning after idxd mdev re-created (Fengqian Gao)
  - anolis: config: correct arm64 configs (Qiao Ma)
  - anolis: efi: do not enable CONFIG_EFI_ZBOOT for arm64 (Qiao Ma)
  - anolis: configs: refresh anolis configs for x86 (Qiao Ma)
  - anolis: mm: limit min_cache_kbytes (Xu Yu)
  - anolis: mm: make min_cache_kbytes behave explicitly (Xu Yu)
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition (Zheng Wang)
  - anolis: crypto: ccp: Fix definition of struct sev_data_send_update_vmsa (hanliyang)
  - anolis: LoongArch: fix SECCOMP test error (Hongchen Zhang)
  - anolis: LoongArch: fix vmlinux ld error (Hongchen Zhang)
  - anolis: LoongArch: enable hugetlbfs support (Hongchen Zhang)
  - anolis: LoongArch: save one instruction for arch_local_irq_{enable,disable} (Hongchen Zhang)
  - anolis: LoongArch: optimize for syscall return (Hongchen Zhang)
  - anolis: LoongArch: refresh usage of sync (Bibo Mao)
  - anolis: LoongArch: use 40 bits address space for user (Hongchen Zhang)
  - anolis: LoongArch: Support loader and kernel interface V40 (liweihao)
  - anolis: LoongArch: Enhance booting and resume compatibility (Jianmin Lv)
  - anolis: LoongArch: Remove redudant csr save/restore (Jun Yi)
  - anolis: LoongArch: Support Power Manager (liweihao)
  - anolis: irqchip/loongson-liointc: Set different isr for differnt core (Tianli Xiong)
  - anolis: platform: Support loongson laptop generic driver (liweihao)
  - anolis: LoongArch: Adapted SECTION_SIZE_BITS with page size (zhangtianyang)
  - anolis: ACPI: Support ACPI_MACHINE_WIDTH for 64 (liweihao)
  - anolis: spi: loongson: Add LS7A spi driver support (liweihao)
  - anolis: i2c: loongson: Add LS7A i2c driver support (liweihao)
  - anolis: LoongArch: Call irq_find_matching_fwnode get irq domain (liweihao)
  - anolis: irqchip/ACPI: Introduce ACPI_IRQ_MODEL_LPIC for LoongArch (Jianmin Lv)
  - anolis: gpio: loongson: Add 3A/3B/3C/7A gpio dirver support (liweihao)
  - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] (David Howells) {CVE-2023-2006}
  - kvm: x86: Add support for getting/setting expanded xstate buffer (Guang Zeng)
  - perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery table (Kan Liang)
  - perf/x86/uncore: Add a quirk for UPI on SPR (Kan Liang)
  - perf/x86/uncore: Ignore broken units in discovery table (Kan Liang)
  - perf/x86/uncore: Fix potential NULL pointer in uncore_get_alias_name (Kan Liang)
  - perf/x86/uncore: Factor out uncore_device_to_die() (Kan Liang)
  - rtc: ls2x: Add support for the Loongson-2K/LS7A RTC (Ming Wang)
  - anolis: LoongArch: convert p v s cache to l1 l2 l3 format (Liu Peibao)
  - anolis: cpufreq: Add cpufreq driver for LoongArch (liuyun)
  - LoongArch: Fix section mismatch due to acpi_os_ioremap() (Huacai Chen)
  - LoongArch: Add vector extensions support (Ming Wang)
  - tools/perf: Add basic support for LoongArch (Ming Wang)
  - perf machine: Use path__join() to compose a path instead of snprintf(dir, '/', filename) (Ming Wang)
  - anolis: LoongArch: defconfig: Set CONFIG_TXGBE=m by default (Ming Wang)
  - anolis: LS7A2000 : Add quirk for OHCI device rev 0x02 (Ming Wang)
  - anolis: stmmac: pci: Add dwmac support for Loongson (Ming Wang)
  - anolis: LoongArch: hugepage table replace tlb (liuyun)
  - anolis: LoongArch: change global registers to local registers (Hongchen Zhang)
  - anolis: LoongArch: Old BPI compatibility (Juxin Gao)
  - anolis: LoongArch: add kernel setvirtmap for runtime (liuyun)
  - anolis: LoongArch: enable some netfilter related configs (Ming Wang)
  - anolis: LoongArch: defconfig: use make defconfig to save a clean defconfig (Ming Wang)
  - LoongArch: Support R_LARCH_GOT_PC_{LO12,HI20} in modules (Ming Wang)
  - LoongArch: Support PC-relative relocations in modules (Ming Wang)
  - LoongArch: Define ELF relocation types added in v2.00 ABI (Ming Wang)
  - LoongArch: Adjust symbol addressing for AS_HAS_EXPLICIT_RELOCS (Ming Wang)
  - LoongArch: Add Kconfig option AS_HAS_EXPLICIT_RELOCS (Ming Wang)
  - anolis: arm64: Add a cmdline parameter to adjust the cpufreq snapshot threshold (Shawn Wang)
  - anolis: KVM: SVM: Add RECEIVE_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH (fangbaoshun)
  - anolis: KVM: SVM: Add SEND_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH (fangbaoshun)
  - anolis: KVM: SVM: Prepare memory pool to allocate buffers for KVM_CSV_COMMAND_BATCH (fangbaoshun)
  - anolis: KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support for issue commands in CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support to switch to CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support for dequeue status in CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support for enqueue command pointers in CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Introduce init and free helpers to manage CSV RING_BUFFER queues (fangbaoshun)
  - EDAC/i10nm: Add Intel Emerald Rapids server support (Qiuxu Zhuo)
  - anolis: driver core: Support forcing probe drivers synchronously (Bitao Hu)
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai) {CVE-2023-31084}
  - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition (Zheng Wang)
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)
  - fbcon: Check font dimension limits (Samuel Thibault) {CVE-2023-3161}
  - media: rkvdec: fix use after free bug in rkvdec_remove (Zheng Wang)
  - sched/fair: Sanitize vruntime of entity being migrated (Vincent Guittot)
  - sched/fair: sanitize vruntime of entity being placed (Zhang Qiao)
  - perf build: Install libsymbol locally when building (Ian Rogers)
  - tool lib symbol: Add Makefile/Build (Ian Rogers)
  - anolis: configs: enable CONFIG_VFIO_MDEV_IDXD (Aubrey Li)
  - anolis: mm: hugetext: default enable (Rongwei Wang)
  - crypto: ccp - Fix whitespace in sev_cmd_buffer_len() (Peter Gonda)
  - KVM: SEV: Flush cache on non-coherent systems before RECEIVE_UPDATE_DATA (Masahiro Kozuka)
  - KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() (Peter Gonda)
  - KVM: SEV: Pin guest memory for write for RECEIVE_UPDATE_DATA (Sean Christopherson)
  - KVM: SVM: Fix sev_pin_memory() error checks in SEV migration utilities (Sean Christopherson)
  - KVM: SVM: fix missing sev_decommission in sev_receive_start (Mingwei Zhang)
  - KVM: SVM: Return -EFAULT if copy_to_user() for SEV mig packet header fails (Sean Christopherson)
  - KVM: SVM: Fix SEV SEND_START session length & SEND_UPDATE_DATA query length after commit 238eca821cee (Ashish Kalra)
  - KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command (Brijesh Singh)
  - KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command (Brijesh Singh)
  - KVM: SVM: Add support for KVM_SEV_RECEIVE_START command (Brijesh Singh)
  - KVM: SVM: Add support for KVM_SEV_SEND_CANCEL command (Steve Rutherford)
  - KVM: SVM: Add KVM_SEV_SEND_FINISH command (Brijesh Singh)
  - KVM: SVM: Add KVM_SEND_UPDATE_DATA command (Brijesh Singh)
  - KVM: SVM: Add KVM_SEV SEND_START command (Brijesh Singh)
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - anolis: xhci: Show Zhaoxin XHCI root hub speed correctly (leoliu-oc)
  - anolis: x86/mm: Print CSV info into the kernel log (hanliyang)
  - perf cs-etm: Add fix for coresight trace for any range of CPUs (Ganapatrao Kulkarni)
  - perf cs-etm: Handle PERF_RECORD_AUX_OUTPUT_HW_ID packet (Mike Leach)
  - perf cs-etm: Update record event to use new Trace ID protocol (Mike Leach)
  - perf cs-etm: Move mapping of Trace ID and cpu into helper function (Mike Leach)
  - perf cs-etm: Improve missing sink warning message (James Clark)
  - anolis: net/smc: fix hung state in inet sock (D. Wythe)
  - anolis: net/smc: avoid applications receiving clc msg (D. Wythe)
  - anolis: net/smc: Improve print and remove module params of reserve_mode (Wen Gu)
  - anolis: net/smc: validate rdma writable by rtoken_idx (Guangguan Wang)
  - anolis: net/smc: fix dup smc diag info (D. Wythe)
  - anolis: net/smc: Fix potential memory leaks and exceptions in inet (D. Wythe)
  - anolis: net/smc: fix ebpf panic (D. Wythe)
  - anolis: net/smc: fix bpf compile error (D. Wythe)
  - anolis: net/smc: fix potential reference count leak in smc (D. Wythe)
  - anolis: net/smc: protect connection state transitions in listen work (D. Wythe)
  - anolis: net/smc: optimize mutex_fback_rsn from mutex to spinlock (D. Wythe)
  - anolis: net/smc: refactor sock_flag/sock_set_flag (D. Wythe)
  - anolis: net/smc: add default name for smc negotiator (D. Wythe)
  - anolis: net/smc: do not check diff_cons when rmb_desc is null (Guangguan Wang)
  - anolis: net/smc: Expand the statistical range of ringbufs (Wen Gu)
  - anolis: net/smc: Expand the upper limit of SMCR/D ringbuf to 2MB (Wen Gu)
  - anolis: net/smc: Split wr_rx_buf into SMC_WR_BUF_CNT (Wen Gu)
  - anolis: net/smc: Adjust reserved-ports range and add warning print (Wen Gu)
  - anolis: net/smc: Fix fallback count overflow issue (Wen Gu)
  - anolis: net/smc: sock_hold in conns_lock protect area when smc_lgr_find_conn (Guangguan Wang)
  - anolis: net/smc: protect rdma_write processing from deleting rkey (Guangguan Wang)
  - anolis: net/smc: do not validate rkey by testing rkey value (Guangguan Wang)
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - anolis: Revert "anolis: io_uring: lift nice value of sqthread" (Ferry Meng)
  - anolis: Revert "selftest: kvm: Add amx selftest" (Guanjun)
  - anolis: arm64: enable CONFIG_KFENCE to solve memory corruption (Kaihao Bai)
  - anolis: arm64: always allocate kfence area to avoid splitting linear mapping (Kaihao Bai)
  - mm,kfence: decouple kfence from page granularity mapping judgement (Zhenhua Huang)
  - anolis: mm/lru: align lruvec lock to a cache line (Rongwei Wang)
  - anolis: i2c: i2c controller driver for Phytium platforms (Jiakun Shuai)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id (D. Wythe) {CVE-2023-31248}
  - cgroup: always put cset in cgroup_css_set_put_fork (John Sperbeck)
  - anolis: io_uring: remove redundant CONFIG_CGROUP_CPUACCT (Joseph Qi)
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - tipc: set con sock in tipc_conn_alloc (Xin Long) {CVE-2023-1382,CVE-2023-1382}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - irqchip/loongson-liointc: Fix an error handling path in liointc_init() (Christophe JAILLET)
  - irqchip/loongarch: Fix irq_domain_alloc_fwnode() abuse (Marc Zyngier)
  - irqchip/loongson-eiointc: Fix a build warning (Huacai Chen)
  - irqchip/loongson-eiointc: Fix irq affinity setting (Huacai Chen)
  - irqchip: Adjust Kconfig for Loongson (Huacai Chen)
  - anolis: PCI: Add quirk for LS7A to avoid reboot failure (Huacai Chen)
  - anolis: PCI: loongson: Improve the MRRS quirk for LS7A (Huacai Chen)
  - PCI: loongson: Work around LS7A incorrect Interrupt Pin registers (Jianmin Lv)
  - PCI: loongson: Don't access non-existent devices (Huacai Chen)
  - PCI: loongson: Add ACPI init support (Juxin Gao)
  - PCI: loongson: Use generic 8/16/32-bit config ops on LS2K/LS7A (Huacai Chen)
  - irqchip / ACPI: Introduce ACPI_IRQ_MODEL_LPIC for LoongArch (Jianmin Lv)
  - ACPI: irq: Allow acpi_gsi_to_irq() to have an arch-specific fallback (Marc Zyngier)
  - APCI: irq: Add support for multiple GSI domains (Juxin Gao)
  - anolis: drm/radeon: Workaround radeon driver bug for Loongson (Huacai Chen)
  - LoongArch: Add writecombine support for drm (Huacai Chen)
  - Input: i8042 - Add PNP checking hook for Loongson (Huacai Chen)
  - LoongArch: Add qspinlock support (Huacai Chen)
  - LoongArch: Add perf events support (Huacai Chen)
  - LoongArch: Add SysRq-x (TLB Dump) support (Huacai Chen)
  - LoongArch: Use TLB for ioremap() (Huacai Chen)
  - LoongArch: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP (Feiyang Chen)
  - LoongArch: Add sparse memory vmemmap support (Feiyang Chen)
  - MIPS&LoongArch&NIOS2: Adjust prototypes of p?d_init() (Feiyang Chen)
  - anolis: configs: enable CONFIG_BUG_ON_DATA_CORRUPTION for arm64 (Qiao Ma)
  - anolis: configs: enable some crypto related configs for arm64 (Qiao Ma)
  - anolis: configs: enable some net related configs for arm64 (Qiao Ma)
  - anolis: configs: support SMR zoned device on arm64 (Qiao Ma)
  - anolis: configs: enable IPV6_SUBTREES for arm64 (Qiao Ma)
  - anolis: configs: refresh configs for arm64 (Qiao Ma)
  - anolis: configs: set fq_codel as default qdisc type for x86 (Qiao Ma)
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)
  - anolis: Revert "anolis: xfs: account extra freespace btree splits for multiple allocations" (Gao Xiang)
  - anolis:driver/virt/coco: Add HYGON CSV Guest dirver. (fangbaoshun)
  - irqchip/loongson-pch-lpc: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-pch-pic: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-eiointc: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-htvec: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-htvec: Add ACPI init support (Huacai Chen)
  - net/mlx5: SF: Fix memory leak of work item (Shay Drory)
  - net/mlx5: SF, Correct vhca context size (Parav Pandit)
  - net/mlx5: SF_DEV, remove SF device on invalid state (Parav Pandit)
  - net/mlx5: SF, Fix error return code in mlx5_sf_dev_probe() (Wei Yongjun)
  - vdpa/mlx5: Use the correct dma device when registering memory (Eli Cohen)
  - vdpa/mlx5: Retrieve BAR address suitable any function (Eli Cohen)
  - net/mlx5: Don't skip subfunction cleanup in case of error in module init (Leon Romanovsky)
  - net/mlx5: Fix SF health recovery flow (Moshe Shemesh)
  - net/mlx5: Fix access to sf_dev_table on allocation failure (Shay Drory)
  - net/mlx5: SF, Drain health before removing device (Shay Drory)
  - net/mlx5: SF: Fix error flow of SFs allocation flow (Shay Drory)
  - net/mlx5: SF, do not use ecpu bit for vhca state processing (Parav Pandit)
  - net/mlx5: SF, Fix show state inactive when its inactivated (Parav Pandit)
  - net/mlx5: Avoid false positive lockdep warning by adding lock_class_key (Moshe Shemesh)
  - net/mlx5: Add devlink subfunction port documentation (Parav Pandit)
  - net/mlx5: SF, Port function state change support (Parav Pandit)
  - net/mlx5: SF, Add port add delete functionality (Parav Pandit)
  - net/mlx5: E-switch, Add eswitch helpers for SF vport (Parav Pandit)
  - net/mlx5: E-switch, Prepare eswitch to handle SF vport (Vu Pham)
  - net/mlx5: SF, Add auxiliary device driver (Parav Pandit)
  - net/mlx5: SF, Add auxiliary device support (Parav Pandit)
  - net/mlx5: Introduce vhca state event notifier (Parav Pandit)
  - net/mlx5: Update the hardware interface definition for vhca state (Parav Pandit)
  - net/mlx5: Register mlx5 devices to auxiliary virtual bus (Leon Romanovsky)
  - net/mlx5_core: Clean driver version and name (Leon Romanovsky)
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - devlink: Extend devlink port documentation for subfunctions (Parav Pandit)
  - devlink: Add devlink port documentation (Parav Pandit)
  - devlink: Support get and set state of port function (Parav Pandit)
  - devlink: Support add and delete devlink port (Parav Pandit)
  - devlink: Introduce PCI SF port flavour and port attribute (Parav Pandit)
  - devlink: Prepare code to fill multiple port function attributes (Parav Pandit)
  - ACPI / table: Print CORE_PIC information when MADT is parsed (Huacai Chen)
  - ACPICA: Events: Support fixed pcie wake event (Huacai Chen)
  - ACPICA: MADT: Add loongarch_arch-specific APICs support (Juxin Gao)
  - ACPI: Add LoongArch support for ACPI_PROCESSOR/ACPI_NUMA (Huacai Chen)
  - Revert "LoongArch: Provisionally add ACPICA data structures" (Huacai Chen)
  - loongarch: efi: enable generic EFI compressed boot (Ard Biesheuvel)
  - efi/libstub: implement generic EFI zboot (Juxin Gao)
  - efi/libstub: use EFI provided memcpy/memset routines (Juxin Gao)
  - efi/libstub: add some missing EFI prototypes (Ard Biesheuvel)
  - efi/loongarch: Add efistub booting support (Huacai Chen)
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - anolis: ata: sata_zhaoxin: Add support for Zhaoxin Serial ATA (leoliu-oc)
  - anolis: xhci: Add Zhaoxin xHCI LPM U1/U2 feature support (leoliu-oc)
  - anolis: xhci: fix issue with resume from system Sx state (leoliu-oc)
  - s390/smp: perform cpu reset before delegating work to target cpu (Heiko Carstens)
  - af_unix: Get user_ns from in_skb in unix_diag_get_exact(). (Kuniyuki Iwashima) {CVE-2023-28327}
  - netrom: Fix use-after-free caused by accept on already connected socket (Hyunwoo Kim) {CVE-2023-32269}
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Zheng Wang) {CVE-2023-2483}
  - sctp: leave the err path free in sctp_stream_init to sctp_stream_free (Xin Long) {CVE-2023-2177}
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (Zheng Wang) {CVE-2023-1859}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li) {CVE-2023-2002}
  - anolis: docs/kfence: update document for kfence.fault switch (Tianchen Ding)
  - anolis: kfence: add independent switch about panic (Tianchen Ding)
  - ovl: enable RCU'd ->get_acl() (Miklos Szeredi)
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs" (Jingbo Xu)
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()" (Jingbo Xu)
  - anolis: configs: enable CONFIG_IKCONFIG_PROC (Qiao Ma)
  - anolis: configs: refresh anolis configs (Qiao Ma)
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command (Fupan Li)
  - anolis: configs: enable TDX guest support by default (GuoRui.Yu)
  - anolis: drivers: arm64: add prefetch tuning sysctl interface by module mode (Feng Su)
  - irqchip: Select downstream irqchip drivers for LoongArch CPU (Huacai Chen)
  - LoongArch: Add subword xchg/cmpxchg emulation (Huacai Chen)
  - LoongArch: Cleanup headers to avoid circular dependency (Huacai Chen)
