# changelog

author: Than Ngo <than@redhat.com> - 142.0.7444.175-1
changelog:
  - Update to 142.0.7444.175
    * High CVE-2025-13223: Type Confusion in V8
    * High CVE-2025-13224: Type Confusion in V8


author: Than Ngo <than@redhat.com> - 142.0.7444.175-4
changelog:
  - Enable system libcxx
  - Fix link error when building with system libcxx
  - Apply memory-allocator-dcheck-assert-fix for aarch64


author: Than Ngo <than@redhat.com> - 143.0.7499.40-1
changelog:
  - Update to 143.0.7499.40
    * High CVE-2025-13630: Type Confusion in V8
    * High CVE-2025-13631: Inappropriate implementation in Google Updater
    * High CVE-2025-13632: Inappropriate implementation in DevTools
    * High CVE-2025-13633: Use after free in Digital Credentials
    * Medium CVE-2025-13634: Inappropriate implementation in Downloads
    * Medium CVE-2025-13720: Bad cast in Loader
    * Medium CVE-2025-13721: Race in v8
    * Low CVE-2025-13635: Inappropriate implementation in Downloads
    * Low CVE-2025-13636: Inappropriate implementation in Split View
    * Low CVE-2025-13637: Inappropriate implementation in Downloads
    * Low CVE-2025-13638: Use after free in Media Stream
    * Low CVE-2025-13639: Inappropriate implementation in WebRTC
    * Low CVE-2025-13640: Inappropriate implementation in Passwords


author: Than Ngo <than@redhat.com> - 143.0.7499.109-1
changelog:
  - Update to 143.0.7499.109
    * High: Under coordination
    * Medium CVE-2025-14372: Use after free in Password Manager
    * Medium CVE-2025-14373: Inappropriate implementation in Toolbar
  - Workaround problem of auto dark mode inverting images and making them unreadable


author: Petr Menšík <pemensik@redhat.com> - 1.3.2-2
changelog:
  - New package dependency of dnscap (rhbz#2418607)
  - Modernize upstream RPM spec according to Fedora Packaging Guidelines
  - Provide also lowercase devel package name
  - Remove Group: and ldconfig obsolete features
  - Uploaded new sources
  - Include LICENSE file


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.4-1
changelog:
  - New GCT release v6.2.20251212
  - Drop patches included in the release
  - Drop old system V init scripts


author: Robert-André Mauchin <zebob.m@gmail.com> - 1.2.0-2
changelog:
  - Fix s390x tests and RISCV build
  - Introduces a patch that fix tests on BigEndian
  - Introduces a patch that disable RVV runtime dispatch for RISCV builds


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.2.16-4
changelog:
  - Change private key cipher to aes-256-cbc
  - Remove obsolete system V conditionals in the specfile
  - Move user/group creation logic to sysusers.d fragments


