# changelog

author: Dave Dykstra <dwd@cern.ch> - 1.4.0
changelog:
  - Update to upstream 1.4.0
  - Change Recommends: fakeroot back to Requires: fakeroot on epel10
    now that fakeroot is available there.


author: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 3.9.0-3
changelog:
  - Fix security vulnerabilities
    CVE-2026-32877,CVE-2026-32883,CVE-2026-32884,CVE-2026-34580,CVE-2026-
    34582 (rhbz#2453751,rhbz#2453757,rhbz#2453763)


author: Jiri Kyjovsky <j1.kyjovsky@gmail.com> 2.4-1
changelog:
  - Fix copr-cli download for Pulp projects
  - Add API endpoint for generating a new token
  - Add wildcard support for 'Packit allowed forge projects'


author: Jakub Kadlcik <frostyx@email.cz> 2.5-1
changelog:
  - Fix download-build for manual createrepo Pulp projects
  - Make sure new-api-token updates expiration token
  - Don't traceback new-api-token for default config
  - Fix download-build from PULP with --rpms
  - Fix script-repos not being saved at all for custom pkgs
  - Use a URL that would be available before the Pulp migration
  - Use build_proxy.get_built_packages to figure out package NEVRAs
  - Bypass anubis challenge by setting copr user agent
  - Use Tito to generate component.__version__
  - Colorize build statuses


author: Carl George <carlwgeorge@fedoraproject.org> - 2.1.2-1
changelog:
  - Update to version 2.1.2 rhbz#2457076
  - Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160


author: Mattia Verga <mattia.verga@proton.me> - 2.1.7-1
changelog:
  - Update to 2.1.7 (Fedora#2419094)
  - Switch to use system's hidapi libs
  - QT client now built on QT6


author: Packit <hello@packit.dev> - 1.15.1-1
changelog:
  - We have fixed a bug that prevented running `sync_release()` on a `PackitAPI` instance initialized with `non_git_upstream=True` repeatedly due to an improper clean-up. (#2691)


author: Packit <hello@packit.dev> - 1.15.2-1
changelog:
  - Packit now uses the specfile library's sanitization when parsing spec files.
  - Resolves: rhbz#2450841


author: Packit <hello@packit.dev> - 1.15.3-1
changelog:
  - We've fixed the formatting of the strings Packit appends to the changelog. Now there will be at most one blank line before or after the Packit comment. (#2707)
  - Resolves: rhbz#2453842


author: Packit <hello@packit.dev> - 1.16.0-1
changelog:
  - Packit CLI has a new option `--[no-]update-release` that, by default, follows the value of the option set in the config, and also allows you to override manually, if necessary. (#2713)
  - In addition to `version_update_mask`, users can now use a new `version_update_specifiers` configuration option to control the upstream versions allowed to be release-synced. The option accepts [PEP440 version specifier sets](https://packaging.pypa.io/en/stable/specifiers.html), for example `version_update_specifiers: >=1.0,~=1.0`. (#2710)
  - Resolves: rhbz#2461103


author: Paul Howarth <paul@city-fan.org> - 1.28-1
changelog:
  - Update to 1.28
    - Bug fix: undef values in hashes were treated incorrectly: need to check
      for existence, not definedness before comparing (GH#21)
  - Use SPDX-format license tag
  - Use %license unconditionally
  - Drop NOTES and README files as they provide nothing useful to users


author: Paul Howarth <paul@city-fan.org> - 1.6300-1
changelog:
  - Update to 1.63
    - Fixed TesouroDireto.pm - using different source URL (GH#424)
    - Added FinanceAPI.pm - requires API key from https://financeapi.net/
      - US and other exchange data available
    - Fixed BVB.pm (GH#409)
    - Fixed BSEIndia.pm (GH#410); removed Unzip as quotes file is now a CSV file
    - Fixed NSEIndia.pm (GH#410)
    - Fixed NZX.pm (GH#401)