  - LoongArch: Cleanup reset routines with new API (Huacai Chen)
  - LoongArch: Fix build warnings in VDSO (Huacai Chen)
  - LoongArch: Select PCI_QUIRKS to avoid build error (Huacai Chen)
  - LoongArch: Update Loongson-3 default config file (Huacai Chen)
  - LoongArch: Add USER_STACKTRACE support (Qing Zhang)
  - LoongArch: Add STACKTRACE support (Qing Zhang)
  - LoongArch: Add prologue unwinder support (Qing Zhang)
  - LoongArch: Add guess unwinder support (Qing Zhang)
  - LoongArch: Add vDSO syscall __vdso_getcpu() (Huacai Chen)
  - LoongArch: Add PCI controller support (Huacai Chen)
  - LoongArch: Parse MADT to get multi-processor information (Huacai Chen)
  - LoongArch: Jump to the link address before enable PG (Huacai Chen)
  - LoongArch: Requires __force attributes for any casts (Qing Zhang)
  - LoongArch: Fix unsigned comparison with less than zero (Yang Li)
  - LoongArch: Adjust arch/loongarch/Kconfig (Huacai Chen)
  - UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK (Huacai Chen)
  - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() (Jann Horn) {CVE-2022-39188}
  - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() (Jann Horn) {CVE-2022-39188}
  - anolis: mm, thp: fix panic tr_get_hugepage() for thp reclaim (Ning Zhang)
  - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core (Miaoqian Lin) {CVE-2023-22995}
  - anolis: configs: split CONFIG_KVM into independent config file (Qiao Ma)
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Hangyu Hua) {CVE-2023-35788}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang) {CVE-2023-33288}
  - anolis: fuse: fix array-index-out-of-bounds in fuse_update_stats() (Jingbo Xu)
  - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 (Alessandro Astone) {CVE-2023-20938}
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco) {CVE-2023-0045}
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin) {CVE-2022-36280}
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen) {CVE-2023-2194}
  - USB: gadgetfs: Fix race between mounting and unmounting (Alan Stern) {CVE-2022-4382}
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang) {CVE-2023-1670}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang) {CVE-2023-1989}
  - android: binder: stop saving a pointer to the VMA (Liam R. Howlett) {CVE-2023-20928}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang) {CVE-2023-1855}
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim) {CVE-2022-41850}
  - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() (Nikita Zhandarovich)
  - clk: st: Fix memory leak in st_of_quadfs_setup() (Xiu Jianfeng)
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang) {CVE-2023-30772}
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) {CVE-2023-0458}
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang) {CVE-2023-1990}
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim) {CVE-2023-1829}
  - irqchip/loongson-pch-pic: Move find_pch_pic() into CONFIG_ACPI (Huacai Chen)
  - LoongArch: Fix wrong "ROM Size" of boardinfo (Tiezhu Yang)
  - LoongArch: Fix missing fcsr in ptrace's fpr_set (Qi Hu)
  - LoongArch: Fix shared cache size calculation (Huacai Chen)
  - LoongArch: Disable executable stack by default (Huacai Chen)
  - LoongArch: Remove unused variables (Bibo Mao)
  - LoongArch: Remove clock setting during cpu hotplug stage (Bibo Mao)
  - LoongArch: Remove useless header compiler.h (Jun Yi)
  - LoongArch: Remove several syntactic sugar macros for branches (WANG Xuerui)
  - LoongArch: Re-tab the assembly files (WANG Xuerui)
  - LoongArch: Simplify "BGT foo, zero" with BGTZ (WANG Xuerui)
  - LoongArch: Simplify "BLT foo, zero" with BLTZ (WANG Xuerui)
  - LoongArch: Simplify "BEQ/BNE foo, zero" with BEQZ/BNEZ (WANG Xuerui)
  - LoongArch: Use the "move" pseudo-instruction where applicable (WANG Xuerui)
  - LoongArch: Use the "jr" pseudo-instruction where applicable (WANG Xuerui)
  - LoongArch: Use ABI names of registers where appropriate (WANG Xuerui)
  - irqchip: Add LoongArch CPU interrupt controller support (Huacai Chen)
  - irqchip: Add Loongson Extended I/O interrupt controller support (Huacai Chen)
  - irqchip/loongson-liointc: Add ACPI init support (Huacai Chen)
  - irqchip/loongson-pch-msi: Add ACPI init support (Huacai Chen)
  - irqchip/loongson-pch-pic: Add ACPI init support (Huacai Chen)
  - irqchip: Add Loongson PCH LPC controller support (Huacai Chen)
  - LoongArch: Prepare to support multiple pch-pic and pch-msi irqdomain (Jianmin Lv)
  - ahci: Add a generic 'controller2' RAID id (Dan Williams)
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 6h (Pu Wen)
  - anolis: x86/amd_nb: Add support for Hygon family 18h model 6h (Pu Wen)
  - anolis: x86/cpu: Get CPU topology for Hygon family 18h model 6h (Pu Wen)
  - anolis: hwmon/k10temp: Add support for Hygon family 18h model 5h (Pu Wen)
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 5h (Pu Wen)
  - anolis: x86/amd_nb: Add support for Hygon family 18h model 5h (Pu Wen)
  - anolis: x86/cpu: Get CPU topology and LLC ID for Hygon family 18h model 5h (Pu Wen)
  - anolis: i2c-piix4: Remove the IMC detecting for Hygon SMBus (Pu Wen)
  - anolis: hwmon/k10temp: Add support for Hygon family 18h model 4h (Pu Wen)
  - anolis: EDAC/mce_amd: Use struct cpuinfo_x86.logical_die_id for Hygon NodeId (Pu Wen)
  - anolis: EDAC/amd64: Adjust address translation for Hygon family 18h model 4h (Pu Wen)
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 4h (Pu Wen)
  - anolis: EDAC/amd64: Get UMC channel from the 6th nibble for Hygon (Pu Wen)
  - anolis: iommu/hygon: Add support for Hygon family 18h model 4h IOAPIC (Pu Wen)
  - anolis: x86/amd_nb: Add northbridge support for Hygon family 18h model 4h (Pu Wen)
  - anolis: x86/amd_nb: Add Hygon family 18h model 4h PCI IDs (Pu Wen)
  - anolis: x86/microcode/hygon: Add microcode loading support for Hygon processors (Pu Wen)
  - anolis: x86/cpu/hygon: Modify the CPU topology deriving method for Hygon (Pu Wen)
  - x86/MCE/AMD: Use an u64 for bank_map (Muralidhara M K)
  - x86/cstate: Allow ACPI C1 FFH MWAIT use on Hygon systems (Pu Wen)
  - x86/topology: Set cpu_die_id only if DIE_TYPE found (Yazen Ghannam)
  - selftest: mptcp: exit from copyfd_io_poll() when receive SIGUSR1 (Menglong Dong)
  - selftests: mptcp: tune timeout and delay for simult_flows cases (Paolo Abeni)
  - NFSD: fix use-after-free in __nfs42_ssc_open() (Dai Ngo) {CVE-2022-4379}
  - spdxcheck.py: Fix a type error (zhujun2)
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei) {CVE-2023-26607}
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu) {CVE-2023-2985}
  - ovl: skip stale entries in merge dir cache iteration (Amir Goldstein)
  - anolis: bpf/selftests: fix compile error on bpf_smc (D. Wythe)
  - perf flamegraph: fix a undefined variable error (zhujun2)
  - netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (Pablo Neira Ayuso) {CVE-2022-42432}
  - rds: rds_rm_zerocopy_callback() use list_first_entry() (Pietro Borrello) {CVE-2023-1078}
  - anolis: RDMA/erdma: Add erdma to arm64 defconfig (Kai Shen)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16_rc2.an8]
changelog:
  - anolis: mm,compaction: Don't use ALLOC_CMA in long term gup path (yangge)
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local (Lin Ma) {CVE-2023-3863}
  - nfc: llcp: simplify llcp_sock_connect() error paths (Krzysztof Kozlowski) {CVE-2023-3863}
  - nfc: constify several pointers to u8, char and sk_buff (Krzysztof Kozlowski) {CVE-2023-3863}
  - mm: disable LRU pagevec during the migration temporarily (Minchan Kim)
  - clk: imx: Add check for kcalloc (Jiasheng Jiang) {CVE-2022-3114}
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng) {CVE-2023-31085}
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou) {CVE-2023-4132}
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou) {CVE-2023-4132}
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang) {CVE-2022-3424}
  - media: mceusb: Use new usb_control_msg_*() routines (Alan Stern) {CVE-2022-3903}
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Hyunwoo Kim) {CVE-2022-45887}
  - mm: remove lru_add_drain_all in alloc_contig_range (Minchan Kim)
  - mm, page_alloc: move draining pcplists to page isolation users (Vlastimil Babka)
  - anolis: KVM: flush the CPU caches only when guest memory is reclaimed (Xin Jiang)
  - arm64: Add AMPERE1 to the Spectre-BHB affected list (D Scott Phillips) {CVE-2023-3006}
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng) {CVE-2023-42754}
  - bpf, sockmap: fix deadlocks in the sockhash and sockmap (Xin Liu) {CVE-2023-0160}
  - mm/page_alloc: don't corrupt pcppage_migratetype (Doug Berger)
  - ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm (Zelin Deng)
  - anolis: mm/hugetlb: misusing spinlock API in isolate_huge_page() (Xin Jiang)
  - anolis: KVM: SEV: Pin SEV guest memory out of CMA area (Xin Jiang)
  - anolis: mm/gup: Use vzalloc to allocate vmas (yangge)
  - anolis: iommu/vt-d: fix alert message of PASID PT SRE checking for EMR (Fengqian Gao)
  - anolis: crypto: ccp: Fix PSP interrupt register's write race (fangbaoshun)
  - anolis: fix invisible experiment_syn_smc (D. Wythe)
  - anolis: net/smc: Add a module parameter to enable/disable loopback support (Wen Gu)
  - anolis: net/smc: Set SMC-R default buffer type to SMCR_MIXED_BUFS (Wen Gu)
  - net/smc: fix smc clc failed issue when netdevice not in init_net (Dust Li)
  - net/smc: Fix pos miscalculation in statistics (Nils Hoppmann)
  - anolis: net/smc: Fix hung issue in smc_cdc_wait_pend_tx_wr (Wen Gu)
  - anolis: net/smc: add rmb between peer_rmbe_space and local_rx_ctrl.cons read (Guangguan Wang)
  - anolis: net/smc: fix for concurrently cursor add and cursor copy (Guangguan Wang)
  - anolis: net/smc: do not print to dmesg when smc_tx_rdma_write but rmb invalid (Guangguan Wang)
  - anolis: net/smc: fix free slot leak when free slot got but lgr terminate (Guangguan Wang)
  - anolis: net/smc: wait for all rwwi tx wr complete before free link (Guangguan Wang)
  - anolis: net/smc: protect link down work from execute after lgr freed (Guangguan Wang)
  - anolis: net/smc: fix timeout in smc_inet_csk_wait_for_connect (D. Wythe)
  - anolis: net/smc: fix race on inet_sock between tcp-fin and final CDC (D. Wythe)
  - anolis: net/smc: fix sk_wq assigned (D. Wythe)
  - anolis: net/smc: fix imcomplete sock dump info (D. Wythe)
  - ext4: Properly sync file size update after O_SYNC direct IO (Jan Kara)
  - iomap: update ki_pos a little later in iomap_dio_complete (Christoph Hellwig)
  - ovl: remove privs in ovl_copyfile() (Amir Goldstein)
  - anolis: set CONFIG_IO_STRICT_DEVMEM to n by default (chench)
  - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Jingbo Xu)
  - anolis: erofs: fix -EIO when zero-length iovec encountered in rafsv6 (Jingbo Xu)
  - anolis: sched/core: fix warning when occ is zero when account sibidle (Cruz Zhao)
  - anolis: sched/core: remove unused variable of clear_all_cookie() (Cruz Zhao)
  - anolis: watchdog: enlarge watchdog_thresh limit (Cruz Zhao)
  - anolis: sched: fix the wrong config judge for __account_sibidle_time() (Cruz Zhao)
  - anolis: mm: kfence: avoid error caused by multiple assignment (Kaihao Bai)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16_rc2.1.an8]
changelog:
  - anolis: crypto - Revert "ccp: Fix sm2 test failed when insmod modules" (Tianjia Zhang)
  - perf/x86/uncore: Correct the number of CHAs on EMR (Kan Liang)
  - perf/x86/uncore: Correct the number of CHAs on SPR (Kan Liang)
  - perf/x86/intel: Fix pebs event constraints for SPR (Kan Liang)
  - anolis: perf/arm-cmn: Fix compatibility between Yitian CMN700 and CMN-ANY (Jing Zhang)
  - KVM: SEV: only access GHCB fields once (Paolo Bonzini) {CVE-2023-4155}
  - x86/cpu/amd: Add a Zenbleed fix (Borislav Petkov (AMD)) {CVE-2023-20593}
  - x86/bugs: Increase the x86 bugs vector size to two u32s (Borislav Petkov (AMD)) {CVE-2023-20569}
  - vc_screen: modify vcs_size() handling in vcs_read() (George Kennedy) {CVE-2023-3567}
  - vc_screen: don't clobber return value in vcs_read (Thomas Weißschuh) {CVE-2023-3567}
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (George Kennedy) {CVE-2023-3567}
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (Jiasheng Jiang) {CVE-2023-3358}
  - media: vivid: dev->bitmap_cap wasn't freed in all cases (Hans Verkuil) {CVE-2023-0615}
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO (Lee, Chun-Yi) {CVE-2023-31083}
  - iommu/vt-d: Fix kdump kernels boot failure with scalable mode (Lu Baolu)
  - anolis: mm: release hugetlb pages to buddy allocator after migrate them (yangge)
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Pablo Neira Ayuso) {CVE-2023-4015}
  - anolis: inspur-drm: Fix kernel panic (Bo Liu)
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng) {CVE-2023-42753}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) {CVE-2023-4623}
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) {CVE-2023-4921}
  - ipv6: sr: fix out-of-bounds read when setting HMAC data. (David Lebrun) {CVE-2023-2860}
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith) {CVE-2023-1206}
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) {CVE-2023-3772}
  - net/sched: Retire rsvp classifier (Jamal Hadi Salim) {CVE-2023-42755}
  - swap: stop add to avail list if swap is full (Ma Wupeng)
  - anolis: Revert "anolis: net/smc: Add SMC-R link WR and WC statistic" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Introduce smc_lgr_stats_list for trouble shooting" (Wen Gu)
  - anolis: Revert "anolis: net/smc: support SMC-R rwwi wr/wc statistic" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Fix fallback count overflow issue" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Expand the upper limit of SMCR/D ringbuf to 2MB" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Expand the statistical range of ringbufs" (Wen Gu)
  - anolis: net/smc: print netns inum instead of address (Wen Gu)
  - anolis: Revert "anolis: net/smc: Add sysctl conrtol for handshake limiation" (D. Wythe)
  - anolis: Revert "anolis: net/smc: Use diff TCP EXPR MAGIC to avoid network middleware do simple echo" (D. Wythe)
  - anolis: Revert "anolis: fix invisible experiment_syn_smc" (D. Wythe)
  - anolis: Revert "anolis: net/smc: Introduce SMC-R-related proc files" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Introduce dim proc file" (Guangguan Wang)
  - anolis: Revert "anolis: net/smc: Introduce link-related proc file" (Guangguan Wang)
  - anolis: Revert "anolis: net/smc: show rwwi flag in link proc file" (Guangguan Wang)
  - anolis: Revert "anolis: net/smc: show max links and max conns info in link proc" (Guangguan Wang)
  - anolis: net/smc: add experiment_vendor_options sysctl description to documentation (Guangguan Wang)
  - anolis: net/smc: change sysctl vendor_exp_option to experiment_vendor_options (Guangguan Wang)
  - anolis: net/smc: fix incorrect sk_buf_size via inet sock (D. Wythe)
  - anolis: net/smc: allow configure on inet mode via sysctl (D. Wythe)
  - anolis: net/smc: force SMC_CLOSED after smc_listen_out_err (D. Wythe)
  - anolis: sched: always update rq->sibidle_sum in update_acpu() (Cruz Zhao)
  - anolis: arm64: Cancel cpuectlr sysfs interfaces write permission on the physical machine (Feng Su)
  - anolis: fix the bug that turn off kernel.sched_core doesn't work (Cruz Zhao)
  - anolis: fuse: make fuse support configuring delete_stale feature (zyfjeff)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16.an8]
changelog:
  - block: don't remove hctx debugfs dir from blk_mq_exit_queue (Ming Lei)
  - anolis: net/smc: allow smc_sock_negotiator_ops negotiate on addr (D. Wythe)
  - anolis: net/smc: fix sockopt for inet sock (D. Wythe)
  - anolis: net/smc: avoid data corruption caused by decline (D. Wythe)
  - anolis: sched: fix duplicate define of PR_SCHED_CORE_CLEAR (Cruz Zhao)
  - anolis: tracing/timerlat: Do not start timerlat kthread when it already started (Zelin Deng)
  - anolis: sched: enable CONFIG_SCHED_ACPU by default (Cruz Zhao)
  - anolis: sched: fix the wrong config judge in __account_sibidle_time() (Cruz Zhao)
  - anolis: sched: don't init se->ht_ratio when alloc fair group (Cruz Zhao)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16.1_beta.an8]
changelog:
  - anolis: sched: update forceidle time during ttwu (Tianchen Ding)
  - anolis: sched: account cfs_rq runtime hierarchically for ht-aware-quota (Cruz Zhao)
  - anolis: sched/fair: fix the problem that cfs_rq->core is NULL (Cruz Zhao)
  - anolis: net/smc: add sysctl for max conns per lgr for SMC-R v2.1 (Guangguan Wang)
  - anolis: net/smc: add sysctl for max links per lgr for SMC-R v2.1 (Guangguan Wang)
  - anolis: net/smc: fix UAF due to SMC_PROCESSABORT (D. Wythe)
  - anolis: introduce sched feature SCHED_CORE_VRUNTIME (Cruz Zhao)
  - anolis: sched/fair: introduce fine-grained priority scheduler (Tianchen Ding)
  - anolis: configs: enable CONFIG_DRM_PHYTIUM (Qiao Ma)
  - anolis: configs: refresh configs by scripts/dummy-tools (Qiao Ma)
  - anolis: blk-throttle: add io latency indicators in cgroupV2 (Ferry Meng)
  - perf/core: Fix perf_cgroup_switch() (Chengming Zhou)
  - perf/core: Don't pass task around when ctx sched in (Chengming Zhou)
  - anolis: sched/core: fix cfs_prio_less (Cruz Zhao)
  - anolis: sched/fair: introduce core_vruntime and (Cruz Zhao)
  - anolis: sched/core: introduce core to struct cfs_rq (Cruz Zhao)
  - anolis: sched/core: introduce core_id to struct rq (Cruz Zhao)
  - anolis: sched: add forceidled time for task and cgroup (Tianchen Ding)
  - anolis: sched: fix percpu account for CPUTIME_*IDLE (Tianchen Ding)