author: Richard Russon <rich@flatcap.org> - 20241212-1
changelog:
  - Features
    - #4437 show message preview in compose view
    - #4439 add trailing commas when editing addresses
  - Bug Fixes
    - #4444 expando: fix overflow
    - #4461 Spaces can be wide
    - #4464 Remove BOM from UTF-8 text
    - #4467 Bug with wrong fingerprints in certificate_file
    - #4470 fix postponed sorting assertion failure
    - #4472 fix: `save_attachment_open()` when overwriting
    - #4473 add text-wrapping to compose message preview pager
    - #4475 edit_headers: cleanup temporary file on error
    - expando: fix crash on empty '[]' date
    - expando: fix container formatting
    - browser: fix 'tag-' display
    - query: fix memory leak
    - fix more arrow_cursor + search
  - Changed Config
    - Config Renames:
      - `$pgp_sort_keys`       -> `$pgp_key_sort`
      - `$sidebar_sort_method` -> `$sidebar_sort`
      - `$sort_alias`          -> `$alias_sort`
      - `$sort_browser`        -> `$browser_sort`
    - Changed Defaults:
      - `set alias_format = "%3i %f%t   | %C%> %Y"`
      - `set query_format = "%3i %t   | %C%> %Y"`
  - Translations
    - 100% German
    - 100% Lithuanian
    - 100% Serbian
    - 100% Turkish
    - 89% French
    - 39% Chinese (Traditional)
  - Coverity Defects
    - Explicit null dereferenced
    - Overflowed constant
    - Overflowed return value
    - Resource leak
  - Docs
    - alias tags
  - Build
    - #4452 only use `struct tm.tm_gmtoff` if available
  - Code
    - #4294 refactor memory allocation
    - #4442 remove unused fields from ComposeSharedData
    - #4447 refactor 'sort' constants
    - #4449 add `mutt_window_swap()`
    - unify Menu data
    - move config to libraries
    - unify Alias/Query
    - expando factor out callbacks
    - refactor `simple_dialog_new()`
    - test: add `TEST_CHECK_NUM_EQ()`
    - fopen: tidy read-only
  - Upstream
    - #4448 Update queue.h


author: Richard Russon <rich@flatcap.org> - 20250113-1
changelog:
  - Bug Fixes
    - #4477 fix crash in folder-hook
    - #4480 fix memory leak in compose message preview (fixes #4478)
    - #4483 query: fix comma-separated names
    - #4485 lua: fix `lua_mutt_call()`
    - #4490 notmuch: refresh the Email if the filename changes
    - fix: no new mail message
    - fix display of certificate fingerprints
    - fix prompt colour
  - Translations
    - 100% Czech
    - 100% German
    - 100% Lithuanian
    - 100% Serbian
    - 100% Slovakian
    - 100% Turkish
    - 91% French
    - 41% Chinese (Traditional)
  - Build
    - #4479 Fix DT_NUMBER entries on 32-bit endian platforms
  - Code
    - #4481 Simplify `mutt_file_fopen()`
    - colour refactoring
    - standardise variable names for temporary files


author: Richard Russon <rich@flatcap.org> - 20250404-1
changelog:
  - Features
    - #4493 config: don't quote enums
    - #4493 link config dump to docs
    - #4494 refactor the Help Page for clarity
    - #4554 CLI: `neomutt -DD` -- Dump Different
    - #4593 browser: tag select rather than descend
  - Bug Fixes
    - #3469 source: fix variable interpretation
    - #4370 `mutt_oauth2`: refactor `sasl_string` computation
    - #4536 expand tabs to spaces in compose preview
    - #4537 fix dumping of initial values
    - #4538 move `real_name` init
    - #4542 Remove `MUTT_NEWFOLDER`, fix appending to mbox
    - #4546 Respect Ignore when modifying an email's headers
    - #4549 fix refresh on toggle `hide_thread_subject`
    - #4550 buffer: fix seek
    - #4551 add comma to single `<complete-query>` match
    - #4595 notmuch: check for parse failure
    - #4596 query: allow `<>`s around email addresses
    - pager: fix normal/stripe colour
    - fix colour leaks in pager
    - fix array leak in the verify certificate dialog
  - Translations
    - 100% German
    - 100% Turkish
    - 96% Lithuanian
    - 86% French
    - 49% Chinese (Traditional)
  - Build
    - #4552 Deprecate some configure options that aren't used anymore
    - build: workaround for unused-result warning
  - Code
    - #4492 colour refactoring
    - #4543 debug: Chain old SEGV Handler
    - #4545 Allow nested `ARRAY_FOREACH()`
    - #4553 config: API `has_been_set()`
    - #4557 config: drop ConfigSet from API functions
    - #4558 drop obsolete pgp/smime menus
    - #4559 array: `foreach_reverse()`
    - #4560 Change description of verify-key to be crypto-scheme agnostic
    - #4561 expando: move EnvList out of library
    - #4570 Simplify the management of NeoMutt Commands
    - #4571 libcli - parse the command line
    - #4580 Split CLI Usage into sections
    - #4582 pager: fix lost `NT_PAGER` notifications
    - #4591 pager: fix refresh on config/colour changes
    - array: upgrade `get_elem_list()`
    - Buffer refactoring
    - coverity: fix defects
    - improve `localise_config()`
    - main: drop -B (batch mode) option
    - merge init.[ch] into main.c
    - refactor version code
    - neomutt: `home_dir`, `username`, `env`
    - query: unify NeoMutt `-D` and `-Q`
    - refactor `main.c`/`init.c`
    - sidebar: streamline expando callbacks
    - test: lots of parse coverage
    - window refactoring
    - window: force recalc|repaint on new windows
  - Upstream
    - Update mutt/queue.h
    - Fix NULL pointer dereference when calling `imap_logout_all()`


