<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="16">
<package pkgid="7fda04705f894ff786ed5080284465dc2e6c685f340c680675c13e018636f676" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="11.0.3" rel="150400.13.1"/>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1731931200">- Update to 10.3.8 (bsc#1233333)
  + Fix the package requirements for cloud-regionsrv-client
  + Follow changes to suseconnect error reporting from stdout to stderr</changelog>
  <changelog author="jesus.bv@suse.com" date="1733227200">- Update to 10.3.11 (bsc#1234050)
  + Send registration code for the extensions, not only base product</changelog>
  <changelog author="rjschwei@suse.com" date="1745928000">- Update version to 10.4.0
  + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
  + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
  + Support flexible licenses in GCE (jsc#PCT-531)
  + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
  + Handle cache inconsistencies (bsc#1218345)
  + Properly handle the zypper root target argument (bsc#1240997)</changelog>
  <changelog author="rjschwei@suse.com" date="1753272000">- Update version to 10.5.0
  + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)</changelog>
  <changelog author="rjschwei@suse.com" date="1753444800">- Update version to 10.5.1
  + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
  + Update scriptlet for package uninstall to avoid issues in the
    build service</changelog>
  <changelog author="rjschwei@suse.com" date="1755864000">- Update version to 10.5.2 (bsc#1247539)
  + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
  + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1758110400">- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188</changelog>
  <changelog author="rjschwei@suse.com" date="1773144000">- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices</changelog>
  <changelog author="rjschwei@suse.com" date="1774008000">- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.</changelog>
  <changelog author="rjschwei@suse.com" date="1774008001">- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work</changelog>
  <changelog author="jesus.bv@suse.com" date="1781006400">- Update to version 11.0.3
  + Write instance data cache file after
  cleaning the cache when the update server fails (bsc#1265930)
  + Create the cache directory when populating the cache (bsc#1267739)</changelog>
</package>
<package pkgid="e20ebfd446423998635bb9f70195630531e18a92b625d6f9f64159503e526d7d" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="11.0.3" rel="150400.13.1"/>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1731931200">- Update to 10.3.8 (bsc#1233333)
  + Fix the package requirements for cloud-regionsrv-client
  + Follow changes to suseconnect error reporting from stdout to stderr</changelog>
  <changelog author="jesus.bv@suse.com" date="1733227200">- Update to 10.3.11 (bsc#1234050)
  + Send registration code for the extensions, not only base product</changelog>
  <changelog author="rjschwei@suse.com" date="1745928000">- Update version to 10.4.0
  + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
  + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
  + Support flexible licenses in GCE (jsc#PCT-531)
  + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
  + Handle cache inconsistencies (bsc#1218345)
  + Properly handle the zypper root target argument (bsc#1240997)</changelog>
  <changelog author="rjschwei@suse.com" date="1753272000">- Update version to 10.5.0
  + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)</changelog>
  <changelog author="rjschwei@suse.com" date="1753444800">- Update version to 10.5.1
  + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
  + Update scriptlet for package uninstall to avoid issues in the
    build service</changelog>
  <changelog author="rjschwei@suse.com" date="1755864000">- Update version to 10.5.2 (bsc#1247539)
  + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
  + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1758110400">- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188</changelog>
  <changelog author="rjschwei@suse.com" date="1773144000">- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices</changelog>
  <changelog author="rjschwei@suse.com" date="1774008000">- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.</changelog>
  <changelog author="rjschwei@suse.com" date="1774008001">- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work</changelog>
  <changelog author="jesus.bv@suse.com" date="1781006400">- Update to version 11.0.3
  + Write instance data cache file after
  cleaning the cache when the update server fails (bsc#1265930)
  + Create the cache directory when populating the cache (bsc#1267739)</changelog>
</package>
