# changelog

author: Robert Scheck <robert@fedoraproject.org> - 4.7.0-1
changelog:
  - Upgrade to 4.7.0 (#2369521)
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371578, thanks to Marcos Mello)


author: Stephen Smoogen <smooge@fedoraproject.org> - 2.2.2-2.20190926git1b8ad57
changelog:
  - Add conditional for perl-UTF8. Thanks to Todd Zullinger and Alexander Kohr
  - Update to newer git tag to fix check_smb


author: Packit <hello@packit.dev> - 1.2.1-1
changelog:
  - Accept the Clavister OneConnect VPN Android client (#485)
  - No longer require to set device name per vhost (#480)
  - Account the correct number of points when proxyproto is in use (#529)
  - nuttcp tests were replaced with iperf3 that is available
    in more environments
  - occtl: fix duplicate key in `occtl --json show users` output


author: Packit <hello@packit.dev> - 1.2.2-1
changelog:
  - Fix session and accounting data tracking of ocserv. This
    reverts fix for #444 (#541)
  - No longer account ICMP and IGMP data for idle session detection


author: Packit <hello@packit.dev> - 1.2.4-1
changelog:
  - Get connection speed limits (traffic shaping) from RADIUS (#554)
  - Fix logging to stderr: add missing newline.
  - Fixed compatibility with AnyConnect clients on Linux (#544)
  - Detect the new AnyConnect-compatible identifier of OpenConnect clients
  - occtl: Print bit rates as kb/s.


author: Packit <hello@packit.dev> - 1.3.0-1
changelog:
  - Switch to https://github.com/nodejs/llhttp from http-parser.
    http-parser was a liability as an unmaintained project (#598)
  - Bump the number of groups per account from 128 to 512 (#219)
  - Allow connecting users to select an authgroup by appending the
    group name to the URL, as in https://vpn.example.com/groupname;
    this introduces the select-group-by-url config option (#597).
  - Informational messages due to configuration loading are not printed
    during worker initialization.


  - Resolves: rhbz#2279186


author: Packit <hello@packit.dev> - 1.4.1-1
changelog:
  - [SECURITY] Fixed authentication bypass (medium severity) when using
    certificate authentication with cert-user-oid set to SAN(rfc822name):
    a client presenting a valid CA-signed certificate without the expected
    RFC822 SAN field could authenticate using password credentials alone,
    bypassing the intended certificate-to-username binding. Requires the
    attacker to possess both a valid CA-signed certificate and valid user
    credentials (#694)
  - The bundled inih was updated to r62.
  - The bundled protobuf-c was updated to 1.5.2.
  - Fixed a bug where session timeout could be bypassed by reconnecting
    (e.g., closing/opening laptop lid) (#599)
  - occtl: show user command now includes a Session started at: field,
    indicating when the VPN session was established
  - occtl: Fix column misalignment in ban command outputs
  - occtl: Fix show ip bans may produce invalid JSON (#683)
  - Handle dotted client hostnames (e.g., .local) by stripping the domain suffix
  - Renamed `min-reauth-time` configuration option to `ban-time` to better reflect
    its purpose (#676). This option defines the duration (in seconds) for which
    an IP address is banned after exceeding the maximum allowed `max-ban-score`.
    Default is 300 seconds (5 minutes).
  - Fixed ocserv-worker process title
  - Fixed ignored udp-port in vhost (#612)


  - Resolves: rhbz#2443556


author: Remi Collet <remi@fedoraproject.org> - 8.0.6-1
changelog:
  - update to 8.0.6
    fixes CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 and CVE-2025-46819
  - update documentation to 8.0.5


author: Remi Collet <remi@fedoraproject.org> - 8.0.7-1
changelog:
  - Valkey 8.0.7 - Released Mon 23 February 2026
  - Upgrade urgency SECURITY: This release includes security fixes


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.0.3-12
changelog:
  - Fix FTBFS. Thanks @limb for the hotfix.
  - Upstream work ongoing for improved support with newer versions of the C programming language and compilers.