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-6
changelog:
  - kdump-lib: Add the CoreOS kernel dir to the boot_dirlist
  - kdump-lib: attempt to fix BOOT_IMAGE detection
  - kdump-lib: change how ostree based systems are detected
  - kdump-lib: clear up references to Atomic/CoreOS


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-2
changelog:
  - mkdumprd: Improve error messages on non-existing NFS target directories
  - fadump: avoid non-debug kernel use for fadump case


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-3
changelog:
  - kdump.conf: use a simple generator script to maintain
  - Reduce kdump memory consumption by not letting NetworkManager manage unneeded network interfaces


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-4
changelog:
  - Don't check fs modified when dump target is lvm2 thinp
  - Add dependency of dracut lvmthinpool-monitor module
  - lvm.conf should be check modified if lvm2 thinp enabled
  - Add lvm2 thin provision dump target checker
  - Fix the sync issue for dump_fs


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-5
changelog:
  dracut-module-setup: Fix invalid rd.znet command line entry
   dracut-module-setup: Fix persistent nic name on s390


author: Youling Tang <tangyouling@loongson.cn> - 2.0.25-5.0.1
changelog:
  - Add LoongArch support
  - Add doc sub package (wb-zh951434@alibaba-inc.com)
  - Fix kexec error for kexec -s (xiangzao@linux.alibaba.com)
  - Reimplement loongarch64 support


author: David Howells <dhowells@redhat.com> - 1.5.10-1
changelog:
  - Include sys/types.h in keyutils.h.
  - The dns resolver needs limits.h.
  - Overhaul of all manual pages.
  - Some manual pages moved to Linux man-pages project.
  - Add Diffie-Helman keyctl function.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: Guixin Liu <kanie@linux.alibaba.com> - 1.13.1
changelog:
  - change spec weak-module (Guixin Liu)
  - add Conflicts: kernel < 5.10.134-16.an8 to avoid install unexpected kernel (DengXiewei)
  - remove pkgversion in spec (DengXiewei)
  - update spec & chmod -x (DengXiewei)
  - ast: support ast driver (Guixin Liu)