<package pkgid="60c30b87002e520b1334d09fbf80b9db64e8c765aae144ec342ffdcd503cda9f" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150400.13.1"/>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1731931200">- Update to 10.3.8 (bsc#1233333)
  + Fix the package requirements for cloud-regionsrv-client
  + Follow changes to suseconnect error reporting from stdout to stderr</changelog>
  <changelog author="jesus.bv@suse.com" date="1733227200">- Update to 10.3.11 (bsc#1234050)
  + Send registration code for the extensions, not only base product</changelog>
  <changelog author="rjschwei@suse.com" date="1745928000">- Update version to 10.4.0
  + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
  + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
  + Support flexible licenses in GCE (jsc#PCT-531)
  + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
  + Handle cache inconsistencies (bsc#1218345)
  + Properly handle the zypper root target argument (bsc#1240997)</changelog>
  <changelog author="rjschwei@suse.com" date="1753272000">- Update version to 10.5.0
  + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)</changelog>
  <changelog author="rjschwei@suse.com" date="1753444800">- Update version to 10.5.1
  + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
  + Update scriptlet for package uninstall to avoid issues in the
    build service</changelog>
  <changelog author="rjschwei@suse.com" date="1755864000">- Update version to 10.5.2 (bsc#1247539)
  + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
  + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1758110400">- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188</changelog>
  <changelog author="rjschwei@suse.com" date="1773144000">- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices</changelog>
  <changelog author="rjschwei@suse.com" date="1774008000">- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.</changelog>
  <changelog author="rjschwei@suse.com" date="1774008001">- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work</changelog>
  <changelog author="jesus.bv@suse.com" date="1781006400">- Update to version 11.0.3
  + Write instance data cache file after
  cleaning the cache when the update server fails (bsc#1265930)
  + Create the cache directory when populating the cache (bsc#1267739)</changelog>
</package>
<package pkgid="5d4ceaa510b11c91bdcca37a84a08a7d79e22cbaf7904d737f343c8bf66600ba" name="cloud-regionsrv-client-license-watcher" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150400.13.1"/>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1731931200">- Update to 10.3.8 (bsc#1233333)
  + Fix the package requirements for cloud-regionsrv-client
  + Follow changes to suseconnect error reporting from stdout to stderr</changelog>
  <changelog author="jesus.bv@suse.com" date="1733227200">- Update to 10.3.11 (bsc#1234050)
  + Send registration code for the extensions, not only base product</changelog>
  <changelog author="rjschwei@suse.com" date="1745928000">- Update version to 10.4.0
  + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
  + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
  + Support flexible licenses in GCE (jsc#PCT-531)
  + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
  + Handle cache inconsistencies (bsc#1218345)
  + Properly handle the zypper root target argument (bsc#1240997)</changelog>
  <changelog author="rjschwei@suse.com" date="1753272000">- Update version to 10.5.0
  + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)</changelog>
  <changelog author="rjschwei@suse.com" date="1753444800">- Update version to 10.5.1
  + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
  + Update scriptlet for package uninstall to avoid issues in the
    build service</changelog>
  <changelog author="rjschwei@suse.com" date="1755864000">- Update version to 10.5.2 (bsc#1247539)
  + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
  + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1758110400">- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188</changelog>
  <changelog author="rjschwei@suse.com" date="1773144000">- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices</changelog>
  <changelog author="rjschwei@suse.com" date="1774008000">- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.</changelog>
  <changelog author="rjschwei@suse.com" date="1774008001">- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work</changelog>
  <changelog author="jesus.bv@suse.com" date="1781006400">- Update to version 11.0.3
  + Write instance data cache file after
  cleaning the cache when the update server fails (bsc#1265930)
  + Create the cache directory when populating the cache (bsc#1267739)</changelog>
</package>
<package pkgid="a8a6a991dc9b466e3081622637ab70d79daf21b8124e27fb5894bd288fbbdd27" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="3.0.0" rel="150400.13.1"/>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1731931200">- Update to 10.3.8 (bsc#1233333)
