# changelog

author: Terje Rosten <terjeros@gmail.com> - 3.1.8-1
changelog:
  - 3.1.8
  - apt-key is gone
  - Add openssl-devel to buildreq
  - Fix include issue
  - apt-extracttemplates has moved


author: Cristian Le <git@lecris.dev> - 18.11.0-1
changelog:
  - Update to version 18.11.0
  - Atuin 18.9.0 fixes fish 4.x removal of `bind -k` (rhbz#2440541)
  - Add better documentation of how to handle MSRV
  - Move the profile.d script outside of the spec file


author: Than Ngo <than@redhat.com> - 144.0.7559.59-1
changelog:
  - Update to 144.0.7559.59
    * CVE-2026-0899: Out of bounds memory access in V8
    * CVE-2026-0900: Inappropriate implementation in V8
    * CVE-2026-0901: Inappropriate implementation in Blink
    * CVE-2026-0902: Inappropriate implementation in V8
    * CVE-2026-0903: Insufficient validation of untrusted input in Downloads
    * CVE-2026-0904: Incorrect security UI in Digital Credentials
    * CVE-2026-0905: Insufficient policy enforcement in Network
    * CVE-2026-0906: Incorrect security UI
    * CVE-2026-0907: Incorrect security UI in Split View
    * CVE-2026-0908: Use after free in ANGLE


author: Than Ngo <than@redhat.com> - 144.0.7559.132-1
changelog:
  - Update to 144.0.7559.132
    * CVE-2026-1861: Heap buffer overflow in libvpx
    * CVE-2026-1862: Type Confusion in V8
  - Add BR on esbuild
  - Disable devtool bundle
  - Update scripts for downloading the source


author: Than Ngo <than@redhat.com> - 145.0.7632.45-1
changelog:
  - Update to 145.0.7632.45
    * CVE-2026-2313: Use after free in CSS
    * CVE-2026-2314: Heap buffer overflow in Codecs
    * CVE-2026-2315: Inappropriate implementation in WebGPU
    * CVE-2026-2316: Insufficient policy enforcement in Frames
    * CVE-2026-2317: Inappropriate implementation in Animation
    * CVE-2026-2318: Inappropriate implementation in PictureInPicture
    * CVE-2026-2319: Race in DevTools
    * CVE-2026-2320: Inappropriate implementation in File input
    * CVE-2026-2321: Use after free in Ozone
    * CVE-2026-2322: Inappropriate implementation in File input
    * CVE-2026-2323: Inappropriate implementation in Downloads


author: Than Ngo <than@redhat.com> - 145.0.7632.109-1
changelog:
  - Update to 145.0.7632.109
    * CVE-2026-2648: Heap buffer overflow in PDFium
    * CVE-2026-2649: Integer overflow in V8
    * CVE-2026-2650: Heap buffer overflow in Media


author: Than Ngo <than@redhat.com> - 145.0.7632.116-1
changelog:
  - Update to 145.0.7632.116
    * CVE-2026-3061: Out of bounds read in Media
    * CVE-2026-3062: Out of bounds read and write in Tint
    * CVE-2026-3063: Inappropriate implementation in DevTools


author: Robert Scheck <robert@fedoraproject.org> - 4.7.0-1
changelog:
  - Upgrade to 4.7.0 (#2369521)
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371578, thanks to Marcos Mello)


author: Petr Menšík <pemensik@redhat.com> - 2.15.0-1
changelog:
  - Update to 2.15.0
  - Report statistics of unexpected messages
  - Datafiles converted to \DDD similar to other DNS tools, RFC 1035 format.
  - statistics can be printed as json stream with -j parameter


author: Simone Caronni <negativo17@gmail.com> - 0.0.13^20250419gitc2860cc-2
changelog:
  - Clean up SPEC file.
  - Simplify conditionals
  - Drivers for ppc64le are long gone
  - RPMFusion package is long gone


author: Derek Weitzel <dweitzel@unl.edu> - 1.1.2-1
changelog:
  - Turn off CMAKE unity builds
  - Add a mutex around requesting public keys to stop overloading issuers


author: Derek Weitzel <dweitzel@unl.edu> - 1.2.0-1
changelog:
  - Fix segfault if the JSON parser cannot parse the JWKS
  - Fix float time claims issue and improve error handling
  - Fix security issue with malicious issuer handling in error messages
  - Improve JWTVerificationException message to include the invalid issuer
  - Update usage on verify command to make the TOKENFILE explicit
  - Read token for scitokens-verify from stdin
  - Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
  - Adding asan value to the job name
  - Turn off building unit tests by default.
  - Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the address sanitizer.  Also enable this in CI, so that tests fail if they hit a memory leak or other memory problem.
  - Fix memory leak in store_public_ec_key
  - Fix memory leaks in the unit tests
  - Fix memory leak in rs256_from_coords
  - Fix memory leak in scitokens_verify


author: Brian Bockelman <bbockelman@morgridge.org> - 1.3.0-1
changelog:
  - Add scitokens-generate-jwks CLI for key generation.
  - Add environment variable-based configuration on library initialization.
  - Add per-issuer lock to prevent multiple concurrent queries against issuers without a known key
  - Add negative cache for failed issuer lookups (preventing frequent re-queries)
  - Add monitoring API for per-issuer validation statistics
  - Add optional background thread for JWKS refresh
  - Add keycache load, metadata, and delete APIs
  - Revert "Fix memory leak in rs256_from_coords" by @djw8605
  - Add CTest-based integration test with JWKS server and TLS infrastructure


author: Derek Weitzel <dweitzel@unl.edu> - 1.4.0-2
changelog:
  - Add keycache.allow_in_memory config option with in-memory SQLite fallback
  - Add persistent anchor connection for shared in-memory SQLite database
  - Improve error messages when keycache file cannot be read or written
  - Add integration test for keycache not-writable error message
  - Improve cache directory permission tests to handle common deployment misconfigurations
  - Implement keycache location retrieval and update library to 0.0.3
  - Fix typo in SQLite file extension in integration and main tests


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.0.3-12
changelog:
  - Fix FTBFS. Thanks @limb for the hotfix.
  - Upstream work ongoing for improved support with newer versions of the C programming language and compilers.


