<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="139">
<package pkgid="d6d9586c68538b08b627eaea3ca82d5d00ec01b4ab20d24090e77cd9874b9c4c" name="389-ds" arch="aarch64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="5550cbaff9ef4c8777e1e2286e0c663c674205633ad1c23ed141efe97aada864" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="383627ed88637128564d0055b6e5556066b74735059262c075ad2afa5af62045" name="389-ds" arch="s390x">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="bcf0e00e7cfed8c396fcaec6caa91ea073a413f78de572001d3df7bb4a647d79" name="389-ds" arch="src">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="d3d205fe60e3e1c6bf2382e4fd75da46b0ca4179e86fe02ea3547c21e8f3b584" name="389-ds" arch="x86_64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="bbe4d0ec8253f0cb32bbef4ac83194008a43096e0eb6bf2ac7fc12ebc00df2dc" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="dae5b8cdc3910628875df70c05e4636d709be92da7b84dc1924121009f56c721" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="838ce2a6aa25364ee102b818cc330547875c9164090fa659ffb567e70df9bdf8" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="e93254fda80a69b7557d34fa03def4bca1e524cccdddf4cd744240880f5694aa" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="0ab4a0efd3247a4241de39eced6ffde24e021f9ca6be5d5965b6434835607d0e" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="a52f77ff3906f5b9cfb6cf36e3f8c51a619718beb7a00a9604a271789ee1b58d" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="e695d5928723b952e3a4245ecdae8dc86333062c3f6ed7e50c08d82594860b83" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="192e96ff9af21c6110017812b303505584ef982ed3981de818d5e9d409fec452" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="dab43f1f74d77f20585b4dae8a7581be41daddef00d1c10f4042d5940c16d0e6" name="lib389" arch="aarch64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="18b94138803d32b9f3832ecdda3623fa168ee319313d0a76596c3fe56a231b6d" name="lib389" arch="ppc64le">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="d9d2b05080c771ba771d04c0e37b2f89911109416c73638ab8d63818b370957c" name="lib389" arch="s390x">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="536f479087565906e29d86572bd9ca7628a04f831abda9a04b36fddcbfcd1e25" name="lib389" arch="x86_64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="c57be9387aa5c3f490f8516695177ebe2e0f5e2983ba1e0ef7911a6a00f8a828" name="libmariadbd-devel" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="efafb18cff07ab954b5bd1a8858a8824471041f15818c359400ff3530c4c566a" name="libmariadbd-devel" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="ee6b5b470f3a3a68ed42be21e225d30925d4090b95f9fbb88000640ceeac5468" name="libmariadbd-devel" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="ce6872e321ef0c86a17304d7494bb89bf308fc63636a4e82b1b9269b10dd85dd" name="libmariadbd-devel" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="e16c4b9be9a88c93f5327a12d4ef7da81f060397fe838c1d713208d0ffa692f5" name="libmariadbd19" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="07b0a6aad591e832810e241de7b77491476519877873398db6a6f3b487d28b6a" name="libmariadbd19" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="00d87e498478a6963d593577ef9e09e7294d6814cdc640ac9cd88d7e91658fc8" name="libmariadbd19" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="73459ab9b0b35f7b4f9b86f20ce4eeea0740594f9a8875fd8e39e19709e1925e" name="libmariadbd19" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="56141920410692fe17bf0507b6c5abcbc072930845fc791457218737dabe7784" name="libsvrcore0" arch="aarch64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="d3c9ac6461c099932babd0ebea87f8af55b6c66d7e5220d452ebb8e82fcddd2f" name="libsvrcore0" arch="ppc64le">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="1a6570411d5e8aec9ca9681e5b891eb92adff6b71bc2a51a96607064e80fcf8f" name="libsvrcore0" arch="s390x">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="abd57955654f1634d46273fd0ee8952d6e93b4e6ecc599679f5628a04057f9ea" name="libsvrcore0" arch="x86_64">
  <version epoch="0" ver="3.0.1~git1.1f95b57" rel="2.2"/>
  <changelog author="william.brown@suse.com" date="1649851200">- Update to version 2.1.1~git8.d50340ba5:
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389</changelog>
  <changelog author="william.brown@suse.com" date="1650542400">- bsc#1196526 - Add systemd override to correct ordering with krb components
- Update to version 2.1.1~git13.beb382e1b:
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 5247 - BUG - Missing attributes in samba schema (#5248)
  * Issue 5242- Craft message may crash the server (#5243)</changelog>
  <changelog author="william.brown@suse.com" date="1652356800">- Add missing devel library on zlib for log compression
- Force openssl as libressl is not compatible with rust ssl needs</changelog>
  <changelog author="william.brown@suse.com" date="1653912000">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.1.1~git22.faef73366:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication</changelog>
  <changelog author="william.brown@suse.com" date="1657108800">- Update to version 2.2.2~git0.55e2c7ab3:
  * Bump version to 2.2.2
  * Issue 5221 - fix covscan (#5359)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5346 - New connection table fails with ASAN failures (#5350)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5323 - BUG - improve skipping of monitor db (#5340)
  * Issue 5329 - Improve replication extended op logging
  * Issue 5343 - Various improvements to winsync
  * Issue 4932 - CLI - add parser aliases to long arg names</changelog>
  <changelog author="william.brown@suse.com" date="1659096000">- Update to version 2.2.2~git11.f002e9e09:
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5335 - RFE - Add Security Audit Log
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 981 Managed Entries betxnpreoperation - transaction not aborted on managed entry failure (#5369)
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)</changelog>
  <changelog author="william.brown@suse.com" date="1660132800">- Update _constraints due to random build failures caused by OBS environmental
  issues that aren't out fault. (out of disk, systemic builder issues).
- Add debugging about the environment to assist with OBS randomly failing
  in the future.</changelog>
  <changelog author="william.brown@suse.com" date="1662552000">- Update to version 2.3.0~git0.3db81913e:
  * Bump version to 2.3.0
  * Issue 5012 - Migrate pcre to pcre2 - remove match limit
  * Update CI tests
  * Issue 5356 - Make Rust non-optional and update default password storage scheme
  * Issue 5012 - Migrate pcre to pcre2
  * Issue 5428 - Fix regression with nscpEntryWsi computation
  * Fix missing 'not' in description (closes #5423) (#5424)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.3.0~git22.8fedec0:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5476 - RFE - add memberUid read aci by default (#5477)
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)</changelog>
  <changelog author="william.brown@suse.com" date="1679486400">- Update to version 2.3.2~git44.5e4551e:
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5681)
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 5661 - LMDB hangs while Rebuilding the replication changelog RUV (#5676)
  * Issue 5554 - Add more tests to security_basic_test suite
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 4758 - Add tests for WebUI</changelog>
  <changelog author="william.brown@suse.com" date="1681214400">- bsc#1210027 - apply upstream fix for setuptools
- Update to version 2.3.2~git53.a01e230:
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5701 - CLI - Fix referral mode setting (#5708)
  * Bump openssl from 0.10.45 to 0.10.48 in /src (#5709)
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 5697 - Obsolete nsslapd-ldapimaprootdn attribute (#5698)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Issue 4812 - Listener thread does not scale with a high num of established connections (#5706)</changelog>
  <changelog author="pgajdos@suse.com" date="1681819200">- python-six is not required</changelog>
  <changelog author="william.brown@suse.com" date="1682510400">- Update to version 2.4.0~git0.87efeb2:
  * Bump version to 2.4.0
  * Issue 5156 - RFE that implement slapi_memberof (#5694)
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 4758 - Add tests for WebUI
  * Issue 5718 - Memory leak in connection table (#5719)
  * Issue 5705 - Add config parameter to close client conns on failed bind (#5712)
  * Issue 4758 - Add tests for WebUI
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations</changelog>
  <changelog author="william.brown@suse.com" date="1684929600">- Update to version 2.4.0~git18.37ec5cd:
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Bump version to 2.4.1
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5722 - fix compilation warnings (#5771)
  * Issue 5765 - Improve installer selinux handling
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)</changelog>
  <changelog author="dimstar@opensuse.org" date="1691668800">- Update to version 2.4.0~git69.89c2de5:
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 4758 - Add tests for WebUI
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.4.3
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)</changelog>
  <changelog author="william.brown@suse.com" date="1692014400">- Update to version 2.4.0~git74.4297d88:
  * issue 5890 part 2 - Need a tester for testing multiple listening thread feature (#5897)
  * Issue i5846 - Crash when lmdb import is aborted (#5881)
  * Issue 5894 - lmdb import error fails with Could not store the entry (#5895)
  * Issue 5890 - Need a tester for testing multiple listening thread feature (#5891)
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- Update to version 2.4.0~git113.84a845c:
  * Issue 5980 - Improve instance startup failure handling (#5991)
  * Issue 5976 - Fix freeipa install regression with lmdb (#5977)
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)
  * Bump version to 2.5.0
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Revert "Issue 5761 - Worker thread dynamic management (#5796)" (#5970)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5786 - Update permissions for Release workflow
  * Issue 5960 - Subpackages should have more strict interdependencies
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 4843 - Fix dscreate create-template issue (#5950)
  * bugfix for --passwd-file not working on latest version (#5934)
  * Issue 5843 - dsconf / dscreate should be able to handle lmdb parameters (#5943)
  * Bump postcss from 8.4.24 to 8.4.31 in /src/cockpit/389-console (#5945)
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 1925 - Add a CI test (#5936)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 1870 - Add a CI test (#5929)
  * Issue 843 - Add a warning to slapi_valueset_add_value_ext (#5925)
  * Issue 5761 - Worker thread dynamic management (#5796)
  * Issue 1802 - Improve ldclt man page (#5928)
  * Issue 1456 - Add a CI test that verifies there is no issue (#5927)
  * Issue 1317 - Add a CI test (#5923)
  * Issue 1081 - CI - Add more tests for overwriting x-origin issue (#5815)
  * Issue 1115 - Add a CI test (#5913)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5914 - UI - server settings page validation improvements and db index fixes
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5902 - Fix previous commit regression (#5919)
  * pass instance correctly to ds_is_older (#5903)
  * Issue 5909 - Multi listener hang with 20k connections (#5910)
  * Issue 5722 - improve testcase (#5904)
  * Issue 5203 - outdated version in provided metadata for lib389
  * Bug Description:</changelog>
  <changelog author="william.brown@suse.com" date="1702468800">- Update to support newer obs-service-cargo-vendor</changelog>
  <changelog author="william.brown@suse.com" date="1705492800">- Update to version 2.4.0~git126.5936946:
  * Issue 6028 - vlv index keys inconsistencies (#6031)
  * Issue 5989 - RFE support of inChain Matching Rule (#5990)
  * Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026)
  * Issue 6015 - Fix typo remeber (#6014)
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 4673 - Update Rust crates
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 5954 - Disable Transparent Huge Pages
  * Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999)
  * Issue 5993 - Fix several race condition around CI tests (#5996)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Bump openssl from 0.10.55 to 0.10.60 in /src (#5995)</changelog>
  <changelog author="william.brown@suse.com" date="1706875200">- Update to version 3.0.1~git1.1f95b57:
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Bump version to 3.0.1
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6051 - Drop unused pytest markers
  * Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Switch default backend to lmdb and bump version to 3.0 (#6013)
  * Issue 6032 - Replication broken after backup restore (#6035)
  * Issue 6037 - Server crash at startup in vlvIndex_delete (#6038)
  * Issue 6034 - Change replica_id from str to int</changelog>
</package>
<package pkgid="51ec7a72995a6ce24c4d25f0a8defac19642453ac3e2a05752d213e7466aee1e" name="mariadb" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="55dccdadaf251b6d8d35371121a443d48f8250e677d775fd1300568893c440db" name="mariadb" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="36bff41469806afb5b1adc0d6400ada55080655a6c0e1c79374b73403d7e4fc4" name="mariadb" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="822f9127600d588d5c7fe031b2fdff1658e4ffae1b32b52fa78fcf71596e494c" name="mariadb" arch="src">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="09f997017c635eb6441fb40668f390bf8bf29af4f37bb9f8315f20da90014cfa" name="mariadb" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="7aa23fda6020ea3afa5e31efe5e06a98522f342f02f0b18a7ea96259d3b9338c" name="mariadb-bench" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="dccff4b639ddfac861d6cbd9c644be9c5440ac1a7afde7210679e327e8ecb9a4" name="mariadb-bench" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="d998a06f3d68a7e208e3832d413b8d6034c99454cb9b8f472cda7ff4f23f4a7e" name="mariadb-bench" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="310bf51d7834352aed03dd4b7a2fed477cbbaa68dfedc34c841a664826a56a88" name="mariadb-bench" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="7c3ecf4ac8e28f78771ebc9cf55b2595d1ab22644ff04ab4995e7f95579edeb5" name="mariadb-client" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="ce9950dc9c5ce0e680a825d4a85afde1baa8f536515c4b6140e72ca4cca261f2" name="mariadb-client" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="0627d81f6bc376e4341157c5a3823b0b6b57bd335c978c3dbbebd20f491ddd08" name="mariadb-client" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="150cb923b5383b336698066ff597d51e4246290a5a206cecaa2eed186700a6a9" name="mariadb-client" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="9f7fbbcd2d321ebdc05598d48d4a5a64bae0506d0108fb4a9b2e0fe5df7191da" name="mariadb-errormessages" arch="noarch">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="9675977666b5d20ea2e9203f6e65896603c1ae1545d8b8596261525f8e41d869" name="mariadb-galera" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="f5e485e9318f59d45e9e4a25d8f40dada5d2e16d07462a6dbc1ceec6f2944f55" name="mariadb-galera" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="b3c9b86a968c38e4d70cdcf49f37960ce49e13090e89ecfd09daa57ad92a7c8d" name="mariadb-galera" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="e13af9af5dc39e989fd0bb3575167d18e031ebf1eda9bfa5e23843825eca735c" name="mariadb-galera" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="34fd00751ba6c89267d15aa2d51b919e672065bf6c83a3e3b84e7a9880d436b2" name="mariadb-rpm-macros" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="6a7d7a931b15c207891fd85c5c5b978fa920cf678646a49d3b458efdf465956a" name="mariadb-rpm-macros" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="50dcdd76b552caa4a4b5f811563d1ef9f5f76c234af557f7b6a820ee181c21e7" name="mariadb-rpm-macros" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="cb45ce0655527532dca235c5e94df60064b440c7b0e963ba90daca614490e274" name="mariadb-rpm-macros" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="7aa3d87f0b35be8933d7bd4bcdce0ffac1049e5d8e739f4a803c8fec6ce28bc2" name="mariadb-test" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="93e7de8894d020f0860c0976c8d6b437d19f40a4d323aaecce4970d39cff8561" name="mariadb-test" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="02d4c21f7b0b7a0cffd3a189424fef6f0c9cba9c20fe22ad649d5e5bdeaa352c" name="mariadb-test" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="c3d80d49e3c51f20ad156141cd92c0daca80dbf95b4457e0027fe4196fd2e395" name="mariadb-test" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="802077fc39385782e068c9791b097b49409ebd04c4184c1ad467e69c33e9908f" name="mariadb-tools" arch="aarch64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="b9f9ccf1d86d2234261d9b8f4b03002b6e8f6b6e87b664acfeda52cf74a07aae" name="mariadb-tools" arch="ppc64le">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="b3776841303cf8cfa3efede5d133385401cb1ee3e9cb96eac8a11796c4d80d11" name="mariadb-tools" arch="s390x">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="a000ec217019ac8ac0354bf89f73f658290a205c698843d2c4129f23197f378a" name="mariadb-tools" arch="x86_64">