  + Fix the package requirements for cloud-regionsrv-client
  + Follow changes to suseconnect error reporting from stdout to stderr</changelog>
  <changelog author="jesus.bv@suse.com" date="1733227200">- Update to 10.3.11 (bsc#1234050)
  + Send registration code for the extensions, not only base product</changelog>
  <changelog author="rjschwei@suse.com" date="1745928000">- Update version to 10.4.0
  + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
  + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
  + Support flexible licenses in GCE (jsc#PCT-531)
  + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
  + Handle cache inconsistencies (bsc#1218345)
  + Properly handle the zypper root target argument (bsc#1240997)</changelog>
  <changelog author="rjschwei@suse.com" date="1753272000">- Update version to 10.5.0
  + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)</changelog>
  <changelog author="rjschwei@suse.com" date="1753444800">- Update version to 10.5.1
  + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
  + Update scriptlet for package uninstall to avoid issues in the
    build service</changelog>
  <changelog author="rjschwei@suse.com" date="1755864000">- Update version to 10.5.2 (bsc#1247539)
  + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
  + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1758110400">- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188</changelog>
  <changelog author="rjschwei@suse.com" date="1773144000">- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices</changelog>
  <changelog author="rjschwei@suse.com" date="1774008000">- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.</changelog>
  <changelog author="rjschwei@suse.com" date="1774008001">- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work</changelog>
  <changelog author="jesus.bv@suse.com" date="1781006400">- Update to version 11.0.3
  + Write instance data cache file after
  cleaning the cache when the update server fails (bsc#1265930)
  + Create the cache directory when populating the cache (bsc#1267739)</changelog>
</package>
<package pkgid="6ae0bc843e96c0e1533865fdd6dd0b9fcf2fc7cbfa987b6244adc0f2e578e3d8" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150400.13.1"/>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1731931200">- Update to 10.3.8 (bsc#1233333)
  + Fix the package requirements for cloud-regionsrv-client
  + Follow changes to suseconnect error reporting from stdout to stderr</changelog>
  <changelog author="jesus.bv@suse.com" date="1733227200">- Update to 10.3.11 (bsc#1234050)
  + Send registration code for the extensions, not only base product</changelog>
  <changelog author="rjschwei@suse.com" date="1745928000">- Update version to 10.4.0
  + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
  + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
  + Support flexible licenses in GCE (jsc#PCT-531)
  + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
  + Handle cache inconsistencies (bsc#1218345)
  + Properly handle the zypper root target argument (bsc#1240997)</changelog>
  <changelog author="rjschwei@suse.com" date="1753272000">- Update version to 10.5.0
  + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)</changelog>
  <changelog author="rjschwei@suse.com" date="1753444800">- Update version to 10.5.1
  + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
  + Update scriptlet for package uninstall to avoid issues in the
    build service</changelog>
  <changelog author="rjschwei@suse.com" date="1755864000">- Update version to 10.5.2 (bsc#1247539)
  + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
  + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1758110400">- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188</changelog>
  <changelog author="rjschwei@suse.com" date="1773144000">- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices</changelog>
  <changelog author="rjschwei@suse.com" date="1774008000">- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.</changelog>
  <changelog author="rjschwei@suse.com" date="1774008001">- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work</changelog>
  <changelog author="jesus.bv@suse.com" date="1781006400">- Update to version 11.0.3
  + Write instance data cache file after
  cleaning the cache when the update server fails (bsc#1265930)
  + Create the cache directory when populating the cache (bsc#1267739)</changelog>
</package>
<package pkgid="a21c0c45efd90825f10f05d6fc2334b9b171a478d68efa1269c50b52ec7a3cc0" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150400.13.1"/>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1731931200">- Update to 10.3.8 (bsc#1233333)
  + Fix the package requirements for cloud-regionsrv-client
  + Follow changes to suseconnect error reporting from stdout to stderr</changelog>