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-86
changelog:
  - Fixed bug which could result in empty flushes being issued to the storage
    below vdo while suspended.
  - Resolves: rhbz#2013056
  - Fixed syntax mismatch which prevented lvm from being able to configure a
    512MB UDS index.
  - Resolves: rhbz#2073203
  - Fixed a race handling timeouts of dedupe index queries.
  - Resolves: rhbz#2092075


author: - Andy Walsh <awalsh@redhat.com> - 6.2.8.1-87
changelog:
  - Fixed a bug which could produce a deadlock after multiple saves and resumes
    of a vdo.
  - Resolves: rhbz#2109047


author: - Susan LeGendre-McGhee <slegendr@redhat.com> - 6.2.8.7-88
changelog:
  - Fixed bug in read-only rebuild when the logical size of the volume is an
    exact multiple of 821 4K blocks.
  - Resolves: rhbz#2166131


author: Julien Thierry <jthierry@redhat.com> 0.9.2-2
changelog:
  - Fix unload issue under stress (rhbz#1883238)
  - Fix dnf-kpatch man file permissions (rhbz#1899341)
  - Do not replace dnf kpatch configuration file when reinstalling (rhbz#1898191)


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Cestmir Kalina <ckalina@redhat.com> - 1.3-1
changelog:
  - Resolves: #1642134 Error restrict bugs to groups without permission while
    trying to submit RHEL8 symbols
  - New ksc reports will no longer be submitted under redhat bugzilla group.
  - At least one bugzilla group must be specified by a ksc user, otherwise ksc
    will terminate with an error.
  - Version bump to 1.3


author: Cestmir Kalina <ckalina@redhat.com> - 1.4-1
changelog:
  - Resolves: #1643187 ksc manpage lies -k can only be specified once
  - Resolves: #1645335 FILE is shown in ksc man page but no explain or effect
  - Support for multiple -k arguments added
  - Man page reworded to match ksc behaviour


author: Čestmír Kalina <ckalina@redhat.com> - 1.5-1
changelog:
  - Resolves: #1647528 ksc add feature to copy justifications between ksc...
  - Resolves: #1648026 ksc add a non-processed .ko file
  - Resolves: #1647974 piped input causes ksc to fail when asking for user input
  - Add support for justification carry over.
  - Add support for symbol filtering using -K.
  - Fix input problems when piping through to ksc.
  - Extend manpage with EXAMPLES section.
  - Version bump fo 1.5.


author: Čestmír Kalina <ckalina@redhat.com> - 1.6-1
changelog:
  - Resolves: #1729039 Extend ksc output to include environment metadata
  - Add modinfo vermagic field to the output.
  - Add kmod (provides modinfo) to requires.


author: Čestmír Kalina <ckalina@redhat.com> - 1.6-2
changelog:
  - Resolves: #1729039 Extend ksc output to include environment metadata
  - (OSCI) Add kmod to Makefile-generated Requires


author: Čestmír Kalina <ckalina@redhat.com> - 1.7-1
changelog:
  - Resolves: #1886901 Avoid divisive language
  - Resolves: #1912506 File bugs with Tracking keyword by default


author: Čestmír Kalina <ckalina@redhat.com> - 1.9-1
changelog:
  - Resolves: #2043450 ksc: Support Authorization header in bugzilla API
  - Rebase to latest ksc release


author: Čestmír Kalina <ckalina@redhat.com> - 1.9-2
changelog:
  - Resolves: #2043450 ksc: Support Authorization header in bugzilla API
  - Use platform-python in place of python3


author: Jan Macku <jamacku@redhat.com> - 0.97-1
changelog:
  - update to 0.97 (#2159588)
  - drop downstream patch - ipmi: avoid error messages on non-dell platforms


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.110-12.el8
changelog:
  - Pass in the distro-provided CFLAGS and LFLAGS. (Jeff Moyer)
  - Get rid of -nostartfiles -nostdlib (Jeff Moyer)
  - Resolves: rhbz#1630578


author: Richard Hughes <richard@hughsie.com> 0.7.16-1
changelog:
  - Update to 0.7.15
  - Add UPL short name to SPDX conversion
  - Allow parsing desktop files using as_app_parse_data()
  - Do not preserve restrictive permissions when installing AppStream files
  - Modernize the validation requirements
  - Remove relative path from icon names
  - Support loading YAML from as_store_from_bytes()
  - Update list of allowed metadata licences
  - Update the SPDX license list to v3.5


author: Richard Hughes <richard@hughsie.com> 0.7.17-1
changelog:
  - New upstream release
  - Add "icon-theme" as recognised component type
  - Fix CI by moving 'future' back a bit
  - Make default content rating values match OARS semantics
  - Properly initialize unique_id_mutex


author: Richard Hughes <richard@hughsie.com> 0.7.18-1
changelog:
  - New upstream release
  - Add content rating system APIs from gnome-software
  - Add "validate-version" command
  - Allow timestamp in the future in validate-relax
  - Don't ignore localized strings that are the same as original
  - Fix crash with invalid children of <ul/>
  - Properly initialize mutexes
  - Test launchable tags in validation


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Zoltan Fridrich <zfridric@redhat.com> - 2.48-2
changelog:
  - rebase to 2.48
    resolves: rhbz#2032813
  - fix ambient capabilities for non-root users
    resolves: rhbz#1950187


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.7.8-6
changelog:
  - Python 2 binary package renamed to python2-libcap-ng
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - backport several upstream fixes
  - set Delegate property for cgconfig service to make sure complete
    cgroup hierarchy is always created by systemd


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Make inline function __comps_objmrtree_all also static (RhBug:1793424)
  - Fix memory leaks and resource leaks
  - Fix: Check result "comps_parse_parsed_init()"


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-8
changelog:
  - Substitute all repository config options (fixes substitution of baseurl)
  - Use solvfile userdata to store and check checksums and solv versions
  - Fix handling transaction id in resolveTransactionItemReason
  - Set short action for Reason Change


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-10
changelog:
  - Do not print errors on failovermethod repo option
  - the dnf_context_remove() function accepts `<package-spec>`, doc updates
  - advisory upgrade: filter out advPkgs with different arch


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.63.0-17.0.1
changelog:
  - Disable rhsm support in Anolis (geliwei@openanolis.org)
  - rebrand: fix platform compatibility (geliwei@openanolis.org)
  - Add loongarch64 to arch_map (liwei.glw@alibaba-inc.com)


author: Jerry James <loganjerry@gmail.com> - 3.1-23.20170329cvs
changelog:
  - Add gcc BR
  - Build verbosely
  - Drop obsolete --enable-widec configure option
  - Fix "unused direct shared library dependency" warning from rpmlint again
  - Fix man page error due to BSD nroff macro that is not available on Linux
  - Drop explicit R on pkgconfig from the -devel package, autogenerated


author: Vishal Vijayraghavan <vvijayra AT redhat DOT com> - 1:2.1.3-1
changelog:
  - New release of liberation-fonts 2.1.3
  - Resolves:rh#1464310 : Tilded G not works with Liberation Sans and Serif


author: Honggang Li <honli@redhat.com> - 1.11.1-1
changelog:
  - Rebase to upstream release v1.11.1
  - EFA Support requires libfabric
  - Resolves: bz1831145, bz1852636


author: Michal Schmidt <mschmidt@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream release 1.15.1
  - Disable LTO on x86_64 due to memory issues (copied from Fedora)
  - Resolves: rhbz#2040450


author: DJ Delorie <dj@redhat.com> - 3.1-24
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2014228)


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
changelog:
  - make only_urandom a default in non-presence of configuration file
  - run the full FIPS selftests only when the library is called from
    application


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-3
changelog:
  - add CMAC selftest for FIPS POST
  - add continuous FIPS entropy test
  - disable non-approved FIPS hashes in the enforced FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
changelog:
  - new upstream version 1.8.5
  - AES performance improvements backported from master branch
  - FIPS module is implicit with kernel FIPS flag
  - always run the FIPS selftests if FIPS module is installed


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-40528 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Richard Hughes <richard@hughsie.com> 0.2.10-1
changelog:
  - New upstream version
  - Correctly detect removed devices when rescanning
  - Fix a memory leak when using control tranfers
  - Fix symbol version table up to version 0.2.9


author: Rafael Aquini <aquini@redhat.com> - 2.21-4
changelog:
  - Fix: task-size-overrun hung over 8 hours on ppc64le (1737370)
  - Introduce libhugetlbfs-tests subpkg for CI tests (1688930)


author: Rafael Aquini <aquini@redhat.com> - 2.21-12
changelog:
  - Fix: Introduce libhugetlbfs-tests subpkg for CI tests (1688930)
  - trim repetitive changelogs for interim debug builds


author: Rafael Aquini <aquini@redhat.com> - 2.21-13
changelog:
  - Fix: huge_page_setup_helper.py: SyntaxError: Missing parentheses in call to 'print' (1821938)
  - libhugetlbfs-tests: harden the testcases to satisfy EXECSHIELD RPMDiff checks (1785296)


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16_1
changelog:
  - [RHEL] Apply 'Add missing dependencies to the tests package'
  - [RHEL] Apply 'Update patch from upstream'


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Phil Sutter <psutter@redhat.com> - 0.3-2
changelog:
  - Add missing build requirement: gcc.
  - Add source code patches to facilitate following changes.
  - Patches managed in git, so add git as another build requirement.
  - Respect build system compiler flags.
  - Use %make_build instead of plain make in %build.
  - Add %check target which performs unattended runtime test.
  - Use -D install flag instead of manual mkdir.


author: Phil Sutter <psutter@redhat.com> - 0.3-3
changelog:
  - Use %autosetup flag '-p1' instead of '-S git' to get rid of git dependency.
  - Use %license macro in %files section.
  - Added comment about included patches' upstream status.


author: Ana Cabral <acabral@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved
    from the main package to the utils sub package causing a file
    conflict on multilib systems between the old 32 bit main
    package and the new 64 bit utils sub package.


author: Martin Gansser <martinkg@fedoraproject.org> - 1:0.9.57-1
changelog:
  - Update to 0.9.57
  - Dropped dependency on libgcrypt
  - Dropped dependency on openssl
  - Update tarball link to "https:"
  - Add examples from doc/examples


author: Stephen Gallagher <sgallagh@redhat.com> - 2.5.0-2
changelog:
  - Fix memory corruption error using Module.search_rpms() from python
  - Speed up valgrind tests
  - Resolves: rhbz#1714766


author: Hangbin Liu <haliu@redhat.com> - 1.7-1
changelog:
  - Update to 1.7
  - libndp: apply filter to raw socket to only accept ND messages
  - libndp: move ndp_sock_{open,close}() after msg parsing functions
  - ndptool: Fix compilation on musl libc


author: Hangbin Liu <haliu@redhat.com> - 1.7-2
changelog:
  - ndptool: add -T target support (rhbz 1666194)
  - ndptool: fix target parameter typo (rhbz 1666194)
  - libndp: close sockfd after using to avoid handle leak (rhbz 1666194)
  - libndp: fix nd_msg typo when setting target address (rhbz 1666194)


author: Hangbin Liu <haliu@redhat.com> - 1.7-3
changelog:
  - ndptool: add -D dest support (rhbz 1697595)
  - ndptool: fix potential memory leak caused by strdup (rhbz 1697595)


author: Phil Sutter <psutter@redhat.com> [1.1.4-2.el8]
changelog:
  - obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser (Phil Sutter) [1758673]
  - set_elem: Validate nftnl_set_elem_set() parameters (Phil Sutter) [1758673]
  - obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data() (Phil Sutter) [1758673]
  - set: Don't bypass checks in nftnl_set_set_u{32,64}() (Phil Sutter) [1758673]
  - obj/tunnel: Fix for undefined behaviour (Phil Sutter) [1758673]
  - set_elem: Fix return code of nftnl_set_elem_set() (Phil Sutter) [1758673]
  - obj: ct_timeout: Check return code of mnl_attr_parse_nested() (Phil Sutter) [1758673]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.3.0-4
changelog:
  - Python 2 binary package renamed to python2-libnl3
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Bastien Nocera <bnocera@redhat.com> - 1.22.0-6
changelog:
  + libpeas-1.22.0-6
  - Remove python2 loader, all GNOME apps using libpeas were ported to Python3
    when ported to GTK+ 3.x, and obsolete libpeas-loader-python
  - Resolves: #1559090


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.3-11
changelog:
  Correctly set socket directory permissions when
    qb_ipcs_connection_auth_set() is called
    Resolves: rhbz#1836146


author: Remi Collet <remi@remirepo.net> - 0.11.0-1
changelog:
  - update to 0.11.0
  - add patch to not install the static library, from
    https://github.com/alanxz/rabbitmq-c/pull/665


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix the key string parsing in url_substitution
  - When zchunk enabled and not using HTTP/S protocol, download the whole file (RhBug:1886706)
  - Add an option LRO_SSLVERIFYSTATUS to check TLS certificate revocation status (using OCSP stapling) (RhBug:1814383)
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for working with certificates used with proxy
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.2-1
changelog:
  - Update to 1.14.2
  - Reduce time to load metadata
  - Fix resource leaks and memory leaks
  - Remove build dependency on python3-flask