author: Paul Howarth <paul@city-fan.org> - 1.6400-1
changelog:
  - Update to 1.64
    - Update AlphaVantage.pm (GH#447)
    - Fix to Stooq.pm (GH#445)
    - Updated ASX.pm (GH#404)
    - Added more fields to CSE.pm and exposed all labels
    - Changed parsing in Comdirect.pm (GH#413)
    - Complete rewrite of OnVista.pm (GH#414)
    - Minor fix to FinanceAPI decoding JSON (GH#434)
    - Modified YahooJSON to deal with "nan" as dividend yield in JSON
    - New CurrencyRates module, CurrencyRates/FinanceAPI (GH#427)
    - Fixed Bourso.pm (GH#417)
    - Allowed Currency Rates modules Fixer.pm and OpenExchange.pm to read their
      API keys from environment variables (GH#426)
    - Removed references to IEXCloud (IEX ended support for all products at the
      end of August 2024)
  - Switch source URL from cpan.metacpan.org to www.cpan.org
  - Add build conditional for author tests, disabled by default


author: Paul Howarth <paul@city-fan.org> - 1.6500-1
changelog:
  - Update to 1.65
    - Added EXCHANGE feature to Sinvestor.pm and some fixes (GH#481)
    - Added EXCHANGE feature to OnVista.pm (GH#480)
    - Added EXCHANGE feature to Consorsbank.pm and some fixes (GH#479)
    - Enabled usage count in Quote.pm
    - Removed DWS.pm
    - Improved check that dividend yield is a number in YahooJSON.pm by adding
      regex anchors
    - Added ssl_opts to user agent in Union.pm to account for bad certificate
      chain (GH#482)
    - Added ETFs search, more labels and EXCHANGE feature to Comdirect.pm (GH#478)
    - GoogleWeb: Add support for Hong Kong Exchange (GH#476)
    - YahooJSON: Adjust other currency fields when data is returned in GBp, ZAc,
      or ILA
    - Added labels wkn, ìsin, close, ask, bid, p_change, time to OnVista.pm
    - Modified OnVista.pm to enable search by ISIN and WKN and search for ETFs
    - Added methodinfo hash to Tradegate.pm (GH#465)
    - Added labels isin, open, ask, bid, time to Tradegate.pm (GH#465)
    - Fixed Tradegate.pm - Search for ETFs (GH#465)
    - Removed MorningstarAU (GH#405)
    - Fixed malformed character in YahooWeb.pm (GH#468)
    - Changed useragent in YahooJSON.pm (GH#467)
    - Added methodinfo hash to AEX.pm (GH#466)
    - Added labels exchange, close, time to AEX.pm (GH#466)
    - Fixed XETRA.pm (GH#460)
    - Added methodinfo hash to Fool.pm
    - Fixed MorningstarJP.pm (GH#443, GH#451)
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1.6600-1
changelog:
  - Update to 1.66
    - Modified CurrencyRates/CurrencyFreaks.pm to return from and to values
      instead of calculated rate
    - Removed Bloomberg.pm, Tiaacref.pm, Troweprice.pm
    - AlphaVantage: Return 'symbol not found' when no price data is returned
    - ASX: Changed error message when symbol isn't found (GH#497)
    - Added a new module to fetch the fund NAV from CMBChina (GH#494)
    - Added Cookie Jar to Comdirect user agent (GH#491)
    - Removed HU.pm, Oslobors.pm, and SEB.pm (GH#490)


author: Paul Howarth <paul@city-fan.org> - 1.6700-1
changelog:
  - Update to 1.67
    - Fixed ASEGR.pm; web site redesigned, URL used for data was no longer
      working (GH#509)
    - Fixed TesouroDireto.pm using Tesouro Transparente as data source (GH#527)
    - Added a new module to fetch data from SwissFundData (GH#515)
    - Handle no trade date in BorsaItaliana.pm (GH#528)
    - Added methodinfo() to MarketWatch.pm and BorsaItaliana.pm
    - Fixed MorningstarCH.pm
    - Fixed MorningstarUK.pm
  - Package new CONTRIBUTING.md file


author: Paul Howarth <paul@city-fan.org> - 1.6800-1
changelog:
  - Update to 1.68
    - Changes to AlphaVantage.pm and CurrencyRates/AlphaVantage.pm to throttle
      queries (GH#546)
    - YahooJSON.pm: Add additional fields/labels (GH#544)
    - New module USBonds.pm
    - MarketWatch.pm: Added headers to fix 401 code (GH#542)
    - Modified AEX.pm to return no data available if currency indicator is '%'
      (bonds return percentage of par/facevalue) (GH#539)
    - Fixed YahooWeb.pm (GH#533, GH#538)
    - Removed CMBChina.pm - no longer working (GH#534)
    - Rewrote Union.pm for URL that returns JSON (GH#516)
    - Modified parsing in BVB.pm (GH#513)