  <version epoch="0" ver="12.3.2" rel="2.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1744718400">- fix build with pcre2 10.45 boo#1241198, adding
  mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
  based on upstream</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1745496000">- Fix galera condition in SLFO
- Fix exclude list for galera-related files when galera is disabled</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1746619200">- Update list of skipped tests</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1749124800">- Update to 11.8.2:
    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/
    https://mariadb.com/kb/en/mariadb-11-8-2-changelog/
- Remove patch included in upstream release
  * mariadb-11.7.2-MDEV-36078-PCRE2-10.45-breaks-main.func_regexp_pcre-.patch
- Refresh gcc13-fix.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1756987200">- Update to 11.8.3:
    https://mariadb.com/docs/release-notes/community-server/mariadb-11-8-series/mariadb-11.8.3-release-notes
    https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-11-8-series/mariadb-11.8.3-changelog</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1757592000">- Remove pie linker flag, fixing builds with cmake 4.1 (bsc#1248263)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1757678400">- Add upstream patch to fix build on armv9:
  * mariadb-fix-armv9.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1761393600">- disable pcre2 tests boo#1252518</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1762948800">- Add fix-MDEV-32585.patch (boo#1237555)
  * Fixes non-null-terminated array which caused a buffer overflow
    in get_defaults_options()</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1765281600">- Update to 11.8.5:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.5
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.4
  * fixes for the following security vulnerabilities:
    11.8.5: none
    11.8.4: none
- Add %license tags to license files (boo#1252162)
- Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files
- Remove client plugin parsec.so, it is shipped by libmariadb_plugins
  (boo#1243040, boo#1254476)
- Refresh fix-pamdir.patch
- Drop mariadb-fix-armv9.patch (included in upstream release)
- Update skipped test list</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1765454400">- Add missing pam configuration file for the shipped auth_pam.so plugin
  (bsc#1254485)
  * mysql.pamd</changelog>
  <changelog author="rfrohl@suse.com" date="1766059200">-  make 'mysql-systemd-helper upgrade' selinux aware (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1769688000">- Fix incomplete SELinux labels during database update (bsc#1255024)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1770120000">- Add StateDirectory configs in systemd unit files to let systemd
  create mariadb datadir
- Let systemd-tmpfiles create log and secure-file-priv dirs
- Add permissions to the update message file</changelog>
  <changelog author="bwiedemann@suse.com" date="1771502400">- Add 0001-MDEV-38874-Make-tests-pass-after-2030.patch (bsc#1258504)
- Drop %jobs macro for reproducible builds (bsc#1237231)</changelog>
  <changelog author="ilya@ilya.top" date="1776340800">- Returned provider_lzma.so plugin (boo#1262217).</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1777896000">- Update to 11.8.6:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6
  * fixes for the following security vulnerabilities:
    11.8.6: CVE-2026-32710 (bsc#1260081)
    CVE-2026-3494  (bsc#1259176)
    CVE-2026-34303 (bsc#1266435)
    CVE-2026-35549 (bsc#1261413)
- Update skipped test list
- Add MDEV-38811.patch
  * Fixes crash in information_schema.table_constraints when --skip-grant-tables
    (bsc#1263153)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1779364800">- Update to 11.8.7:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.7
  * fixes for the following security vulnerabilities:
    11.8.7: CVE-2026-44173 (bsc#1266437)
    CVE-2026-44172 (bsc#1266438)
    CVE-2026-44171 (bsc#1266439)
    CVE-2026-44170 (bsc#1266440)
    CVE-2026-44169 (bsc#1266441)
    CVE-2026-44168 (bsc#1266442)
- Update spec for removal of README-wsrep file
- Add test pam modules in mariadb-test package
- Add new mariadb-migrate-config-file utility in mariadb-tools package
- Refresh 0001-MDEV-38874-Make-tests-pass-after-2030.patch
- Drop MDEV-38811.patch
  * Included in upstream release</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1780315200">- Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
  * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1781092800">- Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
- Refresh fix-pamdir.patch
- Update list of skipped tests
- Remove --ssl option when running the test suite as it was causing some failures
- Remove INFO_SRC (dropped upstream)
- Adjust file list and removal of systemd unit files for upstream changes in the galera config</changelog>
</package>
<package pkgid="dbb47236eacd5cd7d32c90e483bd89b8ac30232f7c5c87132e51f256b0e7f5b7" name="nginx" arch="aarch64">
  <version epoch="0" ver="1.31.2" rel="2.1"/>
  <changelog author="ilya@ilya.top" date="1744804800">- Updated to 1.27.5
  * https://nginx.org/en/CHANGES
  * Changed the maximum size limit for SSL sessions cached in shared
    memory has been raised to 8192.
  * Fixed in the "grpc_ssl_password_file", "proxy_ssl_password_file",
    and "uwsgi_ssl_password_file" directives when loading SSL certificates
    and encrypted keys from variables; the bug had appeared in 1.23.1.
  * Fixed in the $ssl_curve and $ssl_curves variables when using pluggable
    curves in OpenSSL.</changelog>
  <changelog author="okurz@suse.com" date="1747915200">- Changed service to prevent "timed out. Killing" messages on service stopping</changelog>
  <changelog author="rrahl0@opensuse.org" date="1748865600">- Updated to 1.28.0:
  * Fixed -Wunterminated-string-initialization with gcc15
  * HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value</changelog>
  <changelog author="ilya@ilya.top" date="1751025600">- Updated to 1.29.0
  * https://nginx.org/en/CHANGES
  * Added support for response code 103 from proxy and gRPC backends;
    the "early_hints" directive.
  * Added loading of secret keys from hardware tokens with OpenSSL provider.
  * Changed the logging level of SSL errors in a QUIC handshake has been
    changed from "error" to "crit" for critical errors, and to "info" for
    the rest; the logging level of unsupported QUIC transport parameters
    has been lowered from "info" to "debug".
  * Disabled OpenSSL 3.5 QUIC API support by default.</changelog>
  <changelog author="parag.jain@suse.com" date="1752667200">- Removed root privileges when running logrotate (bsc#1246090).</changelog>
  <changelog author="ilya@ilya.top" date="1752667201">- Changed nginx.logrotate and nginx-conf.patch files.
  * Removed hardcoded user and group definitions.
- Removed ending slashes wherever possible.</changelog>
  <changelog author="ilya@ilya.top" date="1755172800">- Updated to 1.29.1
  * https://nginx.org/en/CHANGES
  * Fixed processing of a specially crafted login/password when using
    the "none" authentication method in the ngx_mail_smtp_module might
    cause worker process memory disclosure to the authentication server
    (CVE-2025-53859) (boo#1248070).
  * Changed TLSv1.3 certificate compression is disabled by default.
  * Added the "ssl_certificate_compression" directive.
  * Added support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
  * Fixed the 103 response might be buffered when using HTTP/2 and the
    "early_hints" directive.
  * Fixed in handling "Host" and ":authority" header lines with equal
    values when using HTTP/2; the bug had appeared in 1.17.9.
  * Fixed in handling "Host" header lines with a port when using HTTP/3.
  * Fixed in the "none" parameter of the "smtp_auth" directive.</changelog>
  <changelog author="ilya@ilya.top" date="1759924800">- Updated to 1.29.2
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Fixed now the "ssl_protocols" directive works in a virtual server
    different from the default server when using OpenSSL 1.1.1 or newer.
  * Fixed SSL handshake always failed when using TLSv1.3 with OpenSSL
    and client certificates and resuming a session with a different SNI
    value; the bug had appeared in 1.27.4.
  * Fixed the "ignoring stale global SSL error" alerts might appear in
    logs when using QUIC and the "ssl_reject_handshake" directive; the
    bug had appeared in 1.29.0.
  * Fixed in delta-seconds processing in the "Cache-Control" backend
    response header line.
  * Fixed an XCLIENT command didn't use the xtext encoding.
  * Fixed in SSL certificate caching during reconfiguration.</changelog>
  <changelog author="ilya@ilya.top" date="1761652800">- Updated to 1.29.3
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Added the "add_header_inherit" and "add_trailer_inherit" directives.
  * Added the $request_port and $is_request_port variables.
  * Added the $ssl_sigalg and $ssl_client_sigalg variables.
  * Added the "volatile" parameter of the "geo" directive.
  * Added now certificate compression is available with BoringSSL.
  * Fixed now certificate compression is disabled with OCSP stapling.</changelog>
  <changelog author="ilya@ilya.top" date="1765368000">- Updated to 1.29.4
  * https://nginx.org/en/CHANGES
  * Added the ngx_http_proxy_module supports HTTP/2.
  * Added Encrypted ClientHello TLS extension support when using
    OpenSSL ECH feature branch; the "ssl_ech_file" directive.
  * Changed validation of host and port in the request line, "Host"
    header field, and ":authority" pseudo-header field has been changed
    to follow RFC 3986.
  * Changed now a single LF used as a line terminator in a chunked
    request or response body is considered an error.
  * Fixed when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation
    fault might occur in a worker process; the bug had appeared in 1.29.1.
  * Fixed a segmentation fault might occur in a worker process if the
    "try_files" directive and "proxy_pass" with a URI were used.</changelog>
  <changelog author="ilya@ilya.top" date="1770379200">- Updated to 1.29.5
  * https://nginx.org/en/CHANGES
  * Fixed an attacker might inject plain text data in the response from an SSL backend
    (CVE-2026-1642) (boo#1257675).
  * Fixed use-after-free might occur after switching to the next gRPC or HTTP/2 backend.
  * Fixed an invalid HTTP/2 request might be sent after switching to the next upstream.
  * Fixed a response with multiple ranges might be larger than the source response.
  * Fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends.
  * Fixed warning when compiling with MSVC 2022 x86.
  * Changed the logging level of the "ech_required" SSL error has been lowered from "crit" to "info".</changelog>
  <changelog author="ilya@ilya.top" date="1773144000">- Updated to 1.29.6
  * https://nginx.org/en/CHANGES
  * Added session affinity support; the "sticky" directive in the
    "upstream" block of the "http" module; the "server" directive
    supports the "route" and "drain" parameters.
  * Changed now nginx limits the size and rate of QUIC stateless reset packets.
  * Fixed receiving a QUIC packet by a wrong worker process could cause
    the connection to terminate.
  * Fixed "[crit] cache file ... contains invalid header" messages
    might appear in logs when sending a cached HTTP/2 response.
  * Fixed proxying to scgi backends might not work when using chunked
    transfer encoding and the "scgi_request_buffering" directive.
  * Fixed in the ngx_http_mp4_module.
  * Fixed nginx treated a comma as separator in the "Cookie" request
    header line when evaluating "$cookie_..." variables.
  * Fixed in IMAP command literal argument parsing.</changelog>
  <changelog author="ilya@ilya.top" date="1774353600">- Updated to 1.29.7
  * https://nginx.org/en/CHANGES
  * Fixed a buffer overflow might occur while handling a COPY or MOVE
    request in a location with "alias", allowing an attacker to modify
    the source or destination path outside of the document root
    (CVE-2026-27654) (boo#1260416).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module on 32-bit platforms might cause a worker process
    crash, or might have potential other impact (CVE-2026-27784) (boo#1260417).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module might cause a worker process crash, or might have
    potential other impact (CVE-2026-32647) (boo#1260420).
  * Fixed a segmentation fault might occur in a worker process if the
    CRAM-MD5 or APOP authentication methods were used and authentication
    retry was enabled (CVE-2026-27651) (boo#1260415).
  * Fixed an attacker might use PTR DNS records to inject data in
    auth_http requests, as well as in the XCLIENT command in the backend
    SMTP connection (CVE-2026-28753) (boo#1260418).
  * Fixed SSL handshake might succeed despite OCSP rejecting a client
    certificate in the stream module (CVE-2026-28755) (boo#1260419).
  * Fixed an invalid HTTP/2 request might be sent after switching to the
    next upstream if buffered body was used in the ngx_http_grpc_module.
  * Changed now the "keepalive" directive in the "upstream" block is enabled by default.
  * Changed now ngx_http_proxy_module supports keepalive by default; the
    default value for "proxy_http_version" is "1.1"; the "Connection"
    proxy header is not sent by default anymore.
  * Added the "multipath" parameter of the "listen" directive.
  * Added the "local" parameter of the "keepalive" directive in the "upstream" block.</changelog>
  <changelog author="mrueckert@suse.de" date="1774526400">- Enabled support to build with aws-lc instead of openssl to ship
  the http3/quic support</changelog>
  <changelog author="ilya@ilya.top" date="1775563200">- Updated to 1.29.8
  * https://nginx.org/en/CHANGES
  * Added the "max_headers" directive.
  * Added OpenSSL 4.0 compatibility.
  * Added the "include" directive inside the "geo" block supports wildcards.
  * Fixed in processing of HTTP 103 (Early Hints) responses from a proxied backend.
  * Fixed the $request_port and $is_request_port variables were not available in subrequests.</changelog>
  <changelog author="mrueckert@suse.de" date="1776168000">- Updated to 1.30.0
  - nginx-1.30.0 stable version has been released, incorporating
    new features and bug fixes from the 1.29.x mainline branch —
    including Early Hints, HTTP/2 to backend and Encrypted
    ClientHello, sticky sessions support for upstreams, Multipath
    TCP support, the default proxy HTTP version set to HTTP/1.1
    with keep-alive enabled, and more.
  * https://nginx.org/en/CHANGES
  * https://github.com/nginx/nginx/releases/tag/release-1.30.0</changelog>
  <changelog author="mrueckert@suse.de" date="1778673600">- Updated to 1.31.0 ( boo#1265228 boo#1265229 boo#1265230
  boo#1265231 boo#1265232 boo#1265233 )
  * ) Security: when using the "proxy_set_body" directive, an
    attacker might inject data in the proxied request to an HTTP/2
    backend (CVE-2026-42926). Thanks to Mufeed VH of Winfunc
    Research.
  * ) Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary
    code execution (CVE-2026-42945). Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an
    attacker to cause a disclosure of worker process memory or
    segmentation fault in a worker process (CVE-2026-42946).
    Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding
    from UTF-8 via the "charset_map" directive, allowing an
    attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-42934). Thanks to David Carlier.
  * ) Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address
    before validation, allowing an attacker to cause address
    spoofing (CVE-2026-40460). Thanks to Rodrigo Laneth.
  * ) Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-40701).
    Thanks to Leo Lin.
  * ) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
    "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding",
    "Upgrade" header lines, and "TE" with any value other than
    "trailers".
  * ) Change: the ngx_http_dav_module now rejects a COPY or MOVE
    requests when the source and destination resources are the
    same or have a parent-child collection relationship.
  * ) Change: the logging level of the "invalid alert" and "record
    layer failure" SSL errors, and of the "SSL alert number N" for
    any alert numbers has been lowered from "crit" to "info".
  * ) Change: now the "sticky" module can be disabled with the
  - -without-http_upstream_sticky_module configure option; the
  - -without-http_upstream_sticky configure option is deprecated.
  * ) Feature: the ngx_http_tunnel_module; support for
    authenticating to proxies in the "auth_basic", "satisfy", and
    "auth_delay" directives.
  * ) Feature: the "least_time" directive inside the "upstream" block.
  * ) Feature: the "proxy_ssl_alpn" directive in the stream module.
  * ) Bugfix: connections with HTTP/2 backends might not be cached
    when using the "proxy_set_body" or "proxy_pass_request_body"
    directives.
  * ) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might
    be transferred incorrectly if the first line was not fully
    read.</changelog>
  <changelog author="mrueckert@suse.de" date="1779451200">- Updated to 1.31.1 ( boo#1266215 CVE-2026-9256 )
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with overlapping
    captures in ngx_http_rewrite_module, potentially resulting in
    arbitrary code execution (CVE-2026-9256).
    Thanks to Mufeed VH of Winfunc Research.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697600">- Update to 1.31.2
  * ) Security: use-after-free might occur when using HTTP/3 and
    processing a specially crafted QUIC session, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-42530).
    Thanks to Trung Nguyen of CyStack.
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with
    "ignore_invalid_headers off;" and
    "large_client_header_buffers" with large configured values
    when proxying a specially crafted request to HTTP/2 or gRPC
    backend, allowing an attacker to cause worker process memory
    corruption or segmentation fault in a worker process
    (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
  * ) Security: a heap memory buffer overread might occur in a
    worker process while handling a specially sent response with
    decoding from UTF-8 via the "charset_map" directive, allowing
    an attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of
    CYBERONE.
  * ) Change: now the $request_id variable uses SipHash-2-4.
  * ) Feature: the $ssl_sigalgs variable.
  * ) Bugfix: a variable defined by the "split_clients" directive
    might be empty if all percentages were specified explicitly
    and summed up to 100%.
  * ) Bugfix: constant time "secure_link" hash comparison.
    Thanks to kodareef5.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697601">- Extend keyring file based on https://nginx.org/en/pgp_keys.html
  https://github.com/nginx/nginx/issues/1477</changelog>
</package>
<package pkgid="e2b85000dddeb59b0c6322f4aec232d9241eb973850c31f8f26c5f865533b3ab" name="nginx" arch="ppc64le">
  <version epoch="0" ver="1.31.2" rel="2.1"/>
  <changelog author="ilya@ilya.top" date="1744804800">- Updated to 1.27.5
  * https://nginx.org/en/CHANGES
  * Changed the maximum size limit for SSL sessions cached in shared
    memory has been raised to 8192.
  * Fixed in the "grpc_ssl_password_file", "proxy_ssl_password_file",
    and "uwsgi_ssl_password_file" directives when loading SSL certificates
    and encrypted keys from variables; the bug had appeared in 1.23.1.
  * Fixed in the $ssl_curve and $ssl_curves variables when using pluggable
    curves in OpenSSL.</changelog>
  <changelog author="okurz@suse.com" date="1747915200">- Changed service to prevent "timed out. Killing" messages on service stopping</changelog>
  <changelog author="rrahl0@opensuse.org" date="1748865600">- Updated to 1.28.0:
  * Fixed -Wunterminated-string-initialization with gcc15
  * HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value</changelog>
  <changelog author="ilya@ilya.top" date="1751025600">- Updated to 1.29.0
  * https://nginx.org/en/CHANGES
  * Added support for response code 103 from proxy and gRPC backends;
    the "early_hints" directive.
  * Added loading of secret keys from hardware tokens with OpenSSL provider.
  * Changed the logging level of SSL errors in a QUIC handshake has been
    changed from "error" to "crit" for critical errors, and to "info" for
    the rest; the logging level of unsupported QUIC transport parameters
    has been lowered from "info" to "debug".
  * Disabled OpenSSL 3.5 QUIC API support by default.</changelog>
  <changelog author="parag.jain@suse.com" date="1752667200">- Removed root privileges when running logrotate (bsc#1246090).</changelog>
  <changelog author="ilya@ilya.top" date="1752667201">- Changed nginx.logrotate and nginx-conf.patch files.
  * Removed hardcoded user and group definitions.
- Removed ending slashes wherever possible.</changelog>
  <changelog author="ilya@ilya.top" date="1755172800">- Updated to 1.29.1
  * https://nginx.org/en/CHANGES
  * Fixed processing of a specially crafted login/password when using
    the "none" authentication method in the ngx_mail_smtp_module might
    cause worker process memory disclosure to the authentication server
    (CVE-2025-53859) (boo#1248070).
  * Changed TLSv1.3 certificate compression is disabled by default.
  * Added the "ssl_certificate_compression" directive.
  * Added support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
  * Fixed the 103 response might be buffered when using HTTP/2 and the
    "early_hints" directive.
  * Fixed in handling "Host" and ":authority" header lines with equal
    values when using HTTP/2; the bug had appeared in 1.17.9.
  * Fixed in handling "Host" header lines with a port when using HTTP/3.
  * Fixed in the "none" parameter of the "smtp_auth" directive.</changelog>
  <changelog author="ilya@ilya.top" date="1759924800">- Updated to 1.29.2
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Fixed now the "ssl_protocols" directive works in a virtual server
    different from the default server when using OpenSSL 1.1.1 or newer.
  * Fixed SSL handshake always failed when using TLSv1.3 with OpenSSL
    and client certificates and resuming a session with a different SNI
    value; the bug had appeared in 1.27.4.
  * Fixed the "ignoring stale global SSL error" alerts might appear in
    logs when using QUIC and the "ssl_reject_handshake" directive; the
    bug had appeared in 1.29.0.
  * Fixed in delta-seconds processing in the "Cache-Control" backend
    response header line.
  * Fixed an XCLIENT command didn't use the xtext encoding.
  * Fixed in SSL certificate caching during reconfiguration.</changelog>
  <changelog author="ilya@ilya.top" date="1761652800">- Updated to 1.29.3
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Added the "add_header_inherit" and "add_trailer_inherit" directives.
  * Added the $request_port and $is_request_port variables.
  * Added the $ssl_sigalg and $ssl_client_sigalg variables.
  * Added the "volatile" parameter of the "geo" directive.
  * Added now certificate compression is available with BoringSSL.
  * Fixed now certificate compression is disabled with OCSP stapling.</changelog>
  <changelog author="ilya@ilya.top" date="1765368000">- Updated to 1.29.4
  * https://nginx.org/en/CHANGES
  * Added the ngx_http_proxy_module supports HTTP/2.
  * Added Encrypted ClientHello TLS extension support when using
    OpenSSL ECH feature branch; the "ssl_ech_file" directive.
  * Changed validation of host and port in the request line, "Host"
    header field, and ":authority" pseudo-header field has been changed
    to follow RFC 3986.
  * Changed now a single LF used as a line terminator in a chunked
    request or response body is considered an error.
  * Fixed when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation
    fault might occur in a worker process; the bug had appeared in 1.29.1.
  * Fixed a segmentation fault might occur in a worker process if the
    "try_files" directive and "proxy_pass" with a URI were used.</changelog>
  <changelog author="ilya@ilya.top" date="1770379200">- Updated to 1.29.5
  * https://nginx.org/en/CHANGES
  * Fixed an attacker might inject plain text data in the response from an SSL backend
    (CVE-2026-1642) (boo#1257675).
  * Fixed use-after-free might occur after switching to the next gRPC or HTTP/2 backend.
  * Fixed an invalid HTTP/2 request might be sent after switching to the next upstream.
  * Fixed a response with multiple ranges might be larger than the source response.
  * Fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends.
  * Fixed warning when compiling with MSVC 2022 x86.
  * Changed the logging level of the "ech_required" SSL error has been lowered from "crit" to "info".</changelog>
  <changelog author="ilya@ilya.top" date="1773144000">- Updated to 1.29.6
  * https://nginx.org/en/CHANGES
  * Added session affinity support; the "sticky" directive in the
    "upstream" block of the "http" module; the "server" directive
    supports the "route" and "drain" parameters.
  * Changed now nginx limits the size and rate of QUIC stateless reset packets.
  * Fixed receiving a QUIC packet by a wrong worker process could cause
    the connection to terminate.
  * Fixed "[crit] cache file ... contains invalid header" messages
    might appear in logs when sending a cached HTTP/2 response.
  * Fixed proxying to scgi backends might not work when using chunked
    transfer encoding and the "scgi_request_buffering" directive.
  * Fixed in the ngx_http_mp4_module.
  * Fixed nginx treated a comma as separator in the "Cookie" request
    header line when evaluating "$cookie_..." variables.
  * Fixed in IMAP command literal argument parsing.</changelog>
  <changelog author="ilya@ilya.top" date="1774353600">- Updated to 1.29.7
  * https://nginx.org/en/CHANGES
  * Fixed a buffer overflow might occur while handling a COPY or MOVE
    request in a location with "alias", allowing an attacker to modify
    the source or destination path outside of the document root
    (CVE-2026-27654) (boo#1260416).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module on 32-bit platforms might cause a worker process
    crash, or might have potential other impact (CVE-2026-27784) (boo#1260417).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module might cause a worker process crash, or might have
    potential other impact (CVE-2026-32647) (boo#1260420).
  * Fixed a segmentation fault might occur in a worker process if the
    CRAM-MD5 or APOP authentication methods were used and authentication
    retry was enabled (CVE-2026-27651) (boo#1260415).
  * Fixed an attacker might use PTR DNS records to inject data in
    auth_http requests, as well as in the XCLIENT command in the backend
    SMTP connection (CVE-2026-28753) (boo#1260418).
  * Fixed SSL handshake might succeed despite OCSP rejecting a client
    certificate in the stream module (CVE-2026-28755) (boo#1260419).
  * Fixed an invalid HTTP/2 request might be sent after switching to the
    next upstream if buffered body was used in the ngx_http_grpc_module.
  * Changed now the "keepalive" directive in the "upstream" block is enabled by default.
  * Changed now ngx_http_proxy_module supports keepalive by default; the
    default value for "proxy_http_version" is "1.1"; the "Connection"
    proxy header is not sent by default anymore.
  * Added the "multipath" parameter of the "listen" directive.
  * Added the "local" parameter of the "keepalive" directive in the "upstream" block.</changelog>
  <changelog author="mrueckert@suse.de" date="1774526400">- Enabled support to build with aws-lc instead of openssl to ship
  the http3/quic support</changelog>
  <changelog author="ilya@ilya.top" date="1775563200">- Updated to 1.29.8
  * https://nginx.org/en/CHANGES
  * Added the "max_headers" directive.
  * Added OpenSSL 4.0 compatibility.
  * Added the "include" directive inside the "geo" block supports wildcards.
  * Fixed in processing of HTTP 103 (Early Hints) responses from a proxied backend.
  * Fixed the $request_port and $is_request_port variables were not available in subrequests.</changelog>
  <changelog author="mrueckert@suse.de" date="1776168000">- Updated to 1.30.0
  - nginx-1.30.0 stable version has been released, incorporating
    new features and bug fixes from the 1.29.x mainline branch —
    including Early Hints, HTTP/2 to backend and Encrypted
    ClientHello, sticky sessions support for upstreams, Multipath
    TCP support, the default proxy HTTP version set to HTTP/1.1
    with keep-alive enabled, and more.
  * https://nginx.org/en/CHANGES
  * https://github.com/nginx/nginx/releases/tag/release-1.30.0</changelog>
  <changelog author="mrueckert@suse.de" date="1778673600">- Updated to 1.31.0 ( boo#1265228 boo#1265229 boo#1265230
  boo#1265231 boo#1265232 boo#1265233 )
  * ) Security: when using the "proxy_set_body" directive, an
    attacker might inject data in the proxied request to an HTTP/2
    backend (CVE-2026-42926). Thanks to Mufeed VH of Winfunc
    Research.
  * ) Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary
    code execution (CVE-2026-42945). Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an
    attacker to cause a disclosure of worker process memory or
    segmentation fault in a worker process (CVE-2026-42946).
    Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding
    from UTF-8 via the "charset_map" directive, allowing an
    attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-42934). Thanks to David Carlier.
  * ) Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address
    before validation, allowing an attacker to cause address
    spoofing (CVE-2026-40460). Thanks to Rodrigo Laneth.
  * ) Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-40701).
    Thanks to Leo Lin.
  * ) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
    "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding",
    "Upgrade" header lines, and "TE" with any value other than
    "trailers".
  * ) Change: the ngx_http_dav_module now rejects a COPY or MOVE
    requests when the source and destination resources are the
    same or have a parent-child collection relationship.
  * ) Change: the logging level of the "invalid alert" and "record
    layer failure" SSL errors, and of the "SSL alert number N" for
    any alert numbers has been lowered from "crit" to "info".
  * ) Change: now the "sticky" module can be disabled with the
  - -without-http_upstream_sticky_module configure option; the
  - -without-http_upstream_sticky configure option is deprecated.
  * ) Feature: the ngx_http_tunnel_module; support for
    authenticating to proxies in the "auth_basic", "satisfy", and
    "auth_delay" directives.
  * ) Feature: the "least_time" directive inside the "upstream" block.
  * ) Feature: the "proxy_ssl_alpn" directive in the stream module.
  * ) Bugfix: connections with HTTP/2 backends might not be cached
    when using the "proxy_set_body" or "proxy_pass_request_body"
    directives.
  * ) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might
    be transferred incorrectly if the first line was not fully
    read.</changelog>
  <changelog author="mrueckert@suse.de" date="1779451200">- Updated to 1.31.1 ( boo#1266215 CVE-2026-9256 )
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with overlapping
    captures in ngx_http_rewrite_module, potentially resulting in
    arbitrary code execution (CVE-2026-9256).
    Thanks to Mufeed VH of Winfunc Research.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697600">- Update to 1.31.2
  * ) Security: use-after-free might occur when using HTTP/3 and
    processing a specially crafted QUIC session, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-42530).
    Thanks to Trung Nguyen of CyStack.
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with
    "ignore_invalid_headers off;" and
    "large_client_header_buffers" with large configured values
    when proxying a specially crafted request to HTTP/2 or gRPC
    backend, allowing an attacker to cause worker process memory
    corruption or segmentation fault in a worker process
    (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
  * ) Security: a heap memory buffer overread might occur in a
    worker process while handling a specially sent response with
    decoding from UTF-8 via the "charset_map" directive, allowing
    an attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of
    CYBERONE.
  * ) Change: now the $request_id variable uses SipHash-2-4.
  * ) Feature: the $ssl_sigalgs variable.
  * ) Bugfix: a variable defined by the "split_clients" directive
    might be empty if all percentages were specified explicitly
    and summed up to 100%.
  * ) Bugfix: constant time "secure_link" hash comparison.
    Thanks to kodareef5.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697601">- Extend keyring file based on https://nginx.org/en/pgp_keys.html
  https://github.com/nginx/nginx/issues/1477</changelog>
</package>
<package pkgid="5fc3a09d8807239c5cb6996ef2a713f49f65d578d315608b0eaa841e8f08ed5d" name="nginx" arch="s390x">
  <version epoch="0" ver="1.31.2" rel="2.1"/>
  <changelog author="ilya@ilya.top" date="1744804800">- Updated to 1.27.5
  * https://nginx.org/en/CHANGES
  * Changed the maximum size limit for SSL sessions cached in shared
    memory has been raised to 8192.
  * Fixed in the "grpc_ssl_password_file", "proxy_ssl_password_file",
    and "uwsgi_ssl_password_file" directives when loading SSL certificates
    and encrypted keys from variables; the bug had appeared in 1.23.1.
  * Fixed in the $ssl_curve and $ssl_curves variables when using pluggable
    curves in OpenSSL.</changelog>
  <changelog author="okurz@suse.com" date="1747915200">- Changed service to prevent "timed out. Killing" messages on service stopping</changelog>
  <changelog author="rrahl0@opensuse.org" date="1748865600">- Updated to 1.28.0:
  * Fixed -Wunterminated-string-initialization with gcc15
  * HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value</changelog>
  <changelog author="ilya@ilya.top" date="1751025600">- Updated to 1.29.0
  * https://nginx.org/en/CHANGES
  * Added support for response code 103 from proxy and gRPC backends;
    the "early_hints" directive.
  * Added loading of secret keys from hardware tokens with OpenSSL provider.
  * Changed the logging level of SSL errors in a QUIC handshake has been
    changed from "error" to "crit" for critical errors, and to "info" for
    the rest; the logging level of unsupported QUIC transport parameters
    has been lowered from "info" to "debug".
  * Disabled OpenSSL 3.5 QUIC API support by default.</changelog>
  <changelog author="parag.jain@suse.com" date="1752667200">- Removed root privileges when running logrotate (bsc#1246090).</changelog>
  <changelog author="ilya@ilya.top" date="1752667201">- Changed nginx.logrotate and nginx-conf.patch files.
  * Removed hardcoded user and group definitions.
- Removed ending slashes wherever possible.</changelog>
  <changelog author="ilya@ilya.top" date="1755172800">- Updated to 1.29.1
  * https://nginx.org/en/CHANGES
  * Fixed processing of a specially crafted login/password when using
    the "none" authentication method in the ngx_mail_smtp_module might
    cause worker process memory disclosure to the authentication server
    (CVE-2025-53859) (boo#1248070).
  * Changed TLSv1.3 certificate compression is disabled by default.
  * Added the "ssl_certificate_compression" directive.
  * Added support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
  * Fixed the 103 response might be buffered when using HTTP/2 and the
    "early_hints" directive.
  * Fixed in handling "Host" and ":authority" header lines with equal
    values when using HTTP/2; the bug had appeared in 1.17.9.
  * Fixed in handling "Host" header lines with a port when using HTTP/3.
  * Fixed in the "none" parameter of the "smtp_auth" directive.</changelog>
  <changelog author="ilya@ilya.top" date="1759924800">- Updated to 1.29.2
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Fixed now the "ssl_protocols" directive works in a virtual server
    different from the default server when using OpenSSL 1.1.1 or newer.
  * Fixed SSL handshake always failed when using TLSv1.3 with OpenSSL
    and client certificates and resuming a session with a different SNI
    value; the bug had appeared in 1.27.4.
  * Fixed the "ignoring stale global SSL error" alerts might appear in
    logs when using QUIC and the "ssl_reject_handshake" directive; the
    bug had appeared in 1.29.0.
  * Fixed in delta-seconds processing in the "Cache-Control" backend
    response header line.
  * Fixed an XCLIENT command didn't use the xtext encoding.
  * Fixed in SSL certificate caching during reconfiguration.</changelog>
  <changelog author="ilya@ilya.top" date="1761652800">- Updated to 1.29.3
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Added the "add_header_inherit" and "add_trailer_inherit" directives.
  * Added the $request_port and $is_request_port variables.
  * Added the $ssl_sigalg and $ssl_client_sigalg variables.
  * Added the "volatile" parameter of the "geo" directive.
  * Added now certificate compression is available with BoringSSL.
  * Fixed now certificate compression is disabled with OCSP stapling.</changelog>
  <changelog author="ilya@ilya.top" date="1765368000">- Updated to 1.29.4
  * https://nginx.org/en/CHANGES
  * Added the ngx_http_proxy_module supports HTTP/2.
  * Added Encrypted ClientHello TLS extension support when using
    OpenSSL ECH feature branch; the "ssl_ech_file" directive.
  * Changed validation of host and port in the request line, "Host"
    header field, and ":authority" pseudo-header field has been changed
    to follow RFC 3986.
  * Changed now a single LF used as a line terminator in a chunked
    request or response body is considered an error.
  * Fixed when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation
    fault might occur in a worker process; the bug had appeared in 1.29.1.
  * Fixed a segmentation fault might occur in a worker process if the
    "try_files" directive and "proxy_pass" with a URI were used.</changelog>
  <changelog author="ilya@ilya.top" date="1770379200">- Updated to 1.29.5
  * https://nginx.org/en/CHANGES
  * Fixed an attacker might inject plain text data in the response from an SSL backend
    (CVE-2026-1642) (boo#1257675).
  * Fixed use-after-free might occur after switching to the next gRPC or HTTP/2 backend.
  * Fixed an invalid HTTP/2 request might be sent after switching to the next upstream.
  * Fixed a response with multiple ranges might be larger than the source response.
  * Fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends.
  * Fixed warning when compiling with MSVC 2022 x86.
  * Changed the logging level of the "ech_required" SSL error has been lowered from "crit" to "info".</changelog>
  <changelog author="ilya@ilya.top" date="1773144000">- Updated to 1.29.6
  * https://nginx.org/en/CHANGES
  * Added session affinity support; the "sticky" directive in the
    "upstream" block of the "http" module; the "server" directive
    supports the "route" and "drain" parameters.
  * Changed now nginx limits the size and rate of QUIC stateless reset packets.
  * Fixed receiving a QUIC packet by a wrong worker process could cause
    the connection to terminate.
  * Fixed "[crit] cache file ... contains invalid header" messages
    might appear in logs when sending a cached HTTP/2 response.
  * Fixed proxying to scgi backends might not work when using chunked
    transfer encoding and the "scgi_request_buffering" directive.
  * Fixed in the ngx_http_mp4_module.
  * Fixed nginx treated a comma as separator in the "Cookie" request
    header line when evaluating "$cookie_..." variables.
  * Fixed in IMAP command literal argument parsing.</changelog>
  <changelog author="ilya@ilya.top" date="1774353600">- Updated to 1.29.7
  * https://nginx.org/en/CHANGES
  * Fixed a buffer overflow might occur while handling a COPY or MOVE
    request in a location with "alias", allowing an attacker to modify
    the source or destination path outside of the document root
    (CVE-2026-27654) (boo#1260416).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module on 32-bit platforms might cause a worker process
    crash, or might have potential other impact (CVE-2026-27784) (boo#1260417).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module might cause a worker process crash, or might have
    potential other impact (CVE-2026-32647) (boo#1260420).
  * Fixed a segmentation fault might occur in a worker process if the
    CRAM-MD5 or APOP authentication methods were used and authentication
    retry was enabled (CVE-2026-27651) (boo#1260415).
  * Fixed an attacker might use PTR DNS records to inject data in
    auth_http requests, as well as in the XCLIENT command in the backend
    SMTP connection (CVE-2026-28753) (boo#1260418).
  * Fixed SSL handshake might succeed despite OCSP rejecting a client
    certificate in the stream module (CVE-2026-28755) (boo#1260419).
  * Fixed an invalid HTTP/2 request might be sent after switching to the
    next upstream if buffered body was used in the ngx_http_grpc_module.
  * Changed now the "keepalive" directive in the "upstream" block is enabled by default.
  * Changed now ngx_http_proxy_module supports keepalive by default; the
    default value for "proxy_http_version" is "1.1"; the "Connection"
    proxy header is not sent by default anymore.
  * Added the "multipath" parameter of the "listen" directive.
  * Added the "local" parameter of the "keepalive" directive in the "upstream" block.</changelog>
  <changelog author="mrueckert@suse.de" date="1774526400">- Enabled support to build with aws-lc instead of openssl to ship
  the http3/quic support</changelog>
  <changelog author="ilya@ilya.top" date="1775563200">- Updated to 1.29.8
  * https://nginx.org/en/CHANGES
  * Added the "max_headers" directive.
  * Added OpenSSL 4.0 compatibility.
  * Added the "include" directive inside the "geo" block supports wildcards.
  * Fixed in processing of HTTP 103 (Early Hints) responses from a proxied backend.
  * Fixed the $request_port and $is_request_port variables were not available in subrequests.</changelog>
  <changelog author="mrueckert@suse.de" date="1776168000">- Updated to 1.30.0
  - nginx-1.30.0 stable version has been released, incorporating
    new features and bug fixes from the 1.29.x mainline branch —
    including Early Hints, HTTP/2 to backend and Encrypted
    ClientHello, sticky sessions support for upstreams, Multipath
    TCP support, the default proxy HTTP version set to HTTP/1.1
    with keep-alive enabled, and more.
  * https://nginx.org/en/CHANGES
  * https://github.com/nginx/nginx/releases/tag/release-1.30.0</changelog>
  <changelog author="mrueckert@suse.de" date="1778673600">- Updated to 1.31.0 ( boo#1265228 boo#1265229 boo#1265230
  boo#1265231 boo#1265232 boo#1265233 )
  * ) Security: when using the "proxy_set_body" directive, an
    attacker might inject data in the proxied request to an HTTP/2
    backend (CVE-2026-42926). Thanks to Mufeed VH of Winfunc
    Research.
  * ) Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary
    code execution (CVE-2026-42945). Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an
    attacker to cause a disclosure of worker process memory or
    segmentation fault in a worker process (CVE-2026-42946).
    Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding
    from UTF-8 via the "charset_map" directive, allowing an
    attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-42934). Thanks to David Carlier.
  * ) Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address
    before validation, allowing an attacker to cause address
    spoofing (CVE-2026-40460). Thanks to Rodrigo Laneth.
  * ) Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-40701).
    Thanks to Leo Lin.
  * ) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
    "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding",
    "Upgrade" header lines, and "TE" with any value other than
    "trailers".
  * ) Change: the ngx_http_dav_module now rejects a COPY or MOVE
    requests when the source and destination resources are the
    same or have a parent-child collection relationship.
  * ) Change: the logging level of the "invalid alert" and "record
    layer failure" SSL errors, and of the "SSL alert number N" for
    any alert numbers has been lowered from "crit" to "info".
  * ) Change: now the "sticky" module can be disabled with the
  - -without-http_upstream_sticky_module configure option; the
  - -without-http_upstream_sticky configure option is deprecated.
  * ) Feature: the ngx_http_tunnel_module; support for
    authenticating to proxies in the "auth_basic", "satisfy", and
    "auth_delay" directives.
  * ) Feature: the "least_time" directive inside the "upstream" block.
  * ) Feature: the "proxy_ssl_alpn" directive in the stream module.
  * ) Bugfix: connections with HTTP/2 backends might not be cached
    when using the "proxy_set_body" or "proxy_pass_request_body"
    directives.
  * ) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might
    be transferred incorrectly if the first line was not fully
    read.</changelog>
  <changelog author="mrueckert@suse.de" date="1779451200">- Updated to 1.31.1 ( boo#1266215 CVE-2026-9256 )
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with overlapping
    captures in ngx_http_rewrite_module, potentially resulting in
    arbitrary code execution (CVE-2026-9256).
    Thanks to Mufeed VH of Winfunc Research.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697600">- Update to 1.31.2
  * ) Security: use-after-free might occur when using HTTP/3 and
    processing a specially crafted QUIC session, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-42530).
    Thanks to Trung Nguyen of CyStack.
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with
    "ignore_invalid_headers off;" and
    "large_client_header_buffers" with large configured values
    when proxying a specially crafted request to HTTP/2 or gRPC
    backend, allowing an attacker to cause worker process memory
    corruption or segmentation fault in a worker process
    (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
  * ) Security: a heap memory buffer overread might occur in a
    worker process while handling a specially sent response with
    decoding from UTF-8 via the "charset_map" directive, allowing
    an attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of
    CYBERONE.
  * ) Change: now the $request_id variable uses SipHash-2-4.
  * ) Feature: the $ssl_sigalgs variable.
  * ) Bugfix: a variable defined by the "split_clients" directive
    might be empty if all percentages were specified explicitly
    and summed up to 100%.
  * ) Bugfix: constant time "secure_link" hash comparison.
    Thanks to kodareef5.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697601">- Extend keyring file based on https://nginx.org/en/pgp_keys.html
  https://github.com/nginx/nginx/issues/1477</changelog>
</package>
<package pkgid="e02249b2509dd33f87b49c3fe1421e261c22f70f9805ad6becf17c2cdd4f2433" name="nginx" arch="src">
  <version epoch="0" ver="1.31.2" rel="2.1"/>
  <changelog author="ilya@ilya.top" date="1744804800">- Updated to 1.27.5
  * https://nginx.org/en/CHANGES
  * Changed the maximum size limit for SSL sessions cached in shared
    memory has been raised to 8192.
  * Fixed in the "grpc_ssl_password_file", "proxy_ssl_password_file",
    and "uwsgi_ssl_password_file" directives when loading SSL certificates
    and encrypted keys from variables; the bug had appeared in 1.23.1.
  * Fixed in the $ssl_curve and $ssl_curves variables when using pluggable
    curves in OpenSSL.</changelog>
  <changelog author="okurz@suse.com" date="1747915200">- Changed service to prevent "timed out. Killing" messages on service stopping</changelog>
  <changelog author="rrahl0@opensuse.org" date="1748865600">- Updated to 1.28.0:
  * Fixed -Wunterminated-string-initialization with gcc15
  * HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value</changelog>
  <changelog author="ilya@ilya.top" date="1751025600">- Updated to 1.29.0
  * https://nginx.org/en/CHANGES
  * Added support for response code 103 from proxy and gRPC backends;
    the "early_hints" directive.
  * Added loading of secret keys from hardware tokens with OpenSSL provider.
  * Changed the logging level of SSL errors in a QUIC handshake has been
    changed from "error" to "crit" for critical errors, and to "info" for
    the rest; the logging level of unsupported QUIC transport parameters
    has been lowered from "info" to "debug".
  * Disabled OpenSSL 3.5 QUIC API support by default.</changelog>
  <changelog author="parag.jain@suse.com" date="1752667200">- Removed root privileges when running logrotate (bsc#1246090).</changelog>
  <changelog author="ilya@ilya.top" date="1752667201">- Changed nginx.logrotate and nginx-conf.patch files.
  * Removed hardcoded user and group definitions.
- Removed ending slashes wherever possible.</changelog>
  <changelog author="ilya@ilya.top" date="1755172800">- Updated to 1.29.1
  * https://nginx.org/en/CHANGES
  * Fixed processing of a specially crafted login/password when using
    the "none" authentication method in the ngx_mail_smtp_module might
    cause worker process memory disclosure to the authentication server
    (CVE-2025-53859) (boo#1248070).
  * Changed TLSv1.3 certificate compression is disabled by default.
  * Added the "ssl_certificate_compression" directive.
  * Added support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
  * Fixed the 103 response might be buffered when using HTTP/2 and the
    "early_hints" directive.
  * Fixed in handling "Host" and ":authority" header lines with equal
    values when using HTTP/2; the bug had appeared in 1.17.9.
  * Fixed in handling "Host" header lines with a port when using HTTP/3.
  * Fixed in the "none" parameter of the "smtp_auth" directive.</changelog>
  <changelog author="ilya@ilya.top" date="1759924800">- Updated to 1.29.2
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Fixed now the "ssl_protocols" directive works in a virtual server
    different from the default server when using OpenSSL 1.1.1 or newer.
  * Fixed SSL handshake always failed when using TLSv1.3 with OpenSSL
    and client certificates and resuming a session with a different SNI
    value; the bug had appeared in 1.27.4.
  * Fixed the "ignoring stale global SSL error" alerts might appear in
    logs when using QUIC and the "ssl_reject_handshake" directive; the
    bug had appeared in 1.29.0.
  * Fixed in delta-seconds processing in the "Cache-Control" backend
    response header line.
  * Fixed an XCLIENT command didn't use the xtext encoding.
  * Fixed in SSL certificate caching during reconfiguration.</changelog>
  <changelog author="ilya@ilya.top" date="1761652800">- Updated to 1.29.3
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Added the "add_header_inherit" and "add_trailer_inherit" directives.
  * Added the $request_port and $is_request_port variables.
  * Added the $ssl_sigalg and $ssl_client_sigalg variables.
  * Added the "volatile" parameter of the "geo" directive.
  * Added now certificate compression is available with BoringSSL.
  * Fixed now certificate compression is disabled with OCSP stapling.</changelog>
  <changelog author="ilya@ilya.top" date="1765368000">- Updated to 1.29.4
  * https://nginx.org/en/CHANGES
  * Added the ngx_http_proxy_module supports HTTP/2.
  * Added Encrypted ClientHello TLS extension support when using
    OpenSSL ECH feature branch; the "ssl_ech_file" directive.
  * Changed validation of host and port in the request line, "Host"
    header field, and ":authority" pseudo-header field has been changed
    to follow RFC 3986.
  * Changed now a single LF used as a line terminator in a chunked
    request or response body is considered an error.
  * Fixed when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation
    fault might occur in a worker process; the bug had appeared in 1.29.1.
  * Fixed a segmentation fault might occur in a worker process if the
    "try_files" directive and "proxy_pass" with a URI were used.</changelog>
  <changelog author="ilya@ilya.top" date="1770379200">- Updated to 1.29.5
  * https://nginx.org/en/CHANGES
  * Fixed an attacker might inject plain text data in the response from an SSL backend
    (CVE-2026-1642) (boo#1257675).
  * Fixed use-after-free might occur after switching to the next gRPC or HTTP/2 backend.
  * Fixed an invalid HTTP/2 request might be sent after switching to the next upstream.
  * Fixed a response with multiple ranges might be larger than the source response.
  * Fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends.
  * Fixed warning when compiling with MSVC 2022 x86.
  * Changed the logging level of the "ech_required" SSL error has been lowered from "crit" to "info".</changelog>
  <changelog author="ilya@ilya.top" date="1773144000">- Updated to 1.29.6
  * https://nginx.org/en/CHANGES
  * Added session affinity support; the "sticky" directive in the
    "upstream" block of the "http" module; the "server" directive
    supports the "route" and "drain" parameters.
  * Changed now nginx limits the size and rate of QUIC stateless reset packets.
  * Fixed receiving a QUIC packet by a wrong worker process could cause
    the connection to terminate.
  * Fixed "[crit] cache file ... contains invalid header" messages
    might appear in logs when sending a cached HTTP/2 response.
  * Fixed proxying to scgi backends might not work when using chunked
    transfer encoding and the "scgi_request_buffering" directive.
  * Fixed in the ngx_http_mp4_module.
  * Fixed nginx treated a comma as separator in the "Cookie" request
    header line when evaluating "$cookie_..." variables.
  * Fixed in IMAP command literal argument parsing.</changelog>
  <changelog author="ilya@ilya.top" date="1774353600">- Updated to 1.29.7
  * https://nginx.org/en/CHANGES
  * Fixed a buffer overflow might occur while handling a COPY or MOVE
    request in a location with "alias", allowing an attacker to modify
    the source or destination path outside of the document root
    (CVE-2026-27654) (boo#1260416).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module on 32-bit platforms might cause a worker process
    crash, or might have potential other impact (CVE-2026-27784) (boo#1260417).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module might cause a worker process crash, or might have
    potential other impact (CVE-2026-32647) (boo#1260420).
  * Fixed a segmentation fault might occur in a worker process if the
    CRAM-MD5 or APOP authentication methods were used and authentication
    retry was enabled (CVE-2026-27651) (boo#1260415).
  * Fixed an attacker might use PTR DNS records to inject data in
    auth_http requests, as well as in the XCLIENT command in the backend
    SMTP connection (CVE-2026-28753) (boo#1260418).
  * Fixed SSL handshake might succeed despite OCSP rejecting a client
    certificate in the stream module (CVE-2026-28755) (boo#1260419).
  * Fixed an invalid HTTP/2 request might be sent after switching to the
    next upstream if buffered body was used in the ngx_http_grpc_module.
  * Changed now the "keepalive" directive in the "upstream" block is enabled by default.
  * Changed now ngx_http_proxy_module supports keepalive by default; the
    default value for "proxy_http_version" is "1.1"; the "Connection"
    proxy header is not sent by default anymore.
  * Added the "multipath" parameter of the "listen" directive.
  * Added the "local" parameter of the "keepalive" directive in the "upstream" block.</changelog>
  <changelog author="mrueckert@suse.de" date="1774526400">- Enabled support to build with aws-lc instead of openssl to ship
  the http3/quic support</changelog>
  <changelog author="ilya@ilya.top" date="1775563200">- Updated to 1.29.8
  * https://nginx.org/en/CHANGES
  * Added the "max_headers" directive.
  * Added OpenSSL 4.0 compatibility.
  * Added the "include" directive inside the "geo" block supports wildcards.
  * Fixed in processing of HTTP 103 (Early Hints) responses from a proxied backend.
  * Fixed the $request_port and $is_request_port variables were not available in subrequests.</changelog>
  <changelog author="mrueckert@suse.de" date="1776168000">- Updated to 1.30.0
  - nginx-1.30.0 stable version has been released, incorporating
    new features and bug fixes from the 1.29.x mainline branch —
    including Early Hints, HTTP/2 to backend and Encrypted
    ClientHello, sticky sessions support for upstreams, Multipath
    TCP support, the default proxy HTTP version set to HTTP/1.1
    with keep-alive enabled, and more.
  * https://nginx.org/en/CHANGES
  * https://github.com/nginx/nginx/releases/tag/release-1.30.0</changelog>
  <changelog author="mrueckert@suse.de" date="1778673600">- Updated to 1.31.0 ( boo#1265228 boo#1265229 boo#1265230
  boo#1265231 boo#1265232 boo#1265233 )
  * ) Security: when using the "proxy_set_body" directive, an
    attacker might inject data in the proxied request to an HTTP/2
    backend (CVE-2026-42926). Thanks to Mufeed VH of Winfunc
    Research.
  * ) Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary
    code execution (CVE-2026-42945). Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an
    attacker to cause a disclosure of worker process memory or
    segmentation fault in a worker process (CVE-2026-42946).
    Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding
    from UTF-8 via the "charset_map" directive, allowing an
    attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-42934). Thanks to David Carlier.
  * ) Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address
    before validation, allowing an attacker to cause address
    spoofing (CVE-2026-40460). Thanks to Rodrigo Laneth.
  * ) Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-40701).
    Thanks to Leo Lin.
  * ) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
    "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding",
    "Upgrade" header lines, and "TE" with any value other than
    "trailers".
  * ) Change: the ngx_http_dav_module now rejects a COPY or MOVE
    requests when the source and destination resources are the
    same or have a parent-child collection relationship.
  * ) Change: the logging level of the "invalid alert" and "record
    layer failure" SSL errors, and of the "SSL alert number N" for
    any alert numbers has been lowered from "crit" to "info".
  * ) Change: now the "sticky" module can be disabled with the
  - -without-http_upstream_sticky_module configure option; the
  - -without-http_upstream_sticky configure option is deprecated.
  * ) Feature: the ngx_http_tunnel_module; support for
    authenticating to proxies in the "auth_basic", "satisfy", and
    "auth_delay" directives.
  * ) Feature: the "least_time" directive inside the "upstream" block.
  * ) Feature: the "proxy_ssl_alpn" directive in the stream module.
  * ) Bugfix: connections with HTTP/2 backends might not be cached
    when using the "proxy_set_body" or "proxy_pass_request_body"
    directives.
  * ) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might
    be transferred incorrectly if the first line was not fully
    read.</changelog>
  <changelog author="mrueckert@suse.de" date="1779451200">- Updated to 1.31.1 ( boo#1266215 CVE-2026-9256 )
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with overlapping
    captures in ngx_http_rewrite_module, potentially resulting in
    arbitrary code execution (CVE-2026-9256).
    Thanks to Mufeed VH of Winfunc Research.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697600">- Update to 1.31.2
  * ) Security: use-after-free might occur when using HTTP/3 and
    processing a specially crafted QUIC session, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-42530).
    Thanks to Trung Nguyen of CyStack.
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with
    "ignore_invalid_headers off;" and
    "large_client_header_buffers" with large configured values
    when proxying a specially crafted request to HTTP/2 or gRPC
    backend, allowing an attacker to cause worker process memory
    corruption or segmentation fault in a worker process
    (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
  * ) Security: a heap memory buffer overread might occur in a
    worker process while handling a specially sent response with
    decoding from UTF-8 via the "charset_map" directive, allowing
    an attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of
    CYBERONE.
  * ) Change: now the $request_id variable uses SipHash-2-4.
  * ) Feature: the $ssl_sigalgs variable.
  * ) Bugfix: a variable defined by the "split_clients" directive
    might be empty if all percentages were specified explicitly
    and summed up to 100%.
  * ) Bugfix: constant time "secure_link" hash comparison.
    Thanks to kodareef5.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697601">- Extend keyring file based on https://nginx.org/en/pgp_keys.html
  https://github.com/nginx/nginx/issues/1477</changelog>
</package>
<package pkgid="9bcc8a8ec3884b2b581eb29e09d7d2f11d867014f3ad86d6466c8a0daca67c7c" name="nginx" arch="x86_64">
  <version epoch="0" ver="1.31.2" rel="2.1"/>
  <changelog author="ilya@ilya.top" date="1744804800">- Updated to 1.27.5
  * https://nginx.org/en/CHANGES
  * Changed the maximum size limit for SSL sessions cached in shared
    memory has been raised to 8192.
  * Fixed in the "grpc_ssl_password_file", "proxy_ssl_password_file",
    and "uwsgi_ssl_password_file" directives when loading SSL certificates
    and encrypted keys from variables; the bug had appeared in 1.23.1.
  * Fixed in the $ssl_curve and $ssl_curves variables when using pluggable
    curves in OpenSSL.</changelog>
  <changelog author="okurz@suse.com" date="1747915200">- Changed service to prevent "timed out. Killing" messages on service stopping</changelog>
  <changelog author="rrahl0@opensuse.org" date="1748865600">- Updated to 1.28.0:
  * Fixed -Wunterminated-string-initialization with gcc15
  * HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value</changelog>
  <changelog author="ilya@ilya.top" date="1751025600">- Updated to 1.29.0
  * https://nginx.org/en/CHANGES
  * Added support for response code 103 from proxy and gRPC backends;
    the "early_hints" directive.
  * Added loading of secret keys from hardware tokens with OpenSSL provider.
  * Changed the logging level of SSL errors in a QUIC handshake has been
    changed from "error" to "crit" for critical errors, and to "info" for
    the rest; the logging level of unsupported QUIC transport parameters
    has been lowered from "info" to "debug".
  * Disabled OpenSSL 3.5 QUIC API support by default.</changelog>
  <changelog author="parag.jain@suse.com" date="1752667200">- Removed root privileges when running logrotate (bsc#1246090).</changelog>
  <changelog author="ilya@ilya.top" date="1752667201">- Changed nginx.logrotate and nginx-conf.patch files.
  * Removed hardcoded user and group definitions.
- Removed ending slashes wherever possible.</changelog>
  <changelog author="ilya@ilya.top" date="1755172800">- Updated to 1.29.1
  * https://nginx.org/en/CHANGES
  * Fixed processing of a specially crafted login/password when using
    the "none" authentication method in the ngx_mail_smtp_module might
    cause worker process memory disclosure to the authentication server
    (CVE-2025-53859) (boo#1248070).
  * Changed TLSv1.3 certificate compression is disabled by default.
  * Added the "ssl_certificate_compression" directive.
  * Added support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
  * Fixed the 103 response might be buffered when using HTTP/2 and the
    "early_hints" directive.
  * Fixed in handling "Host" and ":authority" header lines with equal
    values when using HTTP/2; the bug had appeared in 1.17.9.
  * Fixed in handling "Host" header lines with a port when using HTTP/3.
  * Fixed in the "none" parameter of the "smtp_auth" directive.</changelog>
  <changelog author="ilya@ilya.top" date="1759924800">- Updated to 1.29.2
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Fixed now the "ssl_protocols" directive works in a virtual server
    different from the default server when using OpenSSL 1.1.1 or newer.
  * Fixed SSL handshake always failed when using TLSv1.3 with OpenSSL
    and client certificates and resuming a session with a different SNI
    value; the bug had appeared in 1.27.4.
  * Fixed the "ignoring stale global SSL error" alerts might appear in
    logs when using QUIC and the "ssl_reject_handshake" directive; the
    bug had appeared in 1.29.0.
  * Fixed in delta-seconds processing in the "Cache-Control" backend
    response header line.
  * Fixed an XCLIENT command didn't use the xtext encoding.
  * Fixed in SSL certificate caching during reconfiguration.</changelog>
  <changelog author="ilya@ilya.top" date="1761652800">- Updated to 1.29.3
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Added the "add_header_inherit" and "add_trailer_inherit" directives.
  * Added the $request_port and $is_request_port variables.
  * Added the $ssl_sigalg and $ssl_client_sigalg variables.
  * Added the "volatile" parameter of the "geo" directive.
  * Added now certificate compression is available with BoringSSL.
  * Fixed now certificate compression is disabled with OCSP stapling.</changelog>
  <changelog author="ilya@ilya.top" date="1765368000">- Updated to 1.29.4
  * https://nginx.org/en/CHANGES
  * Added the ngx_http_proxy_module supports HTTP/2.
  * Added Encrypted ClientHello TLS extension support when using
    OpenSSL ECH feature branch; the "ssl_ech_file" directive.
  * Changed validation of host and port in the request line, "Host"
    header field, and ":authority" pseudo-header field has been changed
    to follow RFC 3986.
  * Changed now a single LF used as a line terminator in a chunked
    request or response body is considered an error.
  * Fixed when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation
    fault might occur in a worker process; the bug had appeared in 1.29.1.
  * Fixed a segmentation fault might occur in a worker process if the
    "try_files" directive and "proxy_pass" with a URI were used.</changelog>
  <changelog author="ilya@ilya.top" date="1770379200">- Updated to 1.29.5
  * https://nginx.org/en/CHANGES
  * Fixed an attacker might inject plain text data in the response from an SSL backend
    (CVE-2026-1642) (boo#1257675).
  * Fixed use-after-free might occur after switching to the next gRPC or HTTP/2 backend.
  * Fixed an invalid HTTP/2 request might be sent after switching to the next upstream.
  * Fixed a response with multiple ranges might be larger than the source response.
  * Fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends.
  * Fixed warning when compiling with MSVC 2022 x86.
  * Changed the logging level of the "ech_required" SSL error has been lowered from "crit" to "info".</changelog>
  <changelog author="ilya@ilya.top" date="1773144000">- Updated to 1.29.6
  * https://nginx.org/en/CHANGES
  * Added session affinity support; the "sticky" directive in the
    "upstream" block of the "http" module; the "server" directive
    supports the "route" and "drain" parameters.
  * Changed now nginx limits the size and rate of QUIC stateless reset packets.
  * Fixed receiving a QUIC packet by a wrong worker process could cause
    the connection to terminate.
  * Fixed "[crit] cache file ... contains invalid header" messages
    might appear in logs when sending a cached HTTP/2 response.
  * Fixed proxying to scgi backends might not work when using chunked
    transfer encoding and the "scgi_request_buffering" directive.
  * Fixed in the ngx_http_mp4_module.
  * Fixed nginx treated a comma as separator in the "Cookie" request
    header line when evaluating "$cookie_..." variables.
  * Fixed in IMAP command literal argument parsing.</changelog>
  <changelog author="ilya@ilya.top" date="1774353600">- Updated to 1.29.7
  * https://nginx.org/en/CHANGES
  * Fixed a buffer overflow might occur while handling a COPY or MOVE
    request in a location with "alias", allowing an attacker to modify
    the source or destination path outside of the document root
    (CVE-2026-27654) (boo#1260416).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module on 32-bit platforms might cause a worker process
    crash, or might have potential other impact (CVE-2026-27784) (boo#1260417).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module might cause a worker process crash, or might have
    potential other impact (CVE-2026-32647) (boo#1260420).
  * Fixed a segmentation fault might occur in a worker process if the
    CRAM-MD5 or APOP authentication methods were used and authentication
    retry was enabled (CVE-2026-27651) (boo#1260415).
  * Fixed an attacker might use PTR DNS records to inject data in
    auth_http requests, as well as in the XCLIENT command in the backend
    SMTP connection (CVE-2026-28753) (boo#1260418).
  * Fixed SSL handshake might succeed despite OCSP rejecting a client
    certificate in the stream module (CVE-2026-28755) (boo#1260419).
  * Fixed an invalid HTTP/2 request might be sent after switching to the
    next upstream if buffered body was used in the ngx_http_grpc_module.
  * Changed now the "keepalive" directive in the "upstream" block is enabled by default.
  * Changed now ngx_http_proxy_module supports keepalive by default; the
    default value for "proxy_http_version" is "1.1"; the "Connection"
    proxy header is not sent by default anymore.
  * Added the "multipath" parameter of the "listen" directive.
  * Added the "local" parameter of the "keepalive" directive in the "upstream" block.</changelog>
  <changelog author="mrueckert@suse.de" date="1774526400">- Enabled support to build with aws-lc instead of openssl to ship
  the http3/quic support</changelog>
  <changelog author="ilya@ilya.top" date="1775563200">- Updated to 1.29.8
  * https://nginx.org/en/CHANGES
  * Added the "max_headers" directive.
  * Added OpenSSL 4.0 compatibility.
  * Added the "include" directive inside the "geo" block supports wildcards.
  * Fixed in processing of HTTP 103 (Early Hints) responses from a proxied backend.
  * Fixed the $request_port and $is_request_port variables were not available in subrequests.</changelog>
  <changelog author="mrueckert@suse.de" date="1776168000">- Updated to 1.30.0
  - nginx-1.30.0 stable version has been released, incorporating
    new features and bug fixes from the 1.29.x mainline branch —
    including Early Hints, HTTP/2 to backend and Encrypted
    ClientHello, sticky sessions support for upstreams, Multipath
    TCP support, the default proxy HTTP version set to HTTP/1.1
    with keep-alive enabled, and more.
  * https://nginx.org/en/CHANGES
  * https://github.com/nginx/nginx/releases/tag/release-1.30.0</changelog>
  <changelog author="mrueckert@suse.de" date="1778673600">- Updated to 1.31.0 ( boo#1265228 boo#1265229 boo#1265230
  boo#1265231 boo#1265232 boo#1265233 )
  * ) Security: when using the "proxy_set_body" directive, an
    attacker might inject data in the proxied request to an HTTP/2
    backend (CVE-2026-42926). Thanks to Mufeed VH of Winfunc
    Research.
  * ) Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary
    code execution (CVE-2026-42945). Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an
    attacker to cause a disclosure of worker process memory or
    segmentation fault in a worker process (CVE-2026-42946).
    Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding
    from UTF-8 via the "charset_map" directive, allowing an
    attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-42934). Thanks to David Carlier.
  * ) Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address
    before validation, allowing an attacker to cause address
    spoofing (CVE-2026-40460). Thanks to Rodrigo Laneth.
  * ) Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-40701).
    Thanks to Leo Lin.
  * ) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
    "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding",
    "Upgrade" header lines, and "TE" with any value other than
    "trailers".
  * ) Change: the ngx_http_dav_module now rejects a COPY or MOVE
    requests when the source and destination resources are the
    same or have a parent-child collection relationship.
  * ) Change: the logging level of the "invalid alert" and "record
    layer failure" SSL errors, and of the "SSL alert number N" for
    any alert numbers has been lowered from "crit" to "info".
  * ) Change: now the "sticky" module can be disabled with the
  - -without-http_upstream_sticky_module configure option; the
  - -without-http_upstream_sticky configure option is deprecated.
  * ) Feature: the ngx_http_tunnel_module; support for
    authenticating to proxies in the "auth_basic", "satisfy", and
    "auth_delay" directives.
  * ) Feature: the "least_time" directive inside the "upstream" block.
  * ) Feature: the "proxy_ssl_alpn" directive in the stream module.
  * ) Bugfix: connections with HTTP/2 backends might not be cached
    when using the "proxy_set_body" or "proxy_pass_request_body"
    directives.
  * ) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might
    be transferred incorrectly if the first line was not fully
    read.</changelog>
  <changelog author="mrueckert@suse.de" date="1779451200">- Updated to 1.31.1 ( boo#1266215 CVE-2026-9256 )
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with overlapping
    captures in ngx_http_rewrite_module, potentially resulting in
    arbitrary code execution (CVE-2026-9256).
    Thanks to Mufeed VH of Winfunc Research.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697600">- Update to 1.31.2
  * ) Security: use-after-free might occur when using HTTP/3 and
    processing a specially crafted QUIC session, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-42530).
    Thanks to Trung Nguyen of CyStack.
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with
    "ignore_invalid_headers off;" and
    "large_client_header_buffers" with large configured values
    when proxying a specially crafted request to HTTP/2 or gRPC
    backend, allowing an attacker to cause worker process memory
    corruption or segmentation fault in a worker process
    (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
  * ) Security: a heap memory buffer overread might occur in a
    worker process while handling a specially sent response with
    decoding from UTF-8 via the "charset_map" directive, allowing
    an attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of
    CYBERONE.
  * ) Change: now the $request_id variable uses SipHash-2-4.
  * ) Feature: the $ssl_sigalgs variable.
  * ) Bugfix: a variable defined by the "split_clients" directive
    might be empty if all percentages were specified explicitly
    and summed up to 100%.
  * ) Bugfix: constant time "secure_link" hash comparison.
    Thanks to kodareef5.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697601">- Extend keyring file based on https://nginx.org/en/pgp_keys.html
  https://github.com/nginx/nginx/issues/1477</changelog>
</package>
<package pkgid="e4bc7092bcd8e86f0d70b7dd8f0eefd128a0b81c4f7d2aefdc11afe99c0403d5" name="nginx-source" arch="noarch">
  <version epoch="0" ver="1.31.2" rel="2.1"/>
  <changelog author="ilya@ilya.top" date="1744804800">- Updated to 1.27.5
  * https://nginx.org/en/CHANGES
  * Changed the maximum size limit for SSL sessions cached in shared
    memory has been raised to 8192.
  * Fixed in the "grpc_ssl_password_file", "proxy_ssl_password_file",
    and "uwsgi_ssl_password_file" directives when loading SSL certificates
    and encrypted keys from variables; the bug had appeared in 1.23.1.
  * Fixed in the $ssl_curve and $ssl_curves variables when using pluggable
    curves in OpenSSL.</changelog>
  <changelog author="okurz@suse.com" date="1747915200">- Changed service to prevent "timed out. Killing" messages on service stopping</changelog>
  <changelog author="rrahl0@opensuse.org" date="1748865600">- Updated to 1.28.0:
  * Fixed -Wunterminated-string-initialization with gcc15
  * HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value</changelog>
  <changelog author="ilya@ilya.top" date="1751025600">- Updated to 1.29.0
  * https://nginx.org/en/CHANGES
  * Added support for response code 103 from proxy and gRPC backends;
    the "early_hints" directive.
  * Added loading of secret keys from hardware tokens with OpenSSL provider.
  * Changed the logging level of SSL errors in a QUIC handshake has been
    changed from "error" to "crit" for critical errors, and to "info" for
    the rest; the logging level of unsupported QUIC transport parameters
    has been lowered from "info" to "debug".
  * Disabled OpenSSL 3.5 QUIC API support by default.</changelog>
  <changelog author="parag.jain@suse.com" date="1752667200">- Removed root privileges when running logrotate (bsc#1246090).</changelog>
  <changelog author="ilya@ilya.top" date="1752667201">- Changed nginx.logrotate and nginx-conf.patch files.
  * Removed hardcoded user and group definitions.
- Removed ending slashes wherever possible.</changelog>
  <changelog author="ilya@ilya.top" date="1755172800">- Updated to 1.29.1
  * https://nginx.org/en/CHANGES
  * Fixed processing of a specially crafted login/password when using
    the "none" authentication method in the ngx_mail_smtp_module might
    cause worker process memory disclosure to the authentication server
    (CVE-2025-53859) (boo#1248070).
  * Changed TLSv1.3 certificate compression is disabled by default.
  * Added the "ssl_certificate_compression" directive.
  * Added support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
  * Fixed the 103 response might be buffered when using HTTP/2 and the
    "early_hints" directive.
  * Fixed in handling "Host" and ":authority" header lines with equal
    values when using HTTP/2; the bug had appeared in 1.17.9.
  * Fixed in handling "Host" header lines with a port when using HTTP/3.
  * Fixed in the "none" parameter of the "smtp_auth" directive.</changelog>
  <changelog author="ilya@ilya.top" date="1759924800">- Updated to 1.29.2
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Fixed now the "ssl_protocols" directive works in a virtual server
    different from the default server when using OpenSSL 1.1.1 or newer.
  * Fixed SSL handshake always failed when using TLSv1.3 with OpenSSL
    and client certificates and resuming a session with a different SNI
    value; the bug had appeared in 1.27.4.
  * Fixed the "ignoring stale global SSL error" alerts might appear in
    logs when using QUIC and the "ssl_reject_handshake" directive; the
    bug had appeared in 1.29.0.
  * Fixed in delta-seconds processing in the "Cache-Control" backend
    response header line.
  * Fixed an XCLIENT command didn't use the xtext encoding.
  * Fixed in SSL certificate caching during reconfiguration.</changelog>
  <changelog author="ilya@ilya.top" date="1761652800">- Updated to 1.29.3
  * Changed nginx-conf.patch file.
  * https://nginx.org/en/CHANGES
  * Added the "add_header_inherit" and "add_trailer_inherit" directives.
  * Added the $request_port and $is_request_port variables.
  * Added the $ssl_sigalg and $ssl_client_sigalg variables.
  * Added the "volatile" parameter of the "geo" directive.
  * Added now certificate compression is available with BoringSSL.
  * Fixed now certificate compression is disabled with OCSP stapling.</changelog>
  <changelog author="ilya@ilya.top" date="1765368000">- Updated to 1.29.4
  * https://nginx.org/en/CHANGES
  * Added the ngx_http_proxy_module supports HTTP/2.
  * Added Encrypted ClientHello TLS extension support when using
    OpenSSL ECH feature branch; the "ssl_ech_file" directive.
  * Changed validation of host and port in the request line, "Host"
    header field, and ":authority" pseudo-header field has been changed
    to follow RFC 3986.
  * Changed now a single LF used as a line terminator in a chunked
    request or response body is considered an error.
  * Fixed when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation
    fault might occur in a worker process; the bug had appeared in 1.29.1.
  * Fixed a segmentation fault might occur in a worker process if the
    "try_files" directive and "proxy_pass" with a URI were used.</changelog>
  <changelog author="ilya@ilya.top" date="1770379200">- Updated to 1.29.5
  * https://nginx.org/en/CHANGES
  * Fixed an attacker might inject plain text data in the response from an SSL backend
    (CVE-2026-1642) (boo#1257675).
  * Fixed use-after-free might occur after switching to the next gRPC or HTTP/2 backend.
  * Fixed an invalid HTTP/2 request might be sent after switching to the next upstream.
  * Fixed a response with multiple ranges might be larger than the source response.
  * Fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends.
  * Fixed warning when compiling with MSVC 2022 x86.
  * Changed the logging level of the "ech_required" SSL error has been lowered from "crit" to "info".</changelog>
  <changelog author="ilya@ilya.top" date="1773144000">- Updated to 1.29.6
  * https://nginx.org/en/CHANGES
  * Added session affinity support; the "sticky" directive in the
    "upstream" block of the "http" module; the "server" directive
    supports the "route" and "drain" parameters.
  * Changed now nginx limits the size and rate of QUIC stateless reset packets.
  * Fixed receiving a QUIC packet by a wrong worker process could cause
    the connection to terminate.
  * Fixed "[crit] cache file ... contains invalid header" messages
    might appear in logs when sending a cached HTTP/2 response.
  * Fixed proxying to scgi backends might not work when using chunked
    transfer encoding and the "scgi_request_buffering" directive.
  * Fixed in the ngx_http_mp4_module.
  * Fixed nginx treated a comma as separator in the "Cookie" request
    header line when evaluating "$cookie_..." variables.
  * Fixed in IMAP command literal argument parsing.</changelog>
  <changelog author="ilya@ilya.top" date="1774353600">- Updated to 1.29.7
  * https://nginx.org/en/CHANGES
  * Fixed a buffer overflow might occur while handling a COPY or MOVE
    request in a location with "alias", allowing an attacker to modify
    the source or destination path outside of the document root
    (CVE-2026-27654) (boo#1260416).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module on 32-bit platforms might cause a worker process
    crash, or might have potential other impact (CVE-2026-27784) (boo#1260417).
  * Fixed processing of a specially crafted mp4 file by the
    ngx_http_mp4_module might cause a worker process crash, or might have
    potential other impact (CVE-2026-32647) (boo#1260420).
  * Fixed a segmentation fault might occur in a worker process if the
    CRAM-MD5 or APOP authentication methods were used and authentication
    retry was enabled (CVE-2026-27651) (boo#1260415).
  * Fixed an attacker might use PTR DNS records to inject data in
    auth_http requests, as well as in the XCLIENT command in the backend
    SMTP connection (CVE-2026-28753) (boo#1260418).
  * Fixed SSL handshake might succeed despite OCSP rejecting a client
    certificate in the stream module (CVE-2026-28755) (boo#1260419).
  * Fixed an invalid HTTP/2 request might be sent after switching to the
    next upstream if buffered body was used in the ngx_http_grpc_module.
  * Changed now the "keepalive" directive in the "upstream" block is enabled by default.
  * Changed now ngx_http_proxy_module supports keepalive by default; the
    default value for "proxy_http_version" is "1.1"; the "Connection"
    proxy header is not sent by default anymore.
  * Added the "multipath" parameter of the "listen" directive.
  * Added the "local" parameter of the "keepalive" directive in the "upstream" block.</changelog>
  <changelog author="mrueckert@suse.de" date="1774526400">- Enabled support to build with aws-lc instead of openssl to ship
  the http3/quic support</changelog>
  <changelog author="ilya@ilya.top" date="1775563200">- Updated to 1.29.8
  * https://nginx.org/en/CHANGES
  * Added the "max_headers" directive.
  * Added OpenSSL 4.0 compatibility.
  * Added the "include" directive inside the "geo" block supports wildcards.
  * Fixed in processing of HTTP 103 (Early Hints) responses from a proxied backend.
  * Fixed the $request_port and $is_request_port variables were not available in subrequests.</changelog>
  <changelog author="mrueckert@suse.de" date="1776168000">- Updated to 1.30.0
  - nginx-1.30.0 stable version has been released, incorporating
    new features and bug fixes from the 1.29.x mainline branch —
    including Early Hints, HTTP/2 to backend and Encrypted
    ClientHello, sticky sessions support for upstreams, Multipath
    TCP support, the default proxy HTTP version set to HTTP/1.1
    with keep-alive enabled, and more.
  * https://nginx.org/en/CHANGES
  * https://github.com/nginx/nginx/releases/tag/release-1.30.0</changelog>
  <changelog author="mrueckert@suse.de" date="1778673600">- Updated to 1.31.0 ( boo#1265228 boo#1265229 boo#1265230
  boo#1265231 boo#1265232 boo#1265233 )
  * ) Security: when using the "proxy_set_body" directive, an
    attacker might inject data in the proxied request to an HTTP/2
    backend (CVE-2026-42926). Thanks to Mufeed VH of Winfunc
    Research.
  * ) Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary
    code execution (CVE-2026-42945). Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an
    attacker to cause a disclosure of worker process memory or
    segmentation fault in a worker process (CVE-2026-42946).
    Thanks to Leo Lin.
  * ) Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding
    from UTF-8 via the "charset_map" directive, allowing an
    attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-42934). Thanks to David Carlier.
  * ) Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address
    before validation, allowing an attacker to cause address
    spoofing (CVE-2026-40460). Thanks to Rodrigo Laneth.
  * ) Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-40701).
    Thanks to Leo Lin.
  * ) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
    "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding",
    "Upgrade" header lines, and "TE" with any value other than
    "trailers".
  * ) Change: the ngx_http_dav_module now rejects a COPY or MOVE
    requests when the source and destination resources are the
    same or have a parent-child collection relationship.
  * ) Change: the logging level of the "invalid alert" and "record
    layer failure" SSL errors, and of the "SSL alert number N" for
    any alert numbers has been lowered from "crit" to "info".
  * ) Change: now the "sticky" module can be disabled with the
  - -without-http_upstream_sticky_module configure option; the
  - -without-http_upstream_sticky configure option is deprecated.
  * ) Feature: the ngx_http_tunnel_module; support for
    authenticating to proxies in the "auth_basic", "satisfy", and
    "auth_delay" directives.
  * ) Feature: the "least_time" directive inside the "upstream" block.
  * ) Feature: the "proxy_ssl_alpn" directive in the stream module.
  * ) Bugfix: connections with HTTP/2 backends might not be cached
    when using the "proxy_set_body" or "proxy_pass_request_body"
    directives.
  * ) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might
    be transferred incorrectly if the first line was not fully
    read.</changelog>
  <changelog author="mrueckert@suse.de" date="1779451200">- Updated to 1.31.1 ( boo#1266215 CVE-2026-9256 )
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with overlapping
    captures in ngx_http_rewrite_module, potentially resulting in
    arbitrary code execution (CVE-2026-9256).
    Thanks to Mufeed VH of Winfunc Research.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697600">- Update to 1.31.2
  * ) Security: use-after-free might occur when using HTTP/3 and
    processing a specially crafted QUIC session, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-42530).
    Thanks to Trung Nguyen of CyStack.
  * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with
    "ignore_invalid_headers off;" and
    "large_client_header_buffers" with large configured values
    when proxying a specially crafted request to HTTP/2 or gRPC
    backend, allowing an attacker to cause worker process memory
    corruption or segmentation fault in a worker process
    (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
  * ) Security: a heap memory buffer overread might occur in a
    worker process while handling a specially sent response with
    decoding from UTF-8 via the "charset_map" directive, allowing
    an attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of
    CYBERONE.
  * ) Change: now the $request_id variable uses SipHash-2-4.
  * ) Feature: the $ssl_sigalgs variable.
  * ) Bugfix: a variable defined by the "split_clients" directive
    might be empty if all percentages were specified explicitly
    and summed up to 100%.
  * ) Bugfix: constant time "secure_link" hash comparison.
    Thanks to kodareef5.</changelog>
  <changelog author="mrueckert@suse.de" date="1781697601">- Extend keyring file based on https://nginx.org/en/pgp_keys.html
  https://github.com/nginx/nginx/issues/1477</changelog>
</package>
<package pkgid="1775bc7036b06b9bb7f799a2d968c1e226a5195f9961a46bf465c67479d03108" name="postfix" arch="aarch64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="22ec8b6db953e7e37170902a482e96e05787cdf2f121533d6c9ea04c90eb81a6" name="postfix" arch="ppc64le">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="7fc964b8e5f3b78903d57427733df62baf43fae10ac285baee36b7feeb2de912" name="postfix" arch="s390x">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="472b07812ff00d95880ece027fe7710547e7751c00e0aac4b3a90b6d7538d92c" name="postfix" arch="src">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="7c6e0e2632ce9b764764206036914f353063cc94cb6cd3056119feaff4e84cd3" name="postfix" arch="x86_64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="f3977d218669de460f616f2c84c4768a6954ff6d42690a5825eda5c93f0152df" name="postfix-bdb" arch="aarch64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="83bde59c01293b5d83e72de88df3fde896ea8fb87e3276ff530b2e8702502674" name="postfix-bdb" arch="ppc64le">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="19f2e2f959a004119c9fe25afe9584d31e7a170a00b5fa60e53427af8d5087ee" name="postfix-bdb" arch="s390x">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="d36cac3efb57a1c3be3df3641a080fa4f2b72ba1fb3c7efc3d4d2206c90efae8" name="postfix-bdb" arch="src">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="6ed88038364b8779a2b70fb260eb073396784599edee9d2f20418e28eacd17fd" name="postfix-bdb" arch="x86_64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="a48a3590a8bd248094e12943d1a968beee4bb1e4b693590c898f2ff29cd495c3" name="postfix-bdb-lmdb" arch="aarch64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="67f58830f8438b541de1156f483d1b78594af0a8f57e0fdea09d7848b0d1ad8a" name="postfix-bdb-lmdb" arch="ppc64le">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="eb5eeb49055e0de8ca8a47ec3157f77ef32ba45541221e488dbce54b39b87de6" name="postfix-bdb-lmdb" arch="s390x">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="a400ea279d3433732ece012079d0b359bc22101429090860608438111aea530f" name="postfix-bdb-lmdb" arch="x86_64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="e759b0ae62a7656d2361e9e5e8fd335c2fe707b852c180cdb1a05b1123664eaa" name="postfix-devel" arch="noarch">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="76a305c5a9e218ad69a6e9cc9091518e301e70982fd60a5f67e3527c64b54376" name="postfix-doc" arch="noarch">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="3bda5e58bd425cbb839034fdbae2cf88cbf4be4581a41f2647b93ab615a36222" name="postfix-ldap" arch="aarch64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="aa8daa081c9a28299046e0b644a60b56fb48062f01cf83152289e8bfa5c02c02" name="postfix-ldap" arch="ppc64le">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="29f44b92504d7182802d1a8daeb831cb95632121143a196bd7843d6979dbb8e1" name="postfix-ldap" arch="s390x">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="fe40dc8e3ce5d0818102d23654fd3943f26d4c40290dd48ec5d951f35aac1bdd" name="postfix-ldap" arch="x86_64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="d0da379b8ab19d4088a16d95c13682dc7ee414f9e1b3c9ac56b6cf8ae9da4917" name="postfix-mysql" arch="aarch64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="df233adade934d8b8c04738d35472117900e04a8481e7bafbb6317dda4fc4f3e" name="postfix-mysql" arch="ppc64le">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="d77a463bff658246799532f106b1e64b2665cb1e1fcce81e18a65bcd92651d03" name="postfix-mysql" arch="s390x">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="e675a9fd5b397c99e448aa8a53dbbe419112fa3b3bc0705cd21206ccaf2c08bc" name="postfix-mysql" arch="x86_64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="dd58b2a38ea14c4ba74d8e4a9dfb506056f05c66e338b44ab6e08487cf0e8d9b" name="postfix-postgresql" arch="aarch64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="1de70cda6eaf9f0b8e7cc63412e614d8a0484ca90bb47d65c9a8dae4c1e721f9" name="postfix-postgresql" arch="ppc64le">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="6ab91f43bdfe18aacabaea3e180d319962e41ef76f871edcf939a59ea6354546" name="postfix-postgresql" arch="s390x">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="89ae9662aef0f07672e8538ecf42aeb0fa073c27c871020e4d79f946b80e5e3e" name="postfix-postgresql" arch="x86_64">
  <version epoch="0" ver="3.11.4" rel="2.1"/>
  <changelog author="wolfgang.frisch@suse.com" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="suse+build@de-korte.org" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="obs@botter.cc" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="varkoly@suse.com" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="varkoly@suse.com" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="varkoly@suse.com" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="varkoly@suse.com" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="dimstar@opensuse.org" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="ana.guerrero@suse.com" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="mrueckert@suse.de" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
  <changelog author="varkoly@suse.com" date="1769601600">- (bsc#1257199) [SELinux] postalias denied - fatal: open database /etc/aliases.lmdb: Permission denied
  Add proposed ExecStartPre.
- (jsc#PED-14859) Fix packages for Immutable Mode - postfix
  Pack /var/spool/postfix/* /var/lib/postfix using tmpfiles.d</changelog>
  <changelog author="varkoly@suse.com" date="1771243200">- (bsc#1258068) postfix main.cf.rpmnew now contains hash instead of lmdb
  Adapt main.cf in %install
- (bsc#1258264) /var/spool/mail no longer 1777
- (bsc#1258160) [QE][Build 20260212] postfix fails to deliver email
  Provide missed directory and symlink as tmpfile
- (bsc#1257523) [QE][Build 20260129] postfix: missing tmpfiles
  configuration for /var/spool/postfix/trace</changelog>
  <changelog author="suse+build@de-korte.org" date="1771934400">- update to 3.10.8
  * Improved Milter error handling for messages that arrive over a
    long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown"
    action (i.e. disconnect the remote SMTP client).
  * Bugfix (defect introduced: Postfix 2.11): "posttls-finger -v
  - v -v" terminated with a panic, caused by recursive logging.</changelog>
  <changelog author="suse+build@de-korte.org" date="1772712000">- update to 3.11.0
  * Some (Linux) distributions are removing support for BerkeleyDB
    databases (In Postfix, this means we lose support for the hash:
    and btree: lookup tables). See NON_BERKELEYDB_README for manual and
    partially automatic migration from btree: to lmdb:, and from hash:
    to lmdb: or cdb:.
  * The loss of BerkeleyDB affects Mailman versions that want to execute
    commands like "postmap hash:/path/to/file" when a mailing list is
    added or removed. Postfix provides a way to redirect such commands
    to a supported database type.
  * You don't have to wait until BerkeleyDB support is removed. It can
    make sense to migrate while BerkeleyDB support is still available
    (mainly, less downtime).
  * Default TLS security. The Postfix SMTP client smtp_tls_security_level
    default value is "may" if Postfix was built with TLS support, and
    the compatibility_level is 3.11 or higher.
  * Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
    that every SMTP (and LMTP) server in the forward path is strongly
    authenticated with DANE, STS, or equivalent, and that every server
    announces REQUIRETLS support.
  * Logging the TLS security level. This shows the desired and actual
    TLS security level enforcement status and, if a message requests
    REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of
    examples see smtp_log_tls_feature_status
  * Workaround for an interface mismatch between the Postfix SMTP
    client and MTA-STS policy plugins. This introduces a new parameter
    smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
    plugin configuration needs to enable TLSRPT support, so that it
    forwards STS policy attributes to Postfix. Both postfix-tlspol and
    postfix-mta-sts-resolver have been updated accordingly.
  * Post-quantum cryptography support. With OpenSSL 3.5 and later, change
    the tls_eecdh_auto_curves default value to avoid problems with network
    infrastructure that mishandles TLS hello messages larger than one
    (Ethernet) TCP segment. This problem is more generally known as
    "protocol ossification".
  * Deprecation of obsolete parameters. Postfix programs log a warning
    that these parameters will be removed. See DEPRECATION_README for
    a list of deprecated parameters.
  * JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
  - jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
    planned for JSON input support.
  * Milter support: improved Milter error handling for messages that
    arrive over a long-lived SMTP connection, by changing the default
    milter_default_action from "tempfail" to the new "shutdown" action
    (i.e. disconnect the remote SMTP client). This was already back-ported
    to earlier stable releases.
- refreshed patches
  % postfix-linux45.patch
  % set-default-db-type.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1773230400">- update to 3.11.1
  * Bugfix (defect introduced: 20260219): alias_maps errors when
    default_database_type was not set in main.cf.
  * Bugfix (defect introduced: Postfix 3.0): buffer over-read when
    Postfix is configured with an enhanced status code not followed
    by other text. For example, "5.7.2" without text after the
    three-number code, in an access(5) table, header or body checks,
    or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply.
    These are all uncommon configurations.
    (bsc#1264062) VUL-0: CVE-2026-43964
  * Bugfix (defect introduced: Postfix 3.3): null pointer in
    nbdb_reindexd(8) because the "service_name" value was not
    propagated.
  * During Postfix start-up, avoid a spurious error message from
    nbdb_reindexd(8), when non_bdb_migration_level disables automatic
    re-indexing.</changelog>
  <changelog author="varkoly@suse.com" date="1776772800">- Yet another AVC denial from procmail ... (bsc#1261933)
  Set FD_CLOEXEC on the file descriptor of the db file
  o avoid-inherited-file-descriptor.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1777896000">- update to 3.11.2
  * Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
    dereferenced an uninitialized pointer after a request protocol
    error. This daemon is not exposed to local or remote users.
    Found by Claude Opus 4.6.
  * Bugfix (defect introduced: 20260309) a change, to set the
    service_name default value to "amnesiac", violated a test that
    parameter names in postconf output must match 1:1 with parameter
    names in the postlink script.
  * Portability: support for recent FreeBSD, NetBSD, and OpenBSD
    versions.
  * Bugfix (defect introduced: Postfix 2.2, date 20041207): When
    truncating a database file, the cdb: database client looked at
    the file size from before requesting an exclusive lock on a
    database file, instead of the file size after the exclusive
    lock was granted. Found by Claude Opus 4.6.
  * Bugfix (defect introduced: Postfix alpha, date 19980309): file
    descriptor leak after fork() failure. Found by Claude Opus 4.6.
  * Mistakes in debug logging. Found by Claude Opus 4.6. This
    affected two files in Postfix 3.8 and 3.9, three files in Postfix
    3.10 and 3.11.
  * Unchecked null pointer results after an out-of-memory condition
    in a library dependency. Found by Claude Opus 4.6. The fix is
    to return an error status or to log a fatal error. This affected
    three source files.
  * Missing or incomplete guards for ssize_t or int overflow, found
    by Claude Opus 4.6. This affected three source files. These
    limits are unlikely to be exceeded because the size of in-memory
    objects is limited by design (the number of in-memory objects
    is also limited).</changelog>
  <changelog author="varkoly@suse.com" date="1778241600">- AUDIT-0: postfix: move permissions from /etc to /usr/share/permissions
  (bsc#1264563) Apply proposed changes.</changelog>
  <changelog author="suse+build@de-korte.org" date="1779019200">- update to 3.11.3
  * Bitrot: builds with musl libc broke, because they were using an
    obsolete NO_SNPRINTF code path that had not been updated for Claude
    Code findings.
  * Two fixes for a signed integer overshift condition (a left shift into
    the sign bit). This "works" on contemporary CPUs, but may break in
    the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
  * Viktor Dukhovni fixed an 'uninitialized value' error in the
    'collate.pl' script.
  * Test code fixes by Viktor Dukhovni for a deprecation warning with
    OpenSSL 4.0, and for a race condition that caused a test script
    to fail.</changelog>
  <changelog author="suse+build@de-korte.org" date="1781784000">- update to 3.11.4
  * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
  * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
  * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
  * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
  * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.</changelog>
</package>
<package pkgid="ecb3e01caec7af4965d345145cca0a1761b709e186db79c42938d941eaa7a579" name="postgresql16" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="52b0c71a1303e63b91dbc419719edd23f9d16592c4417c603f32465abf124fdb" name="postgresql16" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="36974491c7451e34efa048ed7e61ca5ed59b268e1c703f25a5c9132ed594ade9" name="postgresql16" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="f59c217d6d0f6a397f35509e62cb537d67e98b0c58777612101dac030c19a92f" name="postgresql16" arch="src">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="8005963f21c958cb1bc0b8492f2d2cd3b3e3666a8cfe1f3d79895516f3452e5a" name="postgresql16" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="53b5457c6e9589f0e80257b3c2de76b361bd60a78a33b3ab49198f15f9924a1c" name="postgresql16-contrib" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="940d1c2876db1016aaa08cc3e716035ea02db3a9842a60a7f8eac5687335904d" name="postgresql16-contrib" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="8bf6e4f0f07daf0193b51645dcd5470136929c2d43409404f43edb70135c19cb" name="postgresql16-contrib" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="034ef28561f0be84388b811ed437a1f93df48d3659df7ba134bb3db344b2057e" name="postgresql16-contrib" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="d532ded6f8f4f2ed1b73b42d30a4b983e70a2eb9442083ae27dd4740af873661" name="postgresql16-devel" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="1763bb1c928aba278ad4a136ad8832f49e064b24e5a2a4c2e87991392a5fad2d" name="postgresql16-devel" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="566be84c1bbb997820f2bba5b71352a34c03623ab6a84404e300ba54b79dd7df" name="postgresql16-devel" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="359f62dad188e00e823496443c970eb462f997a3d41df83588a244639859349d" name="postgresql16-devel" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="96c0b7e3dff2c195133fc3fb1303ec77b58e190adb7510fe79147f801435c7f0" name="postgresql16-docs" arch="noarch">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="fea7e6cf5078d4068eac121b2f4b06b4001d7b5af7c9ff313db5a1a80ed6c1a4" name="postgresql16-llvmjit" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="719140d8aab0d6ea5c01c0c77f7d37b07bcf123d48c0b49d0583779dad8ccd04" name="postgresql16-llvmjit" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="a5f7e41db9e3252b9f9fa57fe896c61168bd11b59f549bfe0b835665ca9e3691" name="postgresql16-llvmjit" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="7badfd3acf21483e1ac0bb392ef1520f5e17c0d21935b1a279662c50ffe9eded" name="postgresql16-llvmjit" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="8c210a57e78a8d6dfcc7c17e312e168e24a6c7ba4fe32335edfa44082ead76cb" name="postgresql16-llvmjit-devel" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="bd311531294cf9921e4121183141d8bcadd402902bf3f990ab9b25ea04eb76da" name="postgresql16-llvmjit-devel" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="a9a25c3497b02d86f608c4d1a704b203b4a90d30f9bf9e56509cb918d1404630" name="postgresql16-llvmjit-devel" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="12418a3731b958e8f997bfb573edc3aa00304612b85bf8f5b2a7e8fdeceae045" name="postgresql16-llvmjit-devel" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="1984e761b6d20d2810cd7088ca96c6a79ca564c9d93c235c1e198af7ef40667e" name="postgresql16-plperl" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="b7747ee7e6304d40615c3c70ec9c36a5026e459f8a39ce331883b70e62d57ee7" name="postgresql16-plperl" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="be666f20aa06fdbd6ceaa660c13f0a8826b657899c1b191dda7cbc20887d1d47" name="postgresql16-plperl" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="1ed2ac512412dd6a7c24c7589aa0caa46d59457abcc8b79dd52708b05c0c9e5e" name="postgresql16-plperl" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="b7ef4d0be3ef1c540a8dbc341f856fccba5b48ff63a8525d2f59c6364f1738b8" name="postgresql16-plpython" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="049351474b6668f1619250ddf6ffd71013e774eb49d376dc2769a250a877d88d" name="postgresql16-plpython" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="a6746f47527a43c59de7c144c611aabaa10ab85e0207a71f57a9ee47e8e4104f" name="postgresql16-plpython" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="a6b09c9e10c0c736fa3197f7cc7379a2d1185bd4b1409622610521109d09196a" name="postgresql16-plpython" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="4ced03fde2a0134e124d0a11dfc3a29571b9f1613d7da1c0f1994168458b6382" name="postgresql16-pltcl" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="bbbaa0e24532c24c075c9f1ab7732e949b641b4079b2d821d198a7f4750de735" name="postgresql16-pltcl" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="fbaebbded5fefd89a4b349e43f844e5866e103cff93ac31b7b166b547843201a" name="postgresql16-pltcl" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="61b9bfe4d2fa4b550f713b5698e8d4f9dbb4a1287587138556641480293663dc" name="postgresql16-pltcl" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="6f835833405a9a9764d11f2b72446c1652cce08fe617fe44c7a99b840a6fcfbf" name="postgresql16-server" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="1b75b7b517294747bbebf9b71bd10a0172a8e3113c425005245fae14e9a7b477" name="postgresql16-server" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="20a60901788af9a97cf9778d301034e6501127cb3a077735c8020b5053888d4b" name="postgresql16-server" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="3b30102b85554556bc9aa99ef7440a79cd0df829999e7b9ceb67af7b55cfed2a" name="postgresql16-server" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="1168f0ea91a632b5a88919cd6bbab2b16f87813d6495f511030ad7fea9d55484" name="postgresql16-server-devel" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="ac74b959a440a56f3edfc61fb79fb31ee1d21d644aba1baa6eb5004d75f1bad0" name="postgresql16-server-devel" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="8f6930572d6a5eb1e6de312e0fd38e2d5ee9389cdf9e50852fcc7e1a274159b2" name="postgresql16-server-devel" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="e4e3fac42350effc0066fd069a023bad163b0d51213dbaa714096508b32a7716" name="postgresql16-server-devel" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="5d2975c654f8872869d345c50ada009e172f3efe9179a19bae7173ae466a6deb" name="postgresql16-test" arch="aarch64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="07972a8284cfcad23803385be06ddc9a1a281ae856d2ad69999da7276bfd6ce5" name="postgresql16-test" arch="ppc64le">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="76276ffdbbf78d4fe8fc33be2871f7a10be29043d35d4102a1428d9b9839e067" name="postgresql16-test" arch="s390x">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
<package pkgid="9fe9925040a703b068af130767459ce0ed3e31b2cbd9903628da84779b0a571a" name="postgresql16-test" arch="x86_64">
  <version epoch="0" ver="16.13" rel="2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1710244800">- Require LLVM &lt;= 17 for now, because LLVM 18 doesn't seem to work.</changelog>
  <changelog author="max@suse.com" date="1715169600">- Upgrade to 16.3 (bsc#1224051):
  * bsc#1224038, CVE-2024-4317: Restrict visibility of pg_stats_ext
    and pg_stats_ext_exprs entries to the table owner. See the
    release notes for the steps that have to be taken to fix
    existing PostgreSQL instances.
  * Fix incompatibility with LLVM 18.
  * https://www.postgresql.org/docs/release/16.3/
- Prepare for PostgreSQL 17.
- Make sure all compilation and doc generation happens in %build.</changelog>
  <changelog author="mrueckert@suse.de" date="1723291200">- Upgrade to 16.4 (bsc#1229013):
  * bsc#1229013, CVE-2024-7348 PostgreSQL relation replacement
    during pg_dump executes arbitrary SQL
  * https://www.postgresql.org/about/news/p-2910/
  * https://www.postgresql.org/docs/release/16.4/</changelog>
  <changelog author="max@suse.com" date="1726747200">- Don't build the libs and mini flavor anymore to hand over to
  PostgreSQL 17.</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1726833600">- Pull upstream patch to fix tests with timezone 2024b
  * postgresql-testsuite-timezone-fix.patch</changelog>
  <changelog author="max@suse.com" date="1730808000">- Sync spec file from postgresql17.</changelog>
  <changelog author="max@suse.com" date="1731499200">- Upgrade to 16.5:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql-testsuite-timezone-fix.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/16.5/</changelog>
  <changelog author="max@suse.com" date="1732017600">- Upgrade to 16.6:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/16.6/</changelog>
  <changelog author="max@suse.com" date="1738065600">- Fix build, add postgresql-tzdata2025a.patch</changelog>
  <changelog author="max@suse.com" date="1739275200">- Upgrade to 16.7:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/16.7/
  * https://www.postgresql.org/about/news/-3015/
- Disable LLVM JIT on loongarch64</changelog>
  <changelog author="max@suse.com" date="1739880000">- Upgrade to 16.8:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/16.8/
  * https://www.postgresql.org/about/news/p-3018/</changelog>
  <changelog author="max@suse.com" date="1746792000">- Upgrade to 16.9:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/16.9/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.</changelog>
  <changelog author="mrueckert@suse.de" date="1755172800">- Upgrade to 16.10:
  * https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
  * https://www.postgresql.org/docs/release/16.10/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)</changelog>
  <changelog author="max@suse.com" date="1758628800">- Sync spec file from version 18.</changelog>
  <changelog author="max@suse.com" date="1762948800">- Upgrade to 16.11:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/16.11/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.</changelog>
  <changelog author="max@suse.com" date="1763121600">- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.</changelog>
  <changelog author="max@suse.com" date="1763985600">- Fix build with uring for post SLE15 code streams.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1765281600">- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch</changelog>
  <changelog author="max@suse.com" date="1770811200">- Update to 16.12:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/16.12/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.</changelog>
  <changelog author="max@suse.com" date="1771934400">- bsc#1258754: Update to 16.13 to fix two regressions in 16.12:
  * https://www.postgresql.org/docs/release/16.13/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".</changelog>
</package>
</otherdata>