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.2-4
changelog:
  - Fix termination of va_list in lr_metadatatarget_append_error()
  - Detailed error message when using non-existing TMPDIR


author: Martin Kutlak <mkutlak@redhat.com> - 2.9.5-10
changelog:
  - reportclient: Search for required packages recursively
  - reportclient: Find and download required debuginfo packages
  - report-client: Find debuginfos in own method
  - Resolves: rhbz#1783897


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: zhangbinchen <zhangbinchen@openanolis.org> - 2.9.5-15.0.1
changelog:
  - Disable centos sub package
  - Don't requires subscription for Anolis OS
  - Remove unused sub packages
  - cherry-pick [1acfc44 00b6684 2f29df5]


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Peter Jones <pjones@redhat.com> - 2.3.0-2
changelog:
  - Once again, don't complain about compilers newer than tested with in the
    public headers.
  - Fix up bad %global vs %define directives
  - Fix up bad old changelog dates
  - Note there's a missing changelog here from the 2.3.0 rebase


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.20-5
changelog:
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism
  - Rebase to version 0.9.6
  - Rename SSHD_EXECUTABLE to SSH_EXECUTABLE in tests/torture.c
  - Resolves: rhbz#1896651, rhbz#1994600


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 0.9.6-7
changelog:
  - NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
  - authorization bypass in pki_verify_data_signature (CVE-2023-2283)


author: Tony Asleson <tasleson@redhat.com> - 1.9.1-7
changelog:
  - Remove valgrind dependency as not being used and causing
    build to fail as it pulls in python3.11


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.2
changelog:
  - Obsolete the python2 packages on upgrade
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 1.4.2-2
changelog:
  - Resolves: rhbz#1754420 - Rebase libtdb 1.4.2 for samba
  - Related: rhbz#1754420 - Fix sssd tests (tdb)


author: Xin Long <lxin@redhat.com> - 1.29-1
changelog:
  - man teamd.conf: update some parameter default values [1732587]
  - 1.29 release
  - teamd: add port_master_ifindex_changed for link_watch_port_watch_ops
  - initscripts: fix if/fi align
  - teamd: fix a json object memleak in get_port_obj() [1767685]
  - libteam: set netlink event socket as non-blocking [1684389]
  - libteam: double NETLINK_RCVBUF to fix -ENOMEM error
  - teamd: add a default value 1000 for link_watch.interval


author: Xin Long <lxin@redhat.com> - 1.29-2
changelog:
  - teamd/lacp: fix segfault due to NULL pointer dereference [1758073]
  - teamd: fix build error in expansion of macro teamd_log_dbgx [1758073]
  - teamd: update ctx->hwaddr after setting team dev to new hwaddr
  - libteam: wapper teamd_log_dbg with teamd_log_dbgx [1758073]


author: Xin Long <lxin@redhat.com> - 1.31-1
changelog:
  - 1.31 release
  - utils/bond2team: remove TYPE in ifcfg file [1858518]
  - utils/bond2team: keep delivering config to file if stdout not supplied [1858518]
  - teamd/lacp: silence ignore none LACP frames
  - Send LACP PDU right after the Actor state has been changed
  - Skip setting the same hwaddr to a lag port if not needed
  - Make all netlink socket RCVBUF sizes configurable
  - Don't return an error when timerfd socket return 0
  - Fix ifinfo_link_with_port race condition with newlink
  - teamd: fix possible race in master ifname callback
  - 1.30 release
  - teamd: Disregard current state when considering port enablement [1851460]


author: Xin Long <lxin@redhat.com> - 1.31-4
changelog:
  - teamd: do no remove the ports on shutdown with -N [2148856]
  - teamd: stop iterating callbacks when a loop restart is requested [2148855]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.39-1
changelog:
  - Resolves: #1684580 - Rebase libtevent to version 0.9.36 for Samba
  - Resolves: #1597318 - libtevent uses Python 2 to build
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com>
changelog:
  - Remove the python2 subpackages on upgrade
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 0.10.0-2
changelog:
  - Resolves: #1754421 - Upgrade tevent to 0.10.0 version for samba
  - Related: #1754421 - Fix sssd tests (tevent)


author: Tom Stellard <tstellar@redhat.com> - 1.2.6-2
changelog:
  - Add BuildRequires: gcc
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_packaging


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.6-23
changelog:
  - bake in versioned requirement on automake (rhbz#1193591)
  - fix testsuite FTBFS against automake 1.16.1
  - bypass -specs=* to gcc (rhbz#985592)


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-16
changelog:
  - Use 2048bit keys in tests
  - Resolves: rhbz#1611729 - [RHEL8-S-BUILD] libuser Fails Scratch Build on rhel-8.0


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-17
changelog:
  - Resolves: rhbz#1558151 - libuser needs audit events around the account
                             lifecycle


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-19
changelog:
  - Resolves: rhbz#1602600 -  Please review important issues found by covscan
                              in "libuser-0.62-14.el8+7" package


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-20
changelog:
  - Resolves: rhbz#1637398 - libuser-python3 should be renamed to comply
                             with Packaging Guidelines


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-23
changelog:
  - Actually apply the patch from the previous build
  - Resolves: rhbz#1670997 - Amend the user lifecycle auditing


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.1.6-14
changelog:
  - build with hardening LDFLAGS (#1548717)
  - remove obsolete macro and comments
  - add gcc to build requirements


author: Harald Hoyer <harald@redhat.com> - 16-1
changelog:
  - libvarlink 16
  - fixed coverity issues
  - Resolves: #1638294 - Interface name validation rule update


author: Jarod Wilson <jarod@redhat.com> - 20220713-109.gitdfa29317
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include even newer qed firmware update (rhbz 2040269)


author: Jarod Wilson <jarod@redhat.com> - 20220726-110.git150864a4
changelog:
  - Omit unused password-protected vxge firmware files from package (rhbz 2108051)
  - Pick up latest AMD GPU firmwares


author: Lucas Zampieri <lzampier@redhat.com> - 20221102-111.git8bb75626
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amdgpu firmware update to fix certain "multiple monitor scenarios" (rhbz 2130707)


author: Lucas Zampieri <lzampier@redhat.com> - 20230111-112.gita1ad1d5b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi33 dGPU firmware (rhbz 2047480)
  - Navi31 dGPU firmware (rhbz 2047483)


author: Lucas Zampieri <lzampier@redhat.com> - 20230217-113.git83f1d778
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Qualcomm Wi-Fi - Disconnecting power cable during suspend wakes up the laptop (rhbz 2169012)


author: Patrick Talbert <ptalbert@redhat.com> - 20230404-114.git2e92a49f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Intel QAT Update - firmware for QAT (rhbz 2030316)


author: Xin Long <lxin@redhat.com> - 1.0.18-3
changelog:
  - Added a patch to fix netinet/sctp.h not to be installed.
  - Added some fixes for kernel feature detection.


author: Aaron Conole <aconole@redhat.com> - 1.0.1-14.git036e314
changelog:
  - Update to branch-1.1 compatibility
  - Fixes to avoid assert in the agent state machine
  - Remove the memory constraint on the event socket buffer (#1554110)


author: Artem Egorenkov <aegorenk@redhat.com> - 3.6.0-7
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.0.4-0.27.20111007git
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - Explicitly include <sys/sysmacros.h> due to glibc-headers changes.
  Definition of major and minor macros is no longer transitively included
  through <sys/types.h>, hence make it explicit.
  Ref:
  https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-3
changelog:
  - fix programming mistakes detected by Coverity Analysis
  - document the --version option in the logrotate(8) man page (#1611498)


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-4
changelog:
  - logrotate.8: encourage admins to use the `su` directive (#1759770)
  - do not abort globbing on broken symlink (#1723265)


author: Frank Crawford <frank@crawford.emu.id.au> - 7.5.4-2
changelog:
  - Add requires for perl-diagnostics (#1893671) and perl-lib (#1893503)
  - Add other requires as nothing is now automatically supplied


author: Lianbo Jiang <lijiang@redhat.com> - B.02.18-22
changelog:
  - Display proper logical name of network device
  - Resolves: rhbz#1724087
  - Add DIMM running speed and Print dimm rank information
  - Resolves: rhbz#1725199


author: Jan Rybar <jrybar@redhat.com> - 4.93.2-1
changelog:
  - Rebase to lsof-4.93.2
  - Upstream moved to GitHub (original unreachable) and tarball structure changed
  - Manpage patch needed to reflect the tarball changes
  - Resolves: rhbz#1778228


author: Tomas Bzatek <tbzatek@redhat.com> - 0.32-1
changelog:
  - Upgrade to 0.32 upstream snapshot (#1855766)
  - Fix NVMe device parsing (#1687841, #1845977)
  - Fix WWN string reporting (#1846559)
  - Implement SCSI identifier sort priority (#1846566)


author: Marian Csontos <mcsontos@redhat.com> - 2.03.14-7
changelog:
  - Fix lvm crash when recreating PV with UUID of a missing PV.
  - Fix lvconvert --type vdo-pool with --test should not write signature.
  - Use correect profile in lvmdbusd preventing messages in JSON output.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.14-8
changelog:
  - Fix [vdo_]use_compression options.
  - Fix vgimportdevices operating on incomplete VGs fails when nothing to import.
  - Fix message processing on thin-pool extension leaving devices behind.


author: Gao Xiang <hsiangkao@linux.alibaba.com> - 1.9.4-1
changelog:
  - Update to 1.9.4 in sync with Anolis 23
  - Switch back from Meson since its version is too low on Anolis 8.


author: Robert Scheck <robert@fedoraproject.org> - 1.03-13
changelog:
  - Added patch by Khem Raj to use static inlines as the external
    inline definition has changed with GCC 5 (to fix ppc64 builds)


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-7
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes. (#1589769)
  - Fix testing failure due to Perl changes related to expanding paths.


author: Nikola Forró <nforro@redhat.com> - 2.7.6.1-18
changelog:
  - schedule interrupted cache update for the next boot, instead of blocking
    system reboot/shutdown
    resolves #1874010


author: Nikola Forró <nforro@redhat.com> - 4.15-7
changelog:
  - remove rpc.3 and xdr.3 man pages documenting deprecated glibc RPC implementation
    resolves: #1980919


author: Prarit Bhargava <prarit@redhat.com> - 3:173-0
changelog:
  - Update to v173
  - adds support for Tigerlake, Rocketlake, Alderlake, Lakefield
  - adds support for CometLake, Icelake server, Icelake-D, and Snow Ridge


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-2
changelog:
  - Revert "mcstransd select correct colour range." (#1731451)
  - Fix mcstrans secolor examples (#1731451)


author: Xiao Ni <xni@redhat.com> - 4.2-6
changelog:
  - Keep udev rule close to upstream and update to latest upstream
  - Resolves rhbz#1991596, rhbz#2129088, rhbz#2107150


author: Xiao Ni <xni@redhat.com> - 4.2-7
changelog:
  - Update to latest to upstream to fix some bugs
  - Resolves rhbz#2149307, rhbz#2149473, rhbz#2151208, rhbz#2127096


author: Xiao Ni <xni@redhat.com> - 4.2-9
changelog:
  - Update to latest upstream and fix mdcheck service bug
  - Resolves rhbz#2116418, rhbz#2150862, rhbz#2159584


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.01-14
changelog:
  - Removed some spec artifacts (like buildroot cleaning)
  - Fixed malformed "Loading" banner
  - Not relocating memtest86+ above 1 MB
    Related: rhbz#1303804
  - Introduced new configuration file (/etc/memtest86+.conf)
  - Introduced new memtest-setup switches for selecting ELF/non-ELF versions
    Resolves: rhbz#1303804