author: Richard Russon <rich@flatcap.org> - 20250510-1
changelog:
  - Contrib
    - #4616 Fix gpg-json output
  - Bug Fixes
    - #4600 main: don't stop if /var/spool/mail is missing
    - #4602 color: fix quoted maths
    - #4604 Don't consider "weed" when writing an email to file
    - #4605 help: fix leaks
    - #4612 imap: check for incomplete Mailboxes on sync
    - #4622 fix label completion crash
  - Translations
    - #4622 update Esperanto translation
    - Update lt_LT translations
  - Docs
    -  docs: fix broken functions
  - Build
    - #4607 Check for DocBook XSL
    - #4618 Build and test on FreeBSD


author: Richard Russon <rich@flatcap.org> - 20250905-1
changelog:
  - Security
    - #4623 ncrypt/crypt.c: Protect Message-ID
  - Features
    - #4644 Provide an option to confirm on an empty To
  - Contrib
    - #4645 Add ayu-dark-256 colorscheme
  - Bug Fixes
    - #4635 Handle a non-existing message_cache_dir
    - #4642 Decouple `$crypt_encryption_info` and `$crypt_protected_headers_weed` from `$devel_security`
    - #4650 Return success after querying for config
  - Changed Config
    - Add: `confirm_empty_to = no`
    Confirm when sending an e-mail with an empty To:
  - Translations
    - 100% German
    - 100% Turkish
    - 99% Hungarian
    - 98% Lithuanian
    - 89% French
  - Build
    - #4636 Update FreeBSD CI and workaround `pkg` bug
    - actions: use checkout v5
  - Code
    - #4023 tweak observer event types
    - #4628 Use the standard countof instead of our mutt_array_size()
    - #4637 Update types in test dummy code
    - #4638 remove useless const qualifier from log_queue_get()
    - #4655 Make sure ctype(3) function arguments are valid
    - #4657 Fix warning about unused function and data
    - #4659 Include term.h and [n]curses.h consistently


author: Richard Russon <rich@flatcap.org> - 20251211-1
changelog:
  - Security
    - #4725	deprecate old ssl and tls options
  - Features
    - #4718	add `$message_id_format`
    - Notmuch: hide some old/deprecated features
  - Bug Fixes
    - #4666	limit: force refresh of index bar
    - #4671	Update the status bar on thread [un]collapse
    - #4673	shrink history file on every new entry
    - #4679	Flush S/MIME passkey on failure to sign
    - #4684	execute message-hook sooner
    - #4687	fix: exec auto-completion
    - #4688	Fix infinite loop in GnuTLS socket I/O when socket blocks
    - #4696	`cmd_parse_fetch()`: debug: avoid NULL dereference
    - #4697	expunge: guard against segfault
    - #4719	alias: complete when only one match
    - #4721	browser: fix select/descend folder/mailbox
    - #4726	imap: protect against crash on shutdown
    - fix resolve for tagged save
    - help: fix sorting of unbound functions
    - help: hide deprecated functions
  - Changed Config
    - New: `message_id_format = "<%z@%f>"`
    - Deprecated `ssl_use_sslv2`
    - Deprecated `ssl_use_sslv3`
    - Deprecated `ssl_use_tlsv1`
    - Deprecated `ssl_use_tlsv1_1`
  - Translations
    - 100% Esperanto
    - 100% Lithuanian
    - 100% Serbian
    - 100% Turkish
  - Docs
    - #4665	Revamp the S/MIME docs
    - #4680	Document how to use S/MIME with GPGMe
    - #4692	update the contribution guidelines
    - fix deprecated $pager example
    - lots man pages fixes
    - update help for sort options
  - Build
    - #4668	fix build for re-entrant ncurses
    - #4727	make openssl/gnutls mutually exclusive
    - libkey: light refactoring
    - lua: create liblua
  - Code
    - #4695	Replace some `TAILQ` uses with `ARRAY`
    - convert the ctype wrappers to use `bool`
    - global invert `OptNoCurses` to `OptGui`
    - key: collapse redirector functions
    - move `km_init()` earlier in startup
    - opcodes: add flags to `MenuFuncOp`
    - pass focused window to global functions
    - Use `buf_at()` to get a char from a `Buffer`
    - use `StringArray` everywhere


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.38.00-1
changelog:
  - Update to 6.38.00
  - Removed subpackages: root-proof, root-proof-bench, root-proof-player,
      root-proof-sessionviewer, root-sql-mysql, root-sql-odbc, root-sql-pgsql
  - New subpackages: root-geom-checker, root-gui-treemap,
      root-tree-ntuple-browse, root-histv7
  - JsMVA python (sub)module dropped from python3-root package
  - Compile minuit2 with Open MP support
  - Dropped patches: 7
  - New patches: 4


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.38.00-2
changelog:
  - Skip RPATH using -DCMAKE_SKIP_INSTALL_RPATH:BOOL=ON (replaces
    previously used root specific -Drpath:BOOL=OFF no longer available)
  - Backport fixes to python module
  - Rebuild for pythia8 8.3.16


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-30
changelog:
  - Don't segfault on missing priority tag (RHEL-35249)
  - Use unsigned integers for buildtime too for Y2K38 safety (RHEL-22602)
  - Rebuild against libimaevm.so.4 (RHEL-32505)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-31
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-22604)
  - Fix potential use of uninitialized pgp struct (RHEL-22605)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)
  - Add SourceLicense tag to spec syntax (RHEL-28798)
  - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-33
changelog:
  - Fix root relocation regression (RHEL-28967)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-35
changelog:
  - Fix %patch N applying Patch0 implicitly (RHEL-6294)
  - Issue deprecation warning for number-less %patch (RHEL-6294)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-37
changelog:
  - Allow parametric macros to opt out of option processing (RHEL-67161)
  - Report unsafe symlinks during installation as a specific case (RHEL-33393)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070)


author: Derek Weitzel <dweitzel@unl.edu> - 1.1.2-1
changelog:
  - Turn off CMAKE unity builds
  - Add a mutex around requesting public keys to stop overloading issuers


author: Derek Weitzel <dweitzel@unl.edu> - 1.2.0-1
changelog:
  - Fix segfault if the JSON parser cannot parse the JWKS
  - Fix float time claims issue and improve error handling
  - Fix security issue with malicious issuer handling in error messages
  - Improve JWTVerificationException message to include the invalid issuer
  - Update usage on verify command to make the TOKENFILE explicit
  - Read token for scitokens-verify from stdin
  - Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
  - Adding asan value to the job name
  - Turn off building unit tests by default.
  - Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the address sanitizer.  Also enable this in CI, so that tests fail if they hit a memory leak or other memory problem.
  - Fix memory leak in store_public_ec_key
  - Fix memory leaks in the unit tests
  - Fix memory leak in rs256_from_coords
  - Fix memory leak in scitokens_verify


