# changelog

author: Iryna Shcherbina <ishcherb@redhat.com> - 1.6.3-7
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Joe Orton <jorton@redhat.com> - 1.6.0-1
changelog:
  - update to 1.6.0 (#1460831)
  - move bdb support to loadable DSO in apr-util-dbd subpackage
  - drop NSS, freetds support


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1:4.8.23-3
changelog:
  - add python3 patch: port to python3
  - added python subpackage with s3+ and uc1541 extfs backend scrips to minimise
    base package dependencies
  - added python3-boto to python subpackage dependencies
  - use -Wno-strict-aliasing in CFLAGS is no longer needed
  - added spec.syntax patch: improve rpm spec files syntax colouring
  - added default_setup patch: enable by default lynx navigate with arrows keys
    and auto save setup


author: Jindrich Novy <jnovy@redhat.com> - 1:4.8.23-5
changelog:
  - just keep perl-interpreter BR because of man2hlp,
    it is a perl script required by build
  - require aspell-en, otherwise an annoying error prompt
    is displayed while editing any file


author: Jindrich Novy <jnovy@redhat.com> - 1:4.8.23-6
changelog:
  - re-add BR: perl-generators, it is required for generating
    rpm deps from the embedded VFS perl scriptlets


author: Jindrich Novy <jnovy@redhat.com> - 1:4.8.23-7
changelog:
  - disable aspell support until it is clear how to set up
    aspell dependencies or avoiding annoying error message
    when no dictionary is found every time a file is edited


author: Nginx Packaging <nginx-packaging@f5.com> - 1.26.1-2.codeit.el8.ngx
changelog:
  - Packages were updated to account for a change in CHANGES wording in
    1.26.1. No functional changes.


author: Nginx Packaging <nginx-packaging@f5.com> - 1.27.0-2.codeit.el8.ngx
changelog:
  - Packages were updated to account for a change in CHANGES wording in
    1.27.0. No functional changes.


author: Nginx Packaging <nginx-packaging@f5.com> - 1.30.1-1.codeit.el8.ngx
changelog:
  - 1.30.1-1
  - Security: Security: when using the "proxy_set_body" directive, an attacker
    might inject data in the proxied request to an HTTP/2 backend
    (CVE-2026-42926). Thanks to Mufeed VH of Winfunc Research.
  - Security: Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary code execution
    (CVE-2026-42945). Thanks to Leo Lin.
  - Security: Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker to
    cause a disclosure of worker process memory or segmentation fault in a
    worker process (CVE-2026-42946). Thanks to Leo Lin.
  - Security: Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding from UTF-8
    via the "charset_map" directive, allowing an attacker to cause a limited
    disclosure of worker proccess memory or segmentation fault in a worker
    process (CVE-2026-42934). Thanks to David Carlier.
  - Security: Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address before
    validation, allowing an attacker to cause address spoofing
    (CVE-2026-40460). Thanks to Rodrigo Laneth.
  - Security: Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an attacker to
    cause worker process memory corruption or segmentation fault in a worker
    process (CVE-2026-40701). Thanks to Leo Lin.
  - Bugfix: connections with HTTP/2 backends might not be cached when using
    the "proxy_set_body" or "proxy_pass_request_body" directives.
  - Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might be transferred
    incorrectly if the first line was not fully read.


author: Nginx Packaging <nginx-packaging@f5.com> - 1.30.2-1.codeit.el8.ngx
changelog:
  - 1.30.2-1
  - Security: a heap memory buffer overflow might occur in a worker process
    when using a configuration with overlapping captures in
    ngx_http_rewrite_module, potentially resulting in arbitrary code execution
    (CVE-2026-9256). Thanks to Mufeed VH of Winfunc Research.


author: Nginx Packaging <nginx-packaging@f5.com> - 1.31.0-1.codeit.el8.ngx
changelog:
  - 1.31.0-1
  - Security: Security: when using the "proxy_set_body" directive, an attacker
    might inject data in the proxied request to an HTTP/2 backend
    (CVE-2026-42926). Thanks to Mufeed VH of Winfunc Research.
  - Security: Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary code execution
    (CVE-2026-42945). Thanks to Leo Lin.
  - Security: Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker to
    cause a disclosure of worker process memory or segmentation fault in a
    worker process (CVE-2026-42946). Thanks to Leo Lin.
  - Security: Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding from UTF-8
    via the "charset_map" directive, allowing an attacker to cause a limited
    disclosure of worker proccess memory or segmentation fault in a worker
    process (CVE-2026-42934). Thanks to David Carlier.
  - Security: Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address before
    validation, allowing an attacker to cause address spoofing
    (CVE-2026-40460). Thanks to Rodrigo Laneth.
  - Security: Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an attacker to
    cause worker process memory corruption or segmentation fault in a worker
    process (CVE-2026-40701). Thanks to Leo Lin.


author: Nginx Packaging <nginx-packaging@f5.com> - 1.31.1-1.codeit.el8.ngx
changelog:
  - 1.31.1-1
  - Security: a heap memory buffer overflow might occur in a worker process
    when using a configuration with overlapping captures in
    ngx_http_rewrite_module, potentially resulting in arbitrary code execution
    (CVE-2026-9256). Thanks to Mufeed VH of Winfunc Research.