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20230214-1
changelog:
  - Update Intel CPU microcode to microcode-20230214 release, addresses
    CVE-2022-21216, CVE-2022-33196, CVE-2022-33972, CVE-2022-38090 (#2171234,
      - Addition of 06-6c-01/0x10 (ICL-D B0) microcode at revision 0x1000211;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode at revision
      0x2b000181;
    - Addition of 06-8f-04/0x10 microcode at revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) at revision 0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) at
      revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2c000170;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) at
      revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode at revision
      0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode at revision
      0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) at
      revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2c000170;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) at
      revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) at revision 0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode at revision
      0x2b000181;
    - Addition of 06-8f-06/0x10 microcode at revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) at revision 0x2c000170;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode at revision
      0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) at
      revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) at revision 0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) at
      revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode at revision
      0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode at revision
      0x2c000170;
    - Addition of 06-b7-01/0x32 (RPL-S S0) microcode at revision 0x112;
    - Addition of 06-ba-02/0xc0 microcode at revision 0x410e;
    - Addition of 06-ba-03/0xc0 microcode (in intel-ucode/06-ba-02) at
      revision 0x410e;
    - Addition of 06-ba-02/0xc0 microcode (in intel-ucode/06-ba-03) at
      revision 0x410e;
    - Addition of 06-ba-03/0xc0 microcode at revision 0x410e;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa4 up to 0xa6;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xf0 up to 0xf4;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xf0 up
      to 0xf4;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015e
      up to 0x1000161;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003302
      up to 0x4003303;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003302 up to 0x5003303;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002501
      up to 0x7002503;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000375
      up to 0xd000389;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3c up
      to 0x3e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x20 up
      to 0x22;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb2
      up to 0xb8;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x31 up
      to 0x32;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x40 up
      to 0x42;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x16 up
      to 0x17;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x22
      up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x421 up to 0x429;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x421 up to 0x429;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x421 up to 0x429;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x421
      up to 0x429;
    - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x24000023
      up to 0x24000024;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf0 up
      to 0xf4;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf0
      up to 0xf4;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf0
      up to 0xf4;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf0
      up to 0xf4;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xf0 up to 0xf4;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x54 up
      to 0x57;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x22 up to
      0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x22 up to
      0x2c (old pf 0x3).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20230516-1
changelog:
  - Update Intel CPU microcode to microcode-20230516 release (#2213125):
    - Addition of 06-be-00/0x01 (ADL-N A0) microcode at revision 0x10;
    - Addition of 06-9a-04/0x40 (AZB A0) microcode at revision 0x4;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006e05 up
      to 0x2006f05;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa6 up to 0xaa;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf0 up
      to 0xf2;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf0 up
      to 0xf2;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xf0 up
      to 0xf2;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xf0 up
      to 0xf2;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xf4 up to 0xf6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xf0 up
      to 0xf2;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf0 up
      to 0xf2;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xf0 up
      to 0xf2;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf0 up
      to 0xf2;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xf4 up
      to 0xf8;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000161
      up to 0x1000171;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003303
      up to 0x4003501;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003303 up to 0x5003501;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002503
      up to 0x7002601;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000389
      up to 0xd000390;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000211
      up to 0x1000230;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb8
      up to 0xba;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x32 up
      to 0x33;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x28 up
      to 0x2a;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x42 up
      to 0x44;
    - Update of 06-8f-04/0x10 microcode from revision 0x2c000170 up to
      0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
      0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000181
      up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c000170 up to
      0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000181
      up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000181 up to 0x2b000461;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x429 up to 0x42a;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x429 up to 0x42a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x429 up to 0x42a;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x429
      up to 0x42a;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf4 up
      to 0xf6;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xf4 up to 0xf6;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x57 up
      to 0x58;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x112 up
      to 0x113;
    - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x410e up to 0x4112;
    - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x410e up to 0x4112;
    - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x410e up to 0x4112;
    - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode from revision 0x410e
      up to 0x4112.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20230808-1
changelog:
  - Update Intel CPU microcode to microcode-20230808 release, addresses
    CVE-2022-40982, CVE-2022-41804, CVE-2023-23908 (#2213125, #2223993, #2230678,
      - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006f05 up
      to 0x2007006;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xaa up to 0xac;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf2 up
      to 0xf4;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf2 up
      to 0xf4;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xf2 up
      to 0xf4;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xf2 up
      to 0xf4;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xf6 up to 0xf8;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xf2 up
      to 0xf4;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf2 up
      to 0xf4;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xf2 up
      to 0xf4;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf2 up
      to 0xf4;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xf8 up
      to 0xfa;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000171
      up to 0x1000181;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003501
      up to 0x4003604;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003501 up to 0x5003604;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002601
      up to 0x7002703;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000390
      up to 0xd0003a5;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xba
      up to 0xbc;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2a up
      to 0x2c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x44 up
      to 0x46;
    - Update of 06-8f-04/0x10 microcode from revision 0x2c0001d1 up to
      0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
      0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000461
      up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c0001d1 up to
      0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000461
      up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000461 up to 0x2b0004b1;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x2c up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2c up to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2c up to 0x2e;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2c
      up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2c up to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2c up to 0x2e;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x42a up to 0x42c;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x42a up to 0x42c;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x42a up to 0x42c;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42a
      up to 0x42c;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf6 up
      to 0xf8;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf6
      up to 0xf8;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf6
      up to 0xf8;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf6
      up to 0xf8;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xf6 up to 0xf8;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x58 up
      to 0x59;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x113 up
      to 0x119;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2c up
      to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x2c up to 0x2e;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x2c up to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2c up
      to 0x2e;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4112 up to 0x4119 (old pf 0xc0);
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4112 up to 0x4119 (old pf 0xc0);
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4112 up to 0x4119 (old pf 0xc0);
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4112
      up to 0x4119 (old pf 0xc0);
    - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x10 up
      to 0x11 (old pf 0x1).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20230808-2
changelog:
  - Add support for the new, more correct, variant of dracut's default
    $fw_dir path in dracut_99microcode_ctl-fw_dir_override_module_init.sh.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20230808-2.20231009.1
changelog:
  - Update Intel CPU microcode to microcode-20231009 release, addresses
    CVE-2023-23583 (RHEL-3684):
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xac up to 0xb4;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003a5
      up to 0xd0003b9;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000230
      up to 0x1000268;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xbc
      up to 0xc2;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2c up
      to 0x34;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x46 up
      to 0x4e;
    - Update of 06-8f-04/0x10 microcode from revision 0x2c000271 up to
      0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0004b1
      up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c000271 up to
      0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0004b1
      up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2e up to 0x32;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2e
      up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2e up to 0x32;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x42c up to 0x430;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x42c up to 0x430;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x42c up to 0x430;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42c
      up to 0x430;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x4 up
      to 0x5;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x59 up
      to 0x5d;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x119 up
      to 0x11d;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4119 up to 0x411c;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4119 up to 0x411c;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4119 up to 0x411c;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4119
      up to 0x411c;
    - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x11 up
      to 0x12;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2e up
      to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x2e up to 0x32;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2e up
      to 0x32.


author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Fix: do not download metadata in remove command
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - [repolist] Print padding spaces only if output is terminal


author: Nicola Sella <nsella@redhat.com> - 3.4.0-3
changelog:
  - Patch: Add support for setting a platform module ID
  - Rename "update" command to "upgrade", "update" remain as compatibility alias


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - Don't set default value of "assumeyes" to TRUE
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Add commands: distro-sync, makecache
  - Add subcommands support
  - Add support for command aliases
  - Added alias "update" to "upgrade" command
  - Relicense to GPLv2+
  - Add support for setting allow_vendor_change
  - [download] Support for "--resolve", "--alldeps" and "--archlist=" arguments
  - [download] several optimizations
  - Support "--setopt=keepcache=0/1"
  - Extend "--setopt" to support repository options


author: Michal Hlavinka <mhlavink@redhat.com> 56-1
changelog:
  - Upgrade to 56 (#1479800)
  - fixes wait exit codes of co-processes when run in interactive mode (#1479320)


author: Michal Sekletar <msekleta@redhat.com> - 0.26-14
changelog:
  - start timer after the installation (#1278587)
  - make mlocate-updatedb.service of the type simple, systemd will then not wait for its completion (#1282232)


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1907418


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.3.0-12.0.1
changelog:
  - Modify the WARNINGFLAGS for loongarch64 (zhangwenlong@loongson.cn)
  - Add loongarch64 in ExclusiveArch (gongwen@nfschina.com)
  - Fix build error by koji (jacob.wang@openanolis.org)


author: James Paul Turner <jamesturner246@fedoraproject.org> - 3.1.6-1
changelog:
  - Update to MPFR version 3.1.6
  - Use autosetup specfile macro for applying patches (patches 1 and 2 applied)
  - Removed iconv calls, as they were breaking .info files, which are now unicode
    resolves #1299649
  - Other minor cleanups
  - BuildRequire gcc per https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.18-15
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073842)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Jeff Moyer <jmoyer@redhat.com> - 67-1.el8
changelog:
  - Rebase to v67.  This brings in the following features:
    - support for the 'security frozen' sysfs attribute
    - support for using pmem as system ram
    - various cleanup and bug fixes
  - Fix load-keys failure in initramfs (Jeff Moyer)
  - Resolves: bz#1724531 bz#1730673 bz#1741164 bz#1741165 bz#1749888 bz#1749889


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-4.el8
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
    - Fix enable-namespace all reporting errors incorrectly
    - Add support for inject-smart on papr scm
  - Related: bz#2090190 bz#1986185 bz#2040074


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.50.20160912git
changelog:
  - Resolves: 1557470 - netstat -i cut's interface names
  - Resolves: 1566084 - netstat -agn only shows 10 character interface name for IPv4 addressing


author: Michal Ruprich <michalruprich@gmail.com> - 2.0-0.52.20160912git
changelog:
  - Resolves: #1711119 - netstat says "packetes" instead of "packets"
  - Resolves: #1670355 - Exit code on wrong parameter is zero for many net-tools binaries
  - Resolves: #1807989 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-10
changelog:
  - move snack provides to python3-newt subpackage (#1640153)
  - fix radio button selection check in snack (#1714517)


author: Steve Dickson <steved@redhat.com> 2.3.3-59
changelog:
  - Covscan Scan: Wrong Check of Return Value (bz 2151966)
  - Covscan Scan: Clang (experimental) (bz 2151971)


author: Weitao Zhou <zhouwt@linux.alibaba.com> 2.3.3-59.0.1
changelog:
  - use extern in header files when declaring global variables for compatible gcc10 build
  - allow compilation to succeed with -fno-common
  - Add libuuid-devel buildrequires (wb-zh951434@alibaba-inc.com)
  - Disable v4client on loongarch platform (liwei.glw@alibaba-inc.com)


author: Steve Dickson <steved@redhat.com> 0.3.5-2
changelog:
  - nfs4_getfacl: Add new option -c/--omit-header (bz 1698281)
  - nfs4_setfacl: Skip comment field while reading ACE(s) (bz 1687299)


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Filip Januš <fjanus@redhat.com> - 3.1-4
changelog:
  - addiing: recommending to install 32 bit-version if 32 bit glibc is installed
  - resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803161


author: Filip Januš <fjanus@redhat.com> - 3.1-7
changelog:
  - improve recommandation of 32 bit-version
  - resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803161


author: Dridi Boukelmoune <dridi@fedoraproject.org>- 2.1-1
changelog:
  - Update to 2.1
  - Upstream moved to github
  - Upstream switched to autotools
  - Disable --as-needed until it's patched upstream
  - Drop defunct 32bit x86 support
  - Add ppc64le support
  - Run the new test suite


author: zhangbinchen <zhangbinchen@openanolis.org> - 10.11.2.0.3-1.0.1
changelog:
  - Add Anolis vendor parse
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build (zhouwt@linux.alibaba.com)


author: Than Ngo <than@redhat.com> - 3.18.0-1
changelog:
  - Resolves: #2043845, rebase to 3.18.0
  - Resolves: #2043854, add crypto counters
  - Resolves: #2043855, support crypto profiles


author: Than Ngo <than@redhat.com> - 3.18.0-3
changelog:
  - Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
  - Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126612, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110315, rebase to 3.19.0
  - Resolves: #2110990, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110477, openCryptoki ep11 token: master key consistency
  - Resolves: #1984871, openCryptoki ep11 token: vendor specific key derivation


author: Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
changelog:
  - Added some linker hardening flags to pass annocheck
    Related: rhbz#2031802

    * Tue Dec 14 2021 Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
  - Added gating
    Related: rhbz#2031794


author: Michael Petlan <mpetlan@redhat.com> - 1.2.0-2
changelog:
  - Update to upstream 1.2.0 -- fix opencsd_tag
    Related: rhbz#2041578

    * Fri Jan 21 2022 Michael Petlan <mpetlan@redhat.com> - 1.2.0-1
  - Update to upstream 1.2.0
    Related: rhbz#2041578


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-3
changelog:
  - Unbreak the RSA-PSS mechanisms (#1595626)
  - Unbreak the signing using hashed mechanisms in CardOS and others (#1644338)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-14
changelog:
  - Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
  - Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
  - Include caveat for crypto-policy in sshd manpage (#2044354)
  - Change log level of FIPS specific log message to verbose (#2050511)
  - Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
  - Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)


author: Dmitry Belyavskiy - 8.0p1-17
changelog:
  - Fix parsing of IPv6 IPs in sftp client (#2151334)
  - Avoid ssh banner one-byte overflow (#2138344)
  - Avoid crash of sshd when Include folder does not exist (#2133087)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 8.0p1-17.0.1
changelog:
  - seccomp: Allow check_nanosleep to better compatibility for both glibc2.28 and glibc2.32
  - Support loongarch64 seccomp_filter sandbox (xuezhixin@uniontech.com)
  - another case where a utimes() failure could make scp send (jiang.yong5@zte.com.cn)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-1
changelog:
  - Update to 0.4.8-1
  - RSA key generation on the token
  - RSA-OAEP and RSA-PKCS encryption support
  - RSA-PSS signature support
  - Support for OpenSSL 1.1.1 beta
  - Removed support for OpenSSL 0.9.8
  - Various bug fixes and enhancements


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-2
changelog:
  - Require OpenSSL >= 1.0.2
  - Fixed missing declaration of ERR_get_CKR_code()
  - Add support to use EC keys and tests (#1625338)
  - Exposed check_fork() API
  - Fixed memory leak of RSA objects in pkcs11_store_key()
  - Updated OpenSSL license in eng_front.c
  - Fixed build for old C dialects
  - Allow engine to use private key without PIN
  - Require DEBUG to be defined to print debug messages
  - Changed package description


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-1
changelog:
  - Update to 0.4.10 (#1745082)
  - Add BuildRequires for OpenSSL >= 1.0.2, required for testing
  - Print tests logs if failed during build
  - Small bug fixes such as removal of unused variable
  - Search objects in all matching tokens (#1705505)


author: Neal Gompa <ngompa13@gmail.com> - 1.74-1
changelog:
  - Update to upstream version 1.74
  - Drop merged patches
  - Rediff remaining patches
  - Move newns to /usr/libexec/os-prober (debuginfo generation works)
  - Mark copyright file as license file