  <changelog author="jesus.bv@suse.com" date="1733227200">- Update to 10.3.11 (bsc#1234050)
  + Send registration code for the extensions, not only base product</changelog>
  <changelog author="rjschwei@suse.com" date="1745928000">- Update version to 10.4.0
  + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
  + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
  + Support flexible licenses in GCE (jsc#PCT-531)
  + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
  + Handle cache inconsistencies (bsc#1218345)
  + Properly handle the zypper root target argument (bsc#1240997)</changelog>
  <changelog author="rjschwei@suse.com" date="1753272000">- Update version to 10.5.0
  + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)</changelog>
  <changelog author="rjschwei@suse.com" date="1753444800">- Update version to 10.5.1
  + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
  + Update scriptlet for package uninstall to avoid issues in the
    build service</changelog>
  <changelog author="rjschwei@suse.com" date="1755864000">- Update version to 10.5.2 (bsc#1247539)
  + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
  + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1758110400">- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188</changelog>
  <changelog author="rjschwei@suse.com" date="1773144000">- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices</changelog>
  <changelog author="rjschwei@suse.com" date="1774008000">- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.</changelog>
  <changelog author="rjschwei@suse.com" date="1774008001">- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work</changelog>
  <changelog author="jesus.bv@suse.com" date="1781006400">- Update to version 11.0.3
  + Write instance data cache file after
  cleaning the cache when the update server fails (bsc#1265930)
  + Create the cache directory when populating the cache (bsc#1267739)</changelog>
</package>
<package pkgid="f8c2eb4cc19cd770d71d0127885c830cac4367ab3dec8e01bf34f3ffa19e059a" name="expat" arch="src">
  <version epoch="0" ver="2.7.1" rel="150400.3.14.1"/>
  <changelog author="david.anes@suse.com" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="david.anes@suse.com" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="david.anes@suse.com" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="martin.schreiner@suse.com" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="david.anes@suse.com" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="51937d7d300c5133192b6517021cab452b23a4dc07a3d12e6cdad8d6e0b928a8" name="expat" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.3.14.1"/>
  <changelog author="david.anes@suse.com" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="david.anes@suse.com" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="david.anes@suse.com" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="martin.schreiner@suse.com" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="david.anes@suse.com" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="03536d6788e141007d2bc49ccb7904cdc61112ee81b5dcb8df92018b2bb5f368" name="expat-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.3.14.1"/>
  <changelog author="david.anes@suse.com" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="david.anes@suse.com" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="david.anes@suse.com" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="martin.schreiner@suse.com" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="david.anes@suse.com" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="daf5969fe4f311f8c22d2834eb543e55bacba97e00c138386d8ebf2ac42705b8" name="expat-debugsource" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.3.14.1"/>
  <changelog author="david.anes@suse.com" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="david.anes@suse.com" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="david.anes@suse.com" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="martin.schreiner@suse.com" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="david.anes@suse.com" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="fc0daf75bce551167dcf585a398430d97b9db0a7b8a29eefd761e4c3be35691e" name="libexpat-devel" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.3.14.1"/>
  <changelog author="david.anes@suse.com" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="david.anes@suse.com" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="david.anes@suse.com" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="martin.schreiner@suse.com" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="david.anes@suse.com" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="c513f77a594750da633de6a9056cba1eda3316a1be4b684e39048481283b133e" name="libexpat1" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.3.14.1"/>