author: Paul Howarth <paul@city-fan.org> - 1.6900-1
changelog:
  - Update to 1.69
    - Sinvestor.pm: Trim whitespace before parsing date and price
    - XETRA.pm: Trim whitespace from date-time before extracting the actual date
      value (GH#557)
    - Modified Stooq.pm to send cookies
      - Stooq requires European visitors to their website to accept cookies
      - Cookies are set using JavaScript
      - Current version of module hard codes these cookies gleaned from a browser
        session
      - Added CurrencyRates/TwelveData.pm


author: Paul Howarth <paul@city-fan.org> - 1.37-1
changelog:
  - Update to 1.37
    Features:
    - Add LoadBytes, LoadUTF8, DumpBytes, DumpUTF8 functions (GH#51)
    Fixes:
    - Fix heap buffer overflow in the YAML emitter - CVE-2026-4177 (GH#67)
    - Fix DumpFile with tied filehandles (IO::String, IO::Scalar) (GH#22)
    - Fix _is_glob to recognize IO::Handle subclasses (GH#23)
    - Fix memory leak when dumping filehandles (CPAN RT#41199, GH#42)
    - Fix dumping of tied hashes (GH#31)
    - Fix dumping strings starting with '...' as unquoted plain scalars (GH#34)
    - Fix dumping strings with tabs and carriage returns as plain scalars (GH#59)
    - Fix double-dash YAML parsing (RT#34073, GH#35)
    - Fix extra newline after empty arrays/hashes in YAML output (GH#36)
    - Remove trailing whitespace from YAML output lines (GH#37, GH#38, GH#39)
    - Fix quoting of \r and \t in YAML output instead of emitting raw bytes
      (GH#40)
    - Fix growing !!perl/regexp objects in round-trips (GH#43)
    - Fix quoted '=' being transformed into 'str' (GH#45)
    - Fix backslash-space escape in double-quoted YAML strings (GH#61)
    - Fix flow sequence comma separator not recognized without trailing space
      (GH#60)
    - Fix wide character warning in DumpFile (GH#28)
    - Fix inline arrays without space after comma (GH#25)
    - Fix: quote strings matching YAML implicit types to prevent round-trip
      failures (GH#26)
    - Fix JSON::Syck::Dump to use JSON-valid \uXXXX escapes in output (GH#21)
    - Fix JSON::Syck::Load decoding of \/ and \uXXXX escape sequences (GH#30)
    - Fix: apply JSON postprocessing to JSON::Syck::DumpFile output (GH#104)
    - Fix: add tied-filehandle fallback to JSON::Syck::DumpFile (GH#98)
    - Fix: handle JSON escape sequences in SingleQuote mode Load (GH#99)
    - Fix: restore Perl 5.8 compatibility in test suite (GH#121)
    - Fix: correct copy-paste error in Makefile.PL clean target (GH#101)
    - Fix: correct $SortKeys POD default from false to true (GH#100)
    - Fix: correct POD documentation errors (GH#103)
    Maintenance:
    - Add C23-compatible function prototypes for GCC 15 compatibility (GH#112)
    - Silence macOS compiler warnings (GH#92)
    - Guard stdint.h include for portability (HP-UX 11.11) (GH#33)
    - Guard stdint.h include in syck_st.h for portability (GH#24)
    - Update ppport.h to 3.68
    - Add regression tests for magical variable dumping (GH#32)
    - CI: modernize GitHub Actions workflow (GH#123, GH#124)
    - CI: add disttest job to validate MANIFEST completeness
  - Use %{make_build} and %{make_install}
  - Drop workaround for C23 incompatibility


author: Paul Howarth <paul@city-fan.org> - 1.39-1
changelog:
  - Update to 1.39
    Bug Fixes:
    - Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety
      (GH#125, GH#130)
    - Fix: anchor tracking for blessed scalar refs in Dump (GH#126, GH#131)
    - Fix: prevent buffer underflow in base60 (sexagesimal) parsing (GH#133)
    - Fix: guard against NULL type from strtok in tag parsing (GH#135)
    - Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (GH#137)
    - Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls
      (GH#138, GH#139)
    Improvements:
    - Resolve TODO tests for empty/invalid YAML to match actual behaviour
      (GH#127, GH#129)
    Maintenance:
    - Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (GH#129)
    - Add comprehensive implicit type resolution test suite (GH#137)
    - Update MANIFEST to include all unit tests
    - Clean up test names to remove unnecessary numbering


author: Paul Howarth <paul@city-fan.org> - 1.41-1
changelog:
  - Update to 1.41
    Bug Fixes:
    - Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of
      strtod() so that floats like -3.14 are not corrupted by double-precision
      rounding artifacts (GH#140, GH#141)


author: Paul Howarth <paul@city-fan.org> - 1.42-1
changelog:
  - Update to 1.42
    Bug Fixes:
    - Fix: Replace strtok() with strpbrk() and fix sign-compare warnings in
      perl_syck.h (GH#145)
    - Fix: Terminate plain scalars at document boundaries --- and ... (GH#150)
    - Fix: Skip %TAG and %YAML directives in document header (GH#151)
    - Fix: Plug SV leak when eval_pv croaks on bad perl/code blocks (GH#153)
    - Fix: Allow non-specific tag '!' before block scalars (GH#27, GH#102)
    - Fix: Remove spurious %type <nodeId> for indent_open in gram.y
      (GH#157, GH#158)
    - Fix: Use modern bison %define api.prefix directive (GH#159, GH#160)
    Improvements:
    - Implement YAML merge key (<<) support (GH#149)
    Maintenance:
    - Remove dead Perl 5.6/5.8 version guards from test files (GH#146)
    - Add YAML 1.0 spec compliance audit and coverage tests (GH#148)
    - Add comprehensive round-trip tests for YAML 1.0 spec features (GH#152)
    - Remove unneeded TODO in t/json-basic.t (GH#154)
    - Add regex Dump/Load/round-trip tests to perl tag scheme (GH#155)
    - Do not require a .y file to build YAML::Syck; add brew support for bison
    - Don't ship docs/ directory in tarball


author: Paul Howarth <paul@city-fan.org> - 1.43-1
changelog:
  - Update to 1.43
    Bug Fixes:
    - Fix: Prevent resource leaks on croak/early-return paths in Dump (GH#161)
    - Fix: Prevent output SV leaks on croak in Dump/DumpFile callers (GH#163)
    - Fix: Load() in list context returns empty list for empty/undef input; also
      applies to LoadBytes and LoadUTF8 (GH#164, GH#165)
    - Fix: DumpCode serializes prototype string instead of code body (GH#168)
    - Fix: Memory leak in !perl/scalar Load - newRV_inc should be newRV_noinc
      (GH#170)
    - Fix: Add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl
      (GH#175, GH#176)
    - Fix: Add TODO guard for eval_pv leak on Perl < 5.14 (GH#179, GH#180)
    - Fix: Negative hex and octal values parsed as 0 with ImplicitTyping (GH#183)
    - Fix: Negative int#base60 values produce unsigned wraparound (GH#185)
    Improvements:
    - Modernize META_MERGE for CPANTS compliance (GH#162)
    - Fix hash table size handling and remove compile warnings in syck_st (GH#174)
    Maintenance:
    - Restore TODO guard for Dump code leak test on Perl < 5.26 (GH#167)
    - Resolve 2010 TODO in perl_json_postprocess with test coverage (GH#166)
    - CI: Upgrade actions to resolve Node.js 20 deprecation warnings (GH#177)


author: Paul Howarth <paul@city-fan.org> - 1.44-1
changelog:
  - Update to 1.44
    Bug Fixes:
    - Fix: Positive hex and octal values parsed as 0 with ImplicitTyping (GH#187)
    - Fix: Resolve uintptr_t redefinition error on Win64 MinGW (GH#186)


author: Paul Howarth <paul@city-fan.org> - 1.45-1
changelog:
  - Update to 1.45
    Bug Fixes:
    - Fix: Use syck_base64_free() to fix Windows "Free to wrong pool" crash in
      base64 encode/decode buffers; also plugs a memory leak (GH#189)
    - Fix: Clear type tag on blessed scalar alias early-return so the stale tag
      no longer leaks onto the next emitted item (GH#193, GH#194, rhbz#2459200)
    - Fix: Negative float#base60 values produce wrong results; strip sign before
      accumulating and avoid negative zero for portable stringification (GH#191)
    - Fix: Prevent memory leaks when Load/LoadJSON croak on parse errors (GH#192)
    Maintenance:
    - Test: Add coverage for SortKeys and JSON MaxDepth (GH#188)
    - Test: