# changelog

author: Jiaxin Yang <jiaxinyyang@tencent.com> - 6.0.133-1
changelog:
  - [Type] security
  - [DESC] Update to .NET SDK 6.0.133 and Runtime 6.0.33
  - [DESC] fix CVE-2024-38095


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 6.0.135-1
changelog:
  - [Type] security
  - [DESC] Update to .NET SDK 6.0.135 and Runtime 6.0.35
  - [DESC] fix CVE-2024-43485,CVE-2024-43483,CVE-2024-43484


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 7.0.119-1
changelog:
  - [Type] security
  - [DESC] Update to .NET SDK 7.0.119 and Runtime 7.0.19
  - [DESC] fix CVE-2024-21392, CVE-2024-30046, CVE-2024-30045


author: Fanjun Kong <fanjunkong@tencent.com> - 1.14.5-1
changelog:
  - Update to 1.14.5
  - Add additional image format dependencies 
  - Use SPDX license format
  - Remove .la files


author: Doris Chao <doriscchao@tencent.com> - 3.6.9-1
changelog:
  - [Type] security
  - [DESC] Update to 3.6.9 to fix CVE-2024-34509，CVE-2024-34508,CVE-2022-43272.
  - And also add patches:
    * 0001-Fixed-another-issue-with-invalid-mono-images.patch
      (CVE-2025-25472)
    * 0001-Fixed-another-issue-with-invalid-DICOM-images.patch
      (CVE-2025-25474)
    * 0001-Fixed-issue-with-invalid-RLE-compressed-DICOM-images.patch
      (CVE-2025-25475)
    * 0001-Added-check-to-make-sure-HighBit-BitsAllocated.patch
      (CVE-2024-52333)
    * 0001-Replaced-call-of-delete-by-delete.patch
    * 0001-Fixed-issue-rendering-invalid-monochrome-image.patch
      (CVE-2024-47796)


author: Doris Chao <doriscchao@tencent.com> - 1.8.0-1
changelog:
  - [Type] security
  - [DESC] Update to version 1.8.0. Fixed vulnerability CVE-2024-29864, which was 
  -  previously resolved in version 1.7.0.1.


author: Zhao Zhen <jeremiazhao@tencent.com> - 2.99.18-1
changelog:
  - Upgraded to upstream 2.99.18
  - This is the last development version before 3.0 release
  - Switching building system from automake to meson
  - Fixed CVE-2023-44441 CVE-2023-44443 CVE-2023-44444


author: Shuo Wang <abushwang@tencent.com> - 4.3.5-4
changelog:
  - fix ceilometer-upgrade stuck:
  - 1. backport python3 patch
  - 2. update gnocchi-api.service
  - 3. update Requires


author: Shuo Wang <abushwang@tencent.com> - 1.12.1-4
changelog:
  - backport patch to fix CVE-2021-37501
  - Check for overflow when calculating on-disk attribute data size


author: Pengda Dou <doupengda@loongson.cn> - 1.8.7-3
changelog:
  - [Type] bugfix
  - [DESC] fix url error problem , remove Changlog and imsettings files that aren't there


author: rockerzhu <rockerzhu@tencent.com> - 1:6.0.1-2
changelog:
  - [Type] other
  - [Desc] Add INCUS_SOCKET env variable to fix incusd communication failure with systemd.


author: Zhao Zhen <jeremiazhao@tencent.com> - 21.0.5-1
changelog:
  - initial build, imported from konajdk upstream version 21.0.5
  - bootstrap building using prebuilt konajdk binary tarball
  - fixed CVE-2024-21235 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217


author: Zhao Zhen <jeremiazhao@tencent.com> - 21.0.6-1
changelog:
  - updated to upstream version 21.0.6
  - fixed CVE-2025-21502
  - unified x86_64 aarch64 loongarch specfile


author: Zhao Zhen <jeremiazhao@tencent.com> - 21.0.8-1
changelog:
  - Updated to upstream version 21.0.8
  - Fixed CVE-2025-50059 CVE-2025-30749 CVE-2025-50106 CVE-2025-30754


author: Miaojun Dong <zoedong@tencent.com> - 2.28.10-1
changelog:
  - Upgrade version to 2.28.10 (Fix CVE-2025-27809, CVE-2025-27810)
  - Update Source0 to use official release files


author: OpenCloudOS Release Engineering <releng@opencloudos.tech> - 3.8-1
changelog:
  - [Type] Security
  - [DESC] upgrade to 3.8
  - CVE-2024-48992 CVE-2024-11003 CVE-2024-48990 CVE-2024-48991


author: Zhao Zhen <jeremiazhao@opencloudos.tech> - 20.19.0-1
changelog:
  - upgraded to upstream 20.19.0
  - fixed CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2025-22150
  - CVE-2024-36138 CVE-2024-22020 CVE-2024-22018 CVE-2024-36137 CVE-2024-37372


author: Wang Guodong <gordonwwang@tencent.com> - 1.43-2
changelog:
  - Fixed dist of srpm from ocsNone.src.rpm to ocs2.src.rpm;
  - Turn off distgit_namespaced through ocspkg.conf;


author: Liangliang Zhai <zhailiangliang@loongson.cn> - 1.21.4.3-7
changelog:
  - [Type] other
  - [DESC] Remove macro loongarch64 for avoiding not finding loongarch patch
           Modify add-loongarch-support.patch for delete unnecessary modifications


author: Feng Weiyao <wynnfeng@tencent.com> - 1.21.4.4-4
changelog:
  - [Type] bugfix
  - [DESC] set AutoReqProv no to avoid requiring libssl.so.1.1(OPENSSL_1_1_0)(64bit) because openresty-openssl111 offers it


author: Builder <corcpp@foxmail.com>
changelog:
  - first version
  - split-lock, irq-off, profile, task-state, watchdog, kmemleak, kvm-exit, mpdelay.
  - Kernel stack support, user stack support


author: jackeyji <jackeyji@tencent.com> - 4.9.5-1
changelog:
  - [Type] other
  - [DESC] upgrade to 4.9.5 to fix CVE-2024-1753 CVE-2024-3727 CVE-2024-24786 and CVE-2024-28180


author: jackeyji <jackeyji@tencent.com> - 5.2.5-1
changelog:
  - [Type] security
  - [DESC] upgrade to 5.2.5 to fix CVE-2024-9341 CVE-2024-9407 CVE-2024-9675 and CVE-2024-9676


author: Wang Guodong <gordonwwang@tencent.com> - 16.1-1
changelog:
  - Upgrade to version 16.1
  - Remove /var/run/postgresql
  - Add versioned provide to the default version


author: Wang Guodong <gordonwwang@tencent.com> - 16.5-1
changelog:
  - Upgrade to version 16.5
  - CVEs fixed: CVE-2024-10976, CVE-2024-10977, CVE-2024-10978, CVE-2024-10979


author: Miaojun Dong <zoedong@tencent.com> - 0.6.2-6
changelog:
  - Disable typeguard check, stack-data is not yet adapted to typeguard v3 and v4
  - Fix the color diffrencent and Update test_pygments_example with pygments-2.16


author: OpenCloudOS Release Engineering <releng@opencloudos.tech> - 6.3.1-2
changelog:
  - Rebuilt for loongarch release

  -* Thu Dec 28 2023 cunshunxia <cunshunxia@tencennt.com> - 6.3.1-1
  -- revert to 6.3.1 for openstack-aodh-15.0.0 installation requirement.

  -* Thu Dec 21 2023 Upgrade Robot <upbot@opencloudos.org> - 8.2.3-1
  -- Upgrade to version 8.2.3


author: Shuo Wang <abushwang@tencent.com> - 3.12.2-11
changelog:
  - fix CVE-2024-12254
  - gh-127655: Ensure _SelectorSocketTransport.writelines pauses the
  - protocol if needed (GH-127656) (#127664)


author: Shuo Wang <abushwang@tencent.com> - 3.12.2-13
changelog:
  - fix CVE-2025-1795
  - email/_header_value_parser: don't encode list separators (GH-100885) (GH-115592)
  - Fix for email.generator.Generator with whitespace between encoded words. (GH-92281) (#119246)
  - Fix regression introduced in gh-100884: AttributeError when re-fold a long address list.


author: cunshunxia <cunshunxia@tencent.com> - 3.12.2-15
changelog:
  - fix CVE-2025-4435.
  - Also addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517
  - gh-135034: Normalize link targets in tarfile, add
   `os.path.realpath(strict='allow_missing')` (GH-135037)
  - fix CVE-2025-6069


author: Shuo Wang <abushwang@tencent.com> - 3.12.2-16
changelog:
  - fix CVE-2025-4516
  - gh-116042: Fix location for SyntaxErrors of invalid escapes in the tokenizer (GH-116049) (#130065)
  - gh-120155: Fix Coverity issue in parse_string() (GH-120997) (#121006)
  - gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) (#134337)


author: cunshunxia <cunshunxia@tencent.com> - 3.12.2-17
changelog:
  - fix CVE-2025-8194.
  - gh-130577: tarfile now validates archives to ensure member offsets
  - are non-negative (GH-137027)


author: Doris Chao <doriscchao@tencent.com> - 1.6.11-1
changelog:
  - [Type] security
  - [DESC] Update to 1.6.11 to fix CVE-2024-42008,CVE-2024-42009 and CVE-2025-49113.


author: Doris Chao <doriscchao@tencent.com> - 2.67.1-1
changelog:
  - [Type] security
  - [DESC] update to 2.67.1 to fix CVEs,including CVE-2024-1724,CVE-2024-29068 and
  - CVE-2024-29069.


author: Liangliang Zhai <zhailiangliang@loongson.cn> - 17.0.0-2
changelog:
  - [Type] other
  - [DESC] Fix build error: 'CapabilityLongConstantCompositeINTEL' was not declared in this scope


author: Doris Chao <doriscchao@tencent.com> - 7.0.7-1
changelog:
  - [Type] security
  - [DESC] Upgrade to Suricata 7.0.7 to resolve multiple CVEs, such as CVE-2024-47188,
  - CVE-2024-47187, CVE-2024-45795, CVE-2024-45796, and CVE-2024-47522.


author: Sinong Chen <costinchen@tencent.com> - 7.0.10-1
changelog:
  - [Type] security
  - [DESC] Upgrade to Suricata 7.0.10 to fix CVE-2025-29915, CVE-2025-29916,
  - CVE-2025-29917, CVE-2025-29918.


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 115.14.0-1
changelog:
  - Update to 115.14.0-1.
  - Fix CVE-2024-7519, CVE-2024-7522, CVE-2024-7521, CVE-2024-7531, CVE-2024-7527
  - CVE-2024-7529, CVE-2024-7525, CVE-2024-7526


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 128.4.0-1
changelog:
  - Update to 128.4.0.
  - Fix CVE-2024-10466, CVE-2024-10465, CVE-2024-10467, CVE-2024-10464, CVE-2024-10461
  - CVE-2024-10459, CVE-2024-10462, CVE-2024-10460, CVE-2024-10463, CVE-2024-10458


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 128.5.0-1
changelog:
  - Update to 128.5.0.
  - Fix CVE-2024-11699, CVE-2024-11692, CVE-2024-11694, CVE-2024-11696, CVE-2024-11695
  - CVE-2024-11693, CVE-2024-11698, CVE-2024-11697, CVE-2024-11691, CVE-2024-11159


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 128.7.0-1
changelog:
  - Update to 128.7.0.
  - Fix CVE-2025-1013, CVE-2025-1015, CVE-2025-1010, CVE-2025-1016, CVE-2025-1014,
  - CVE-2025-1012, CVE-2025-1009, CVE-2025-1011, CVE-2025-0510, CVE-2025-1017,
  - CVE-2025-0237, CVE-2025-0239, CVE-2025-0238, CVE-2025-0241, CVE-2025-0243,
  - CVE-2025-0240, CVE-2025-0242


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 128.10.0-1
changelog:
  - Update to 128.10.0.
  - Fix CVE-2025-4091, CVE-2025-4087, CVE-2025-4093, CVE-2025-4083, CVE-2025-2817,
  - CVE-2025-27363, CVE-2025-3029, CVE-2025-3030, CVE-2025-3028, CVE-2025-1930,
  - CVE-2025-1935, CVE-2025-1936, CVE-2025-1934, CVE-2025-1938, CVE-2025-1931,
  - CVE-2025-1933, CVE-2025-1932, CVE-2025-1937, CVE-2025-3932, CVE-2025-3909,
  - CVE-2025-3877, CVE-2025-3875, CVE-2025-3523, CVE-2025-2830, CVE-2025-26695,
  - CVE-2025-26696


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 128.13.0-1
changelog:
  - Update to 128.13.0.
  - Fix CVE-2025-8034, CVE-2025-8030, CVE-2025-8031, CVE-2025-8035, CVE-2025-8032
  - CVE-2025-8027, CVE-2025-8033, CVE-2025-8029, CVE-2025-8028


author: Shuo Wang <abushwang@tencent.com> - 0.9.7-4
changelog:
  - backport patch to fix CVE-2024-34402 CVE-2024-34403
  - Protect against integer overflow in ComposeQueryEngine and ComposeQueryMallocExMm


author: Shop You <shopyou@example.com> - 8.0.1-3
changelog:
  - [Type] security
  - [DESC] Resolves: CVE-2025-49112
  - Apply valkey-8.0.1-CVE-2025-49112.patch to fix networking.c buffer check


author: Doris Chao <doriscchao@tencent.com> - 0.5.3-2.git20230121
changelog:
  - [Type] security
  - [DESC] Add patch to fix CVEs,including CVE-2022-38223, CVE-2023-38253,
  - CVE-2023-38252 and CVE-2023-4255.


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 6.0.36-1
changelog:
  - Update to 6.0.36
  - fix CVE-2024-42330, CVE-2024-36461, CVE-2024-36464, CVE-2024-42332, CVE-2024-36463,
  - CVE-2024-42333, CVE-2024-22120, CVE-2024-36460, CVE-2024-36467, CVE-2024-22117,
  - CVE-2024-42327, CVE-2024-22123, CVE-2024-22121, CVE-2024-22114, CVE-2024-36466,
  - CVE-2024-22122


author: Upgrade Robot <upbot@opencloudos.tech> - 0.2.44-1
changelog:
  - [Type] security
  - [DESC] Upgrade to version 0.2.44, fix CVEs: CVE-2025-2173, CVE-2025-2174, CVE-2025-2175, 
    CVE-2025-2176, CVE-2025-2177