  <changelog author="david.anes@suse.com" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="david.anes@suse.com" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="david.anes@suse.com" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="martin.schreiner@suse.com" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="david.anes@suse.com" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="77b588b9cf1ed0bb7cee6bda7880fc8daeb890c3d93e26f72e88131f7472a717" name="libexpat1-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.3.14.1"/>
  <changelog author="david.anes@suse.com" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="david.anes@suse.com" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="david.anes@suse.com" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="david.anes@suse.com" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="martin.schreiner@suse.com" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="david.anes@suse.com" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="36aee322f1f75cf6bbfb1b1166e0208206fae7514b11e6434937645b21c0f823" name="python-instance-billing-flavor-check" arch="src">
  <version epoch="0" ver="1.0.1" rel="150400.1.36.1"/>
  <changelog author="jesus.bv@suse.com" date="1689595200">- Add reference
  Include PAYG checker package in SLE (jsc#PED-4791)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689854400">- Version 0.0.3
  Handle exception for Python 3.4</changelog>
  <changelog author="jesus.bv@suse.com" date="1700049600">- Version 0.0.4
  Run the command as sudo only (bsc#1217696, bsc#1217695)</changelog>
  <changelog author="jesus.bv@suse.com" date="1705579200">- Version 0.0.5
  Add IPv6 support (bsc#1218739)</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Version 0.0.6 (bsc#1218561)
  Support proxy setup on the client to access the update infrastructure
  API</changelog>
  <changelog author="rjschwei@suse.com" date="1737460800">- Version 0.1.1 (bsc#1235991, bsc#1235992)
  + Add time stamp to log
- From version 0.1.0
  + Doc improvements clarifying exit staus codes</changelog>
  <changelog author="rjschwei@suse.com" date="1738324800">- Version 0.1.2 (bsc#1234444)
  + Improve detection of IPv4 and IPv6 network setup and use appropriate
    IP version for access the update servers
  + Improve reliability of flavor detection. Try an update server multiple
    times to get an answer, if we hit timeouts return the value flavor
    value from a cache file.</changelog>
  <changelog author="rjschwei@suse.com" date="1740225600">- Update to version 1.0.0 (jsc#PCT-531)
  + API incompatibility: The check_payg_byos function no longer exits, it now
    returns a tuple of (flavor, exit_code). This makes the function reusable.
  + Update the build setup to work with the system interpreter of
    upcoming SLE releases. SLE 12 stays with the Python 3.4 interpreter
    and SLE 15 with the Python 3.6 interpreter.</changelog>
  <changelog author="jesus.bv@suse.com" date="1748001600">- Update to version 1.0.1
  + Fix infinite loop (bsc#1242064)
  + Fix bug in update infrastructure request (bsc#1242064)</changelog>
  <changelog author="gustavo.basso@suse.com" date="1778155200">- Override %pythons=python311 on SP7+ to match cloud-regionsrv-client base ABI; drop once upstream gates %pythons itself.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780315200">- Override %primary_python (not %pythons) on SP7+ so upstream's %define pythons %{primary_python} resolves to python311.
  Previous %pythons topadd was silently clobbered by upstream's later re-bind. Retire when SUSE makes python311-rpm-macros default in
  SLE 15-SP7 base, or when the upstream satellite spec explicitly BRs the python311 flavor.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780315201">- Pin %pythons=python311 on SP7+ via surgical patch. &lt;topadd&gt;%define %primary_python was empirically ineffective at OBS BR-resolution time (verified: bdeps remained python3-*); patching the spec content directly lets the scheduler see %pythons=python311 and resolve %{pythons}-* BRs to python311-* deps. Retire when SUSE sets %primary_python in the SLE 15-SP7 base prjconf, or when upstream stops indirecting via %{primary_python} on &gt;=1600.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780315202">- Fix pin-pythons-python311-sp7.patch: proper unified diff (line numbers + single-space context). Previous bare-@@ form broke server-side link expansion across all 5 lanes.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401600">- Pin %pythons=python311 on SP7 via sle_version. Rev 5 patched the &gt;=1600 suse_version arm, but on SLE 15 %suse_version=1500 (service packs are encoded in %sle_version, not %suse_version), so that arm is dead code. New gate %if 0%{?sle_version} &gt;= 150700 &amp;&amp; 0%{?sle_version} &lt; 160000 overrides %pythons last, so all %{pythons}-foo BRs resolve to python311-* on SP7.