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Daiki Ueno <dueno@redhat.com> - 0.23.21-4
changelog:
  - Fix realloc usage on proxy cleanup (#1894979)
  - Make 'trust anchor --store' preserve all attributes from .p11-kit files


author: Daiki Ueno <dueno@redhat.com> - 0.23.22-1
changelog:
  - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
  - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
  - Add xsltproc to BR


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-17
changelog:
  - pam_keyinit: thread-safe implementation. Resolves: #1997969
  - pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25
changelog:
  - pam_motd: avoid unnecessary logging. Resolves: #2091062
  - pam_lastlog: check localtime_r() return value. Resolves: #2012871
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442


author: Brian C. Lane <bcl@redhat.com> - 3.2-33
changelog:
  - Switch gpt-header-move and msdos-overlap to python3 (bcl)
    Resolves: rhbz#1595810
  - Modify gpt-header-move and msdos-overlap to work with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-34
changelog:
  - Fix the length of several strncpy calls (bcl)
    Related: rhbz#1602652
  - parted.c: Always free peek_word (bcl)
    Related: rhbz#1602652
  - parted.c: Make sure dev_name is freed (bcl)
    Related: rhbz#1602652
  - t6100-mdraid-partitions: Use v0.90 metadata for the test (bcl)
  - Fix msdos-overlap to work correctly with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-35
changelog:
  - Use python3-devel in buildroot
    Resolves: rhbz#1615576
  - linux.c: Use sys/sysmacros.h for major/minor
    Resolves: rhbz#1615592


author: Brian C. Lane <bcl@redhat.com> - 3.2-37
changelog:
  - Add CI tests
    Resolves: rhbz#1653912
  - t6000-dm: Stop using private lvm root
    Related: rhbz#1653912


author: Brian C. Lane <bcl@redhat.com> - 3.2-39
changelog:
  - tests: Add a test for resizepart on a busy partition (bcl)
    Related: rhbz#1861804
  - parted: Preserve resizepart End when prompted for busy partition (bcl)
    Resolves: rhbz#1861804
  - Fix end_input usage in do_resizepart (bcl)
    Related: rhbz#1861804
  - tests: Test incomplete resizepart command (bcl)
    Related: rhbz#1861804
  - Fix resizepart iec unit end sector (psusi)
    Related: rhbz#1861804
  - libparted: Fix endian bug in bsd.c (AWilcox)
    Resolves: rhbz#1980105


author: Than Ngo <than@redhat.com> - 2.7.6-10
changelog:
  - CVE-2019-13636 , Don't follow symlinks unless --follow-symlinks is given
  - Resolves: #1665928, patch has a huge error output and segfaults when the file to be patched does not exist


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: Petr Pisar <ppisar@redhat.com> - 8.41-6
changelog:
  - Fix returning unset groups in POSIX interface if REG_STARTEND has a non-zero
    starting offset (upstream bug #2244)


author: Petr Pisar <ppisar@redhat.com> - 8.42-2
changelog:
  - Fix handling UTF and start-of-pattern options in C++ wrapper
    (upstream bug #2283)
  - Fix an error message and locale handling in pcregrep tool


author: Petr Pisar <ppisar@redhat.com> - 8.42-3
changelog:
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256
    (bug #1619228)


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.5-1
changelog:
  - Rebase to 1.9.5 version to address race conditions (#2014641)
  - Drop dowstream polkit policy to avoid repeated authentication requests in remote sessions (#1928154)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
changelog:
  - 5.26.3 bump (bug #1655526)
  - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)
  - Fix CVE-2018-18312 (heap buffer overflow in regcomp.c) (bug #1654922)
  - Fix CVE-2018-18313 (heap buffer overflow read in regcomp.c) (bug #1654924)
  - Fix CVE-2018-18314 (heap based buffer overflow) (bug #1654925)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Paul Howarth <paul@city-fan.org> - 1.1903-1
changelog:
  - Update to 1.1903
    - Fix documentation typos (CPAN RT#84981)
    - Add -w and -i switches to diffnew.pl (CPAN RT#69945)
    - Remove Algorithm::DiffOld from the index; the module is still distributed
      with Algorithm::Diff, but is not indexed on CPAN because this is an
      ***UNAUTHORIZED*** release of Algorithm::DiffOld
  - Add patch to generate provide for perl(Algorithm::DiffOld)
  - Drop %defattr, redundant since rpm 4.4
  - General spec tidy-up


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.54-6
changelog:
  - Adjust to sqlite-3.22.0 (bug #1543286)
  - Add new index constraint ops introduced in SQLite 3.21.0 to PerlData


author: Jan Pazdziora <jpazdziora@redhat.com> - 6.56-1
changelog:
  - 1372494 - Rebase to upstream version 6.56.
  - 1372494 - Rebase to upstream version 6.55, build failed due to
    https://rt.cpan.org/Public/Bug/Display.html?id=117404.


author: Petr Pisar <ppisar@redhat.com> - 2.12-367
changelog:
  - Fix CVE-2017-6512 (setting arbitrary mode on an arbitrary file in rmtree()
    and remove_tree()) (bug #1457834)


author: Petr Pisar <ppisar@redhat.com> - 3.28-2
changelog:
  - Introduce a build-condition on groff
  - Rename a _without_tk build-condition to
    _without_perl_Pod_Perldoc_enables_tk_test


author: Paul Howarth <paul@city-fan.org> - 1.71-5
changelog:
  - Soften Business::ISBN dependency from Requires: to Suggests: to avoid
    pulling in gd and X libraries (#1380152)


author: Petr Pisar <ppisar@redhat.com> - 3.10-2
changelog:
  - Net::libnetFAQ document replaced with a hyper link because of the Artistic
    license (CPAN RT#117888)


author: Paul Howarth <paul@city-fan.org> - 1:0.236-1
changelog:
  - Update to 0.236
    - Add Travis test configuration
    - Make test for PMC availability more reliable
    - Disable benchmark test rt62341.t as it runs out of memory on many smoker
      systems (CPAN RT#118310)
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1:0.237-1
changelog:
  - Update to 0.237
    - Don't load vars.pm (CPAN RT#132077)
  - Drop legacy Group: tag
  - Drop buildroot cleaning in %install section


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-19
changelog:
  - semodule: move module hashing into libsemanage (requires libsemanage-2.9-7)
  - semodule: add command-line option to detect module changes (#2049189)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-20
changelog:
  - python: Split "semanage import" into two transactions (#2063353)
  - semodule: rename --rebuild-if-modules-changed to --refresh (#2089802)
  - selinux-autorelabel: Do not force reboot (#2093133)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-21.1
changelog:
  - python: Harden tools against "rogue" modules (#2128976)
  - Update "pathfix" arguments to match ^^^ (#2128976)
  - python: Do not query the local database if the fcontext is non-local (#2124825)


author: Jan Rybar <jrybar@redhat.com> - 0.115-7
changelog:
  - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled
  - Mitigation of regression caused by fix of CVE-2018-19788
  - Resolves: rhbz#1693781
  - Resolves: rhbz#1693814


author: Panu Matilainen <pmatilai@redhat.com> - 1.18-1
changelog:
  - Rebase to popt 1.18 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.18-release)
  - Update URLs to rebooted upstream
  - Clean up ancient cruft from spec, use modern build macros


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.3.1-10
changelog:
  - Release bump and rebuild for relengs to be able to ship postfix-pcre,
    postfix-cdb, postfix-sqlite
    Resolves: rhbz#1745321


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: Tomas Korbar <tkorbar@redhat.com> - 2:3.5.8-5
changelog:
  - Backport dns SRV record resolution feature (RFC6186)
    Resolves: rhbz#1787010
  - Fix building in ZUUL CI
    Resolves: rhbz#2196577


author: Michal Sekletár <msekleta@redhat.com> - 0.1.0-5
changelog:
  - if interface has name in expected format print it to stdout (#1643515)
  - don't assign names to virtual devices (#1644294)


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-3
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: align manpage with procfs wording
  - watch: manpage presumes NTP on system
  - Resolves: rhbz#1827731
  - Resolves: rhbz#1829920
  - Resolves: rhbz#1583669


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-4
changelog:
  - pidof: new option to show kernel worker threads
  - pidof: empty input causes to show kernel worker threads
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640
  -


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-5
changelog:
  - version bump due to unspotted malformed backport patch
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-8
changelog:
  - vmstat: added -y option to omit first report
  - Resolves: rhbz#2027350
  - sysctl: backport config directory order, align with systemd
  - Resolves: rhbz#2111915


author: Jan Rybar <jrybar@redhat.com> - 6.6.3-2
changelog:
  - lastcomm: added new --pid option to show process PID and PPID
  - changelog update: 6.6.3-1 author change
  - spec file update: added correct access mode to created /var/account/pacct


author: Jan Rybar <jrybar@redhat.com> - 23.1
changelog:
  - Rebase to the newest upstream official release
  - Source0 updated to latest functional SourceForge URL format
  - peekfd manpage now not present if peekfd binary missing on given architecture
  - URL of the project updated
  - new tool pslog added with rebase
  - Resolves: #1460695


author: Tomas Popela <tpopela@redhat.com> - 3.40.1-6
changelog:
  - Fix the multilib problems by backporting fixes done by mhroncok from Fedora:
  - Move pure Python modules to a noarch subpackage
  - Ensure Python bytecode installed in multilib packages is bit-to-bit identical
    Resolves: rhbz#1915764


author: liuzhilin <liuzhilin@uniontech.com> - 1.11.5-6.0.1
changelog:
  - Remove releated unversioned python macro that not supported now
    (See https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/#_macros)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-3
changelog:
  - Python 2 binary package renamed to python2-chardet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.1.fb23-4
changelog:
  - Python 2 binary package renamed to python2-configshell
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Christian Heimes <cheimes@redhat.com> - 2.2.1-2
changelog:
  - Drop Python 2 subpackages from RHEL 8, fixes RHBZ#1589754
  - Remove unnecessary copy and shebang mangling


author: Christian Heimes <cheimes@redhat.com> - 2.3-1
changelog:
  - New upstream release 2.3
  - Fix AEAD tag truncation bug, CVE-2018-10903, RHBZ#1602755, RHBZ#1602932


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12.2-9
changelog:
  - Python 2 binary package renamed to python2-dmidecode
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miro Hrončok <mhroncok@redhat.com> - 0.13-1
changelog:
  - Updated to 0.13
  - Added python3 and python2 subpackages
  - Add --with tests
  - Modernize spec
  - Remove merged patch
  - Update upstream URL


author: Lumír Balhar <lbalhar@redhat.com> - 0.14-3
changelog:
  - Backport patch from upstream/rhel7 which allows pifconfig to show
    multiple IPv4 addresses for each interface
  - Move patches to dist-git
  - Resolves: rhbz#1652174


author: Carl George <carl@george.computer> - 1.6.1-1
changelog:
  - Latest upstream
  - Add patch0 to remove pytest-{cov,runner} deps
  - Share doc and license dir between subpackages
  - Enable EPEL PY3 build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.9-16
changelog:
  - Python 2 binary package renamed to python2-kmod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: John Kacur <jkacur@redhat.com> - 0.6.2-1
changelog:
  - Add bitmasklist_test
  - Clean-ups including using a more modern python spacing, tabbing, etc
  - Fix to parse number of cpus correctly on s390(x)
  Resolves: rhbz#1849215


author: John Kacur <jkacur@redhat.com> - 0.6.3-4
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2016204


author: John Dennis <jdennis@redhat.com> - 2.0.1-1
changelog:
  - Upgrade to upstream 2.0.1
  - port from jwt to jwcrypto (conditional build)
  - bring into alignment with rhel spec file


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-13
changelog:
  - Use the system level root certificate instead of the one bundled in certifi
  - Resolves: rhbz#1655255


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  Resolves: rhbz#1962856


author: mulhern <amulhern@redhat.com> - 0.19.0
changelog:
  - Never raise a DeviceNotFoundError when iterating over a device enumeration
  - Device.subsystem() now returns None if device has no subsystem
  - Add DeprecationWarnings to deprecated Device methods
  - Replace "/" with "!" in Device.from_name() sys_name parameter
  - Add some unstable classes for parsing some kinds of values
  - Make version info more like Python's including micro numbers and levels
  - Refactor some internal modules into subdirectories
  - Work on tests and reproducers


author: mulhern <amulhern@redhat.com> - 0.20.0
changelog:
  - Remove parsing code added in previous release
  - No longer do CI for Python 2.6
  - Eliminate all wildcard imports and __all__ statements
  - No longer use deprecated Device.from_sys_path() method
  - Minor pylint induced changes
  - Documentation fixes


author: mulhern <amulhern@redhat.com> - 0.21.1
changelog:
  - Deprecate use of Device object as mapping from udev property names to values
  - Add a Properties class and a Device.properties() method for udev properties
  - Fix places where Device object was incorrectly used in a boolean context
  - Return an empty string, not None, if the property value is an empty string
  - Exceptions re-raised from libudev calls now have a message string
  - Insert a warning about using a Device in a boolean context in docs
  - Infrastructure for vagrant tests is removed
  - Various internal refactorings
  - Extensive test improvements
  - Numerous documentation fixes


author: Tomas Orsava <torsava@redhat.com> - 2.18.4-6
changelog:
  - Skip all tests needing httpbin: httpbin has too many dependencies to be
    shipped in RHEL just for build-time package tests


author: Lumír Balhar <lbalhar@redhat.com> - 2.20.0-4
changelog:
  - Bump release to fix upgrade path
    from 2.20.0-2.1.el8_1 via 2.20.0-3.el8_8 to 2.20.0-4.el8
  Related: rhbz#2209469


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5-5
changelog:
  - Python 2 binary package renamed to python2-schedutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-8
changelog:
  - Python 2 binary package renamed to python2-slip
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-10
changelog:
  - Also rename python-slip-dbus and python-slip-gtk to python2-*
  - Add missing %python_provide macros
  - Use new python2- names in dependencies


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6.4-12
changelog:
  - Make firewalld to not log errors when running commands as root
    in the absence of polkitd.
  Resolves: rhbz#2076606


author: Tomas Orsava <torsava@redhat.com> - 1.24.2-1
changelog:
  - Rebased to 1.24.2 to fix CVE-2019-11324
  - Added patches for CVE-2019-11236 (AKA CVE-2019-9740)
  - Resolves: rhbz#1703361 rhbz#1706026


author: Lumír Balhar <lbalhar@redhat.com> - 1.24.2-3
changelog:
  - Enable TLS 1.3 post-handshake authentication
  - Adjust RECENT_DATE variable according to rules
  Resolves: rhbz#1726743


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.3.0-11
changelog:
  - Python 2 binary package renamed to python2-urwid
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David Cantrell <dcantrell@redhat.com> - 1.3.1-2
changelog:
  - Apply upstream fix for EINTR handling in test_vterm test case
  - Apply upstream fix for test_remove_watch_file flakiness
  - Apply upstream fix for test_vterm handling of NUL characters


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-6
changelog:
  - Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
  Resolves: rhbz#1889886


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-9
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-10
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  Resolves: rhbz#2047376


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-11
changelog:
  - Security fix for CVE-2015-20107
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2075390


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-12
changelog:
  - Security fix for CVE-2022-45061: CPU denial of service via inefficient IDNA decoder
  Resolves: rhbz#2144072


author: Jacob Wang <jacob.wang@openanolis.org> - 2.7.18-13
changelog:
  - Pick up fix from Upstream
    Fixup for CVE-2023-24329 patch name [f9e9f76](cstratak@redhat.com)
    Fix for CVE-2023-24329 [3f00cdc](lbalhar@redhat.com)


author: Charalampos Stratakis <cstratak@redhat.com> - 9.0.3-15
changelog:
  - Use the system level root certificate instead of the one bundled in certifi
  Resolves: rhbz#1659551


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  Resolves: rhbz#1870184


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: zhangbinchen <zhangbinchen@openanolis.org> - 3.6.8-51.0.1.1
changelog:
  - Add Anolis platform cherry-pick [9a96461]
  - Support Loongarch for python3
  - Fix testcase fails on loongarch64


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.10.0-3
changelog:
  - Python 2 binary package renamed to python2-pywbem
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tony Asleson <tasleson@redhat.com> - 0.11.0-8
changelog:
  - Fix the conflict with sblim-wbemcli: RHBZ #1757855
  - Corrected warning about multiple file inclusion


author: Petr Pisar <ppisar@redhat.com> - 1:4.05-17
changelog:
  - Support grace period expirations past 2038 year for XFS
  - Add a synopsis for a project quota option in the quota tool
  - Add a --filesystem option to the quota tool
  - Complain that ext4 external quota files are deprecated


author: Petr Pisar <ppisar@redhat.com> - 1:4.06-2
changelog:
  - Remove a dead code from process_file() (upstream bug #54)
  - Fix a compilation warning in quotaops.c
  - Warn when kernel XFS large time stamp does fit into (32-bit) user-space
    time_t
  - Do not use a pointless compiler-internal __P() macro


author: Aristeu Rozanski <aris@redhat.com> 0.6.7-1
changelog:
  - Bumped to 0.6.7
  - Backported patches that sit on top of 0.6.7 without being released
    Related: rhbz#2052190


author: Honggang Li <honli@redhat.com> - 32.0-4
changelog:
  - Update to upstream stable release v32.1
  - Fix mlx5 pyverbs CQ test
  - Resolves: bz1915745, bz1907377


author: Honggang Li <honli@redhat.com> - 37.1-1
changelog:
  - Update to upstream v37.1 release for features and fixes
  - Resolves: bz1982200, bz1990120, bz1982131


author: Kamal Heib <kheib@redhat.com> - 46.0-1
changelog:
  - Rebase to upstream release v46.0
  - Resolves: rhbz#2170066, rhbz#2209685, rhbz#2159635, rhbz#2167517


author: Sumit Bose <sbose@redhat.com> - 0.16.3-19
changelog:
  - Realm join fails with error 'Failed to join domain: failed to lookup
    DC info ...'
    Resolves: rhbz#1859503
  - realm command to use option like dnshostname=fqdn
    Resolves: rhbz#1867912


author: Sumit Bose <sbose@redhat.com> - 0.16.3-20
changelog:
  - realmd should handle default_realm in krb5.conf
    Resolves: rhbz#1791016
  - [RFE] Enable LDAPS functionality in realmd join
    Resolves: rhbz#1826964


author: Sumit Bose <sbose@redhat.com> - 0.16.3-24
changelog:
  - Avoid duplicated log messages and use Samba's new CLI options
    Resolves: rhbz#2024248
    Resolves: rhbz#2028528


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is
    incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-6
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm is not
    run in a container (bz 1975554)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-1.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Fix a number of issues (bz 1974103, bz 1980421, bz 1859154)


author: Vladis Dronov <vdronov@redhat.com> - 6.14-4.git.b2b7934e
changelog:
  - Update rng-tools to v6.14 @ b2b7934e (bz 2015570)
  - Update jitterentropy library to v3.3.1 @ 887c9871
  - Add a config file for storing rngd options
  - Fix a security issue found by a covscan in jitterentropy library


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update rng-tools to v6.15 @ 172bf0e3 (bz 2075974)
  - Update jitterentropy library to v3.4.0 @ 887c9871
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update rng-tools to v6.15 @ 6dcc9ec2 (bz 2124602)
  - Update jitterentropy library to v3.4.1 @ 4544e113
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update rng-tools to v6.15 @ cb8cc624 (bz 2141379)
  - Update jitterentropy library to v3.4.1 @ 7bf9f85d
  - Fix a stack corruption on s390x
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-1
changelog:
  - Update rng-tools to v6.16 @ 0e560296 (bz 2174908)
  - Get rid of text relocations in -fPIE build
  - Add a hint for opensc package (bz 1845854)


author: Ondrej Vasik <ovasik@redhat.com> 0.1-13
changelog:
  - copy content of /etc/skel directory for root as posstrans,
    don't overwrite  existing files (#999114)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Liwei Ge <geliwei@openanolis.org> - 4.14.4-26.0.1
changelog:
  - Rebrand for Anolis OS
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Support loongarch for rpm
  - Add loongarch64 support for debugedit(doupengda@loongson.cn)
  - Modify the spec to add debugedit for loongarch64(zhangwenlong@loongson.cn)


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
changelog:
  - Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Jakub Martisko <jamartis@redhat.com> - 4.4-4
changelog:
  - When editing file inplace, the SELinux context should
    be based on the link instead of the target file itself.
    --follow-symlinks option remains unchanged
  - Resolves: #1401442


author: Jakub Martisko <jamartis@redhat.com> - 4.5-2
changelog:
  - fix "in-place edits on FUSE filesystems create files with all-zero mode bits"
  - Resolves: #1835761


author: Jakub Martisko <jamartis@redhat.com> - 4.5-5
changelog:
  - Minor cleanup - remove unused patch from the spec file too (related to 4.5-3)
  - Resolves: rhbz#1869253


author: Mahailiang <mahailiang@openanolis.org> - 4.5-5.0.1
changelog:
  - fix testsuite/inplace-selinux.sh check error
  - Sync from https://debbugs.gnu.org/cgi/bugreport.cgi?bug=35997


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-120
changelog:
  - Allow unconfined service inherit signal state from init
  Resolves: rhbz#2177254
  - Allow systemd-pstore delete kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow certmonger manage cluster library files
  Resolves: rhbz#2177836
  - Allow samba-rpcd work with passwords
  Resolves: rhbz#2107106
  - Allow snmpd read raw disk data
  Resolves: rhbz#2160000
  - Allow cluster_t dbus chat with various services
  Resolves: rhbz#2196524


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-121
changelog:
  - Update pkcsslotd policy for sandboxing 2/2
  Resolves: rhbz#2208162
  - Update pkcsslotd policy for sandboxing 1/2
  Resolves: rhbz#2208162
  - Allow abrt_t read kernel persistent storage files
  Resolves: rhbz#2207914
  - Add allow rules for lttng-sessiond domain
  Resolves: rhbz#2203509
  - Allow rpcd_lsad setcap and use generic ptys
  Resolves: rhbz#2107106
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  Resolves: rhbz#2107106
  - Dontaudit targetd search httpd config dirs
  Resolves: rhbz#2203720


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-122
changelog:
  - Update cyrus_stream_connect() to use sockets in /run
  Resolves: rhbz#2165752
  - Allow insights-client map generic log files
  Resolves: rhbz#2214572
  - Allow insights-client work with pipe and socket tmp files
  Resolves: rhbz#2207819
  - Allow insights-client getsession process permission
  Resolves: rhbz#2207819
  - Allow keepalived to manage its tmp files
  Resolves: rhbz#2179335


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-123
changelog:
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  Resolves: rhbz#2213606
  - Allow httpd tcp connect to redis port conditionally
  Resolves: rhbz#2213965
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: rhbz#2218362


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-124
changelog:
  - Add the files_getattr_non_auth_dirs() interface
  Resolves: rhbz#2076937
  - Update policy for the sblim-sfcb service
  Resolves: rhbz#2076937
  - Dontaudit sfcbd sys_ptrace cap_userns
  Resolves: rhbz#2076937
  - Label /usr/sbin/sos with sosreport_exec_t
  Resolves: rhbz#2167731
  - Allow sa-update manage spamc home files
  Resolves: rhbz#2222200
  - Allow sa-update connect to systemlog services
  Resolves: rhbz#2222200
  - Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t
  Resolves: rhbz#2222200


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-125
changelog:
  - Allow user_u and staff_u get attributes of non-security dirs
  Resolves: rhbz#2216151
  - Allow unconfined user filetrans chrome_sandbox_home_t 1/2
  Resolves: rhbz#2221573
  - Allow unconfined user filetrans chrome_sandbox_home_t 2/2
  Resolves: rhbz#2221573
  - Allow insights-client execmem
  Resolves: rhbz#2225233
  - Allow svnserve execute postdrop with a transition
  Resolves: rhbz#2004843
  - Do not make postfix_postdrop_t type an MTA executable file
  Resolves: rhbz#2004843
  - Allow samba-dcerpc service manage samba tmp files
  Resolves: rhbz#2210771
  - Update samba-dcerpc policy for printing
  Resolves: rhbz#2210771


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-126
changelog:
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
  Resolves: rhbz#2229726
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: rhbz#2177704
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
  Resolves: rhbz#2229726
  - Make insights_client_t an unconfined domain
  Resolves: rhbz#2225527
  - Allow insights-client create all rpm logs with a correct label
  Resolves: rhbz#2229559
  - Allow insights-client manage generic logs
  Resolves: rhbz#2229559


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128
changelog:
  - Allow ssh_agent_type manage generic cache home files
  Resolves: rhbz#2177704
  - Add chromium_sandbox_t setcap capability
  Resolves: rhbz#2221573


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-4
changelog:
  - Disable/remove neverallow options in frontends (#2184141)
  - AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-18
changelog:
  - Update patch to close label to reset libselinux state. Resolves: #1984740
  - useradd: check if subid range exists for user. Resolves: #2012929
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #1994269


author: Javier Martinez Canillas <javierm@redhat.com> - 15-12
changelog:
  - Fix firmware update bug in aarch64 caused by shim ignoring arguments
    Resolves: rhbz#1830871
  - Fix a shim crash when attempting to netboot
    Resolves: rhbz#1795654


author: Peter Jones <pjones@redhat.com> - 15-13
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-1
changelog:
  - Resolves: #1869292 Statistics Support - smc-tools part
  - Resolves: #1919225 Add SMC-D Setup Check (smc-tools)
  - Resolves: #1919240 Upgrade smc-tools to latest version


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Jan Jansky <jjansky@redhat.com> = 4.6.0-1
changelog:
  - [ultrapath] Add new plugin for Huawei UltraPath
    Resolves: bz2187407
  - [cleaner] Use data filter for extraction
    Resolves: bz2217906
  - [discovery] Enable the plugin by containers
    Resolves: bz2222134


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-3
changelog:
  - Resolves: rhbz#2219351 - [sssd] SSSD enters failed state after heavy load in the system [rhel-8.8.0.z]
  - Resolves: rhbz#2196838 - [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed' [rhel-8.8.0.z]


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8.1
changelog:
  RHEL 8.7.0.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161220


author: Liwei Ge <geliwei@openanolis.org> - 6.04-6.0.1
changelog:
  - Enable nonlinux for x86 build
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-69
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)
  - ci(lint): add shell linter - Differential ShellCheck (#2122499)
  - meson: do not compare objects of different types (#2122499)
  - journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE is deprecated since 0.9.74 (#2122499)
  - Fix build with µhttpd 0.9.71 (#2122499)
  - ci: replace LGTM with CodeQL (#2122499)
  - ci(mergify): Update policy - Drop LGTM checks (#2122499)
  - time-util: fix buffer-over-run (#2139391)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


