# changelog

author: Than Ngo <than@redhat.com> - 142.0.7444.175-4
changelog:
  - Enable system libcxx
  - Fix link error when building with system libcxx
  - Apply memory-allocator-dcheck-assert-fix for aarch64


author: Than Ngo <than@redhat.com> - 143.0.7499.40-1
changelog:
  - Update to 143.0.7499.40
    * High CVE-2025-13630: Type Confusion in V8
    * High CVE-2025-13631: Inappropriate implementation in Google Updater
    * High CVE-2025-13632: Inappropriate implementation in DevTools
    * High CVE-2025-13633: Use after free in Digital Credentials
    * Medium CVE-2025-13634: Inappropriate implementation in Downloads
    * Medium CVE-2025-13720: Bad cast in Loader
    * Medium CVE-2025-13721: Race in v8
    * Low CVE-2025-13635: Inappropriate implementation in Downloads
    * Low CVE-2025-13636: Inappropriate implementation in Split View
    * Low CVE-2025-13637: Inappropriate implementation in Downloads
    * Low CVE-2025-13638: Use after free in Media Stream
    * Low CVE-2025-13639: Inappropriate implementation in WebRTC
    * Low CVE-2025-13640: Inappropriate implementation in Passwords


author: Than Ngo <than@redhat.com> - 143.0.7499.109-1
changelog:
  - Update to 143.0.7499.109
    * High: Under coordination
    * Medium CVE-2025-14372: Use after free in Password Manager
    * Medium CVE-2025-14373: Inappropriate implementation in Toolbar
  - Workaround problem of auto dark mode inverting images and making them unreadable


author: Than Ngo <than@redhat.com> - 143.0.7499.146-1
changelog:
  - Update to 143.0.7499.146
    * High CVE-2025-14765: Use after free in WebGPU
    * High CVE-2025-14766: Out of bounds read and write in V8
  - Force dark mode when auto dark mode web content is on
  - Remove omnibox-next-Improve-cutout-mouse-handling-for-Wayla patch, as it's merged


author: Than Ngo <than@redhat.com> - 143.0.7499.192-1
changelog:
  - Update to 143.0.7499.192
    * High CVE-2026-0628: Insufficient policy enforcement in WebView tag
  - Fix rhbz#2425338, Enable control flow integrity support for x86_64/aarch64
  - Enable build for epel10.1


author: Than Ngo <than@redhat.com> - 144.0.7559.59-1
changelog:
  - Update to 144.0.7559.59
    * CVE-2026-0899: Out of bounds memory access in V8
    * CVE-2026-0900: Inappropriate implementation in V8
    * CVE-2026-0901: Inappropriate implementation in Blink
    * CVE-2026-0902: Inappropriate implementation in V8
    * CVE-2026-0903: Insufficient validation of untrusted input in Downloads
    * CVE-2026-0904: Incorrect security UI in Digital Credentials
    * CVE-2026-0905: Insufficient policy enforcement in Network
    * CVE-2026-0906: Incorrect security UI
    * CVE-2026-0907: Incorrect security UI in Split View
    * CVE-2026-0908: Use after free in ANGLE


author: Robert Scheck <robert@fedoraproject.org> - 4.7.0-1
changelog:
  - Upgrade to 4.7.0 (#2369521)
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371578, thanks to Marcos Mello)


author: Robert Scheck <robert@fedoraproject.org> 13.0.2-4
changelog:
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371331, thanks to Marcos Mello)
  - Do not use removed /etc/pki/tls/certs/ca-bundle.crt bundle file
    for Fedora 42 >= and RHEL >= 11


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 1.68.2-1
changelog:
  - Update to 1.68.2 - Closes rhbz#2311287 rhbz#2326578 rhbz#2333262
    rhbz#2333238 rhbz#2331989 rhbz#2331961


author: Robert-André Mauchin <zebob.m@gmail.com> - 1.68.2-2
changelog:
  - Update to 1.68.2
  - Move to bundling with gotmax23 tool
  - Bump golang.org/x/net/html to v0.33.0 to fix CVE-2024-45338
  - Bump golang.org/x/crypto/ssh to v0.31.0 to fix CVE-2024-45337
  - Bump github.com/quic-go/quic-go to 0.48.2 to fix CVE-2024-53259 and
    CVE-2024-22189
  - s390x is temporarly disable until a workaround to
    https://github.com/cronokirby/saferith/issues/52 is found


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 1.70.2-1
changelog:
  - Update to 1.70.2 - Closes rhbz#2254045 rhbz#2336979 rhbz#2337234
    rhbz#2341265 rhbz#2348838 rhbz#2350844 rhbz#2352327 rhbz#2354433
    rhbz#2360615 rhbz#2360653


author: Derek Weitzel <dweitzel@unl.edu> - 1.1.2-1
changelog:
  - Turn off CMAKE unity builds
  - Add a mutex around requesting public keys to stop overloading issuers


author: Derek Weitzel <dweitzel@unl.edu> - 1.2.0-1
changelog:
  - Fix segfault if the JSON parser cannot parse the JWKS
  - Fix float time claims issue and improve error handling
  - Fix security issue with malicious issuer handling in error messages
  - Improve JWTVerificationException message to include the invalid issuer
  - Update usage on verify command to make the TOKENFILE explicit
  - Read token for scitokens-verify from stdin
  - Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
  - Adding asan value to the job name
  - Turn off building unit tests by default.
  - Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the address sanitizer.  Also enable this in CI, so that tests fail if they hit a memory leak or other memory problem.
  - Fix memory leak in store_public_ec_key
  - Fix memory leaks in the unit tests
  - Fix memory leak in rs256_from_coords
  - Fix memory leak in scitokens_verify


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.6.0-2
changelog:
  - Correct naming of helper library libXrdPelicanHttpCore (not a plugin)
  - Fix parallel running of Posc tests