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401601">- Fix SP7 %build/%install/%files for python311. After rev 6 pinned %pythons=python311 the SP7 buildroot has /usr/bin/python3.11 and no /usr/bin/python3, so the spec's literal 'python3 setup.py build/install' fails (cannot add python3-base BR -- that pulls python3.6 and would silently rebuild at 3.6 defeating the override). Add %py3_exe macro routing build/install through python3.11 on SP7 and python3 elsewhere. Also switch %files from %{python_sitelib} (computed via %python_flavor = the system default = python3 -&gt; /usr/lib/python3.6/...) to %{_sitelibdir} (defined by this spec as %{%{pythons}_sitelib} -&gt; /usr/lib/python3.11/... on SP7) so payload location matches the file manifest. Escape %suse_version -&gt; %%suse_version in the override comment to silence RPM 'Macro expanded in comment' warning. Sources: python-rpm-macros/macros/010-common-defs lines 6, 49.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401602">- Workaround SP7 libexpat ABI mismatch via explicit BR. python311-3.11.15-150600.3.53.1 (SUSE maintenance rebuild) references libexpat symbol XML_SetAllocTrackerActivationThreshold (introduced in libexpat 2.7.2, CVE-2025-59375 fix, 2025-09-16). SP7 GA ships libexpat 2.6.4-150700.1.4 which lacks the symbol -&gt; runtime ImportError during python3.11 setup.py install. SP6's libexpat is 2.4.4-150400.3.17.1 (even older), so the plan's original Prefer:SP6 recipe doesn't help. Force OBS to resolve a libexpat 2.7.2+ from whichever Maintenance repo SUSE built python311 against. Long-term fix: bugzilla.suse.com for coordinated SP7 libexpat backport.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401603">- Widen python311 pin from SP7-only to SLE 15 SP4-SP7 to match base package ABI on SP4/SP5/SP6 (SP7 unchanged).</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401604">- Actually apply the SP7 -&gt; SP4+ gate widen (previous .changes entry described the change but the sed was skipped); comment out the SP7-only libexpat BR so SP4-SP6 don't inherit the SP7 unresolvable resolver state.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780488000">- Bootstrap: sync _link and pin-pythons-python311-sp4plus.patch from tracked sources</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780488001">- SP7: un-comment libexpat1 &gt;= 2.7.1 BR (provider is locally-branched libexpat from openSUSE:Factory)</changelog>
</package>
<package pkgid="66a025f8b7da7c791373cf6fe64afa6a7f5622fc44fb6ba0564eae221938ae2d" name="python-instance-billing-flavor-check" arch="x86_64">
  <version epoch="0" ver="1.0.1" rel="150400.1.36.1"/>
  <changelog author="jesus.bv@suse.com" date="1689595200">- Add reference
  Include PAYG checker package in SLE (jsc#PED-4791)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689854400">- Version 0.0.3
  Handle exception for Python 3.4</changelog>
  <changelog author="jesus.bv@suse.com" date="1700049600">- Version 0.0.4
  Run the command as sudo only (bsc#1217696, bsc#1217695)</changelog>
  <changelog author="jesus.bv@suse.com" date="1705579200">- Version 0.0.5
  Add IPv6 support (bsc#1218739)</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Version 0.0.6 (bsc#1218561)
  Support proxy setup on the client to access the update infrastructure
  API</changelog>
  <changelog author="rjschwei@suse.com" date="1737460800">- Version 0.1.1 (bsc#1235991, bsc#1235992)
  + Add time stamp to log
- From version 0.1.0
  + Doc improvements clarifying exit staus codes</changelog>
  <changelog author="rjschwei@suse.com" date="1738324800">- Version 0.1.2 (bsc#1234444)
  + Improve detection of IPv4 and IPv6 network setup and use appropriate
    IP version for access the update servers
  + Improve reliability of flavor detection. Try an update server multiple
    times to get an answer, if we hit timeouts return the value flavor
    value from a cache file.</changelog>
  <changelog author="rjschwei@suse.com" date="1740225600">- Update to version 1.0.0 (jsc#PCT-531)
  + API incompatibility: The check_payg_byos function no longer exits, it now
    returns a tuple of (flavor, exit_code). This makes the function reusable.
  + Update the build setup to work with the system interpreter of
    upcoming SLE releases. SLE 12 stays with the Python 3.4 interpreter
    and SLE 15 with the Python 3.6 interpreter.</changelog>
  <changelog author="jesus.bv@suse.com" date="1748001600">- Update to version 1.0.1
  + Fix infinite loop (bsc#1242064)
  + Fix bug in update infrastructure request (bsc#1242064)</changelog>
  <changelog author="gustavo.basso@suse.com" date="1778155200">- Override %pythons=python311 on SP7+ to match cloud-regionsrv-client base ABI; drop once upstream gates %pythons itself.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780315200">- Override %primary_python (not %pythons) on SP7+ so upstream's %define pythons %{primary_python} resolves to python311.
  Previous %pythons topadd was silently clobbered by upstream's later re-bind. Retire when SUSE makes python311-rpm-macros default in
  SLE 15-SP7 base, or when the upstream satellite spec explicitly BRs the python311 flavor.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780315201">- Pin %pythons=python311 on SP7+ via surgical patch. &lt;topadd&gt;%define %primary_python was empirically ineffective at OBS BR-resolution time (verified: bdeps remained python3-*); patching the spec content directly lets the scheduler see %pythons=python311 and resolve %{pythons}-* BRs to python311-* deps. Retire when SUSE sets %primary_python in the SLE 15-SP7 base prjconf, or when upstream stops indirecting via %{primary_python} on &gt;=1600.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780315202">- Fix pin-pythons-python311-sp7.patch: proper unified diff (line numbers + single-space context). Previous bare-@@ form broke server-side link expansion across all 5 lanes.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401600">- Pin %pythons=python311 on SP7 via sle_version. Rev 5 patched the &gt;=1600 suse_version arm, but on SLE 15 %suse_version=1500 (service packs are encoded in %sle_version, not %suse_version), so that arm is dead code. New gate %if 0%{?sle_version} &gt;= 150700 &amp;&amp; 0%{?sle_version} &lt; 160000 overrides %pythons last, so all %{pythons}-foo BRs resolve to python311-* on SP7.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401601">- Fix SP7 %build/%install/%files for python311. After rev 6 pinned %pythons=python311 the SP7 buildroot has /usr/bin/python3.11 and no /usr/bin/python3, so the spec's literal 'python3 setup.py build/install' fails (cannot add python3-base BR -- that pulls python3.6 and would silently rebuild at 3.6 defeating the override). Add %py3_exe macro routing build/install through python3.11 on SP7 and python3 elsewhere. Also switch %files from %{python_sitelib} (computed via %python_flavor = the system default = python3 -&gt; /usr/lib/python3.6/...) to %{_sitelibdir} (defined by this spec as %{%{pythons}_sitelib} -&gt; /usr/lib/python3.11/... on SP7) so payload location matches the file manifest. Escape %suse_version -&gt; %%suse_version in the override comment to silence RPM 'Macro expanded in comment' warning. Sources: python-rpm-macros/macros/010-common-defs lines 6, 49.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401602">- Workaround SP7 libexpat ABI mismatch via explicit BR. python311-3.11.15-150600.3.53.1 (SUSE maintenance rebuild) references libexpat symbol XML_SetAllocTrackerActivationThreshold (introduced in libexpat 2.7.2, CVE-2025-59375 fix, 2025-09-16). SP7 GA ships libexpat 2.6.4-150700.1.4 which lacks the symbol -&gt; runtime ImportError during python3.11 setup.py install. SP6's libexpat is 2.4.4-150400.3.17.1 (even older), so the plan's original Prefer:SP6 recipe doesn't help. Force OBS to resolve a libexpat 2.7.2+ from whichever Maintenance repo SUSE built python311 against. Long-term fix: bugzilla.suse.com for coordinated SP7 libexpat backport.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401603">- Widen python311 pin from SP7-only to SLE 15 SP4-SP7 to match base package ABI on SP4/SP5/SP6 (SP7 unchanged).</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780401604">- Actually apply the SP7 -&gt; SP4+ gate widen (previous .changes entry described the change but the sed was skipped); comment out the SP7-only libexpat BR so SP4-SP6 don't inherit the SP7 unresolvable resolver state.</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780488000">- Bootstrap: sync _link and pin-pythons-python311-sp4plus.patch from tracked sources</changelog>
  <changelog author="gustavo.basso@suse.com" date="1780488001">- SP7: un-comment libexpat1 &gt;= 2.7.1 BR (provider is locally-branched libexpat from openSUSE:Factory)</changelog>
</package>
</otherdata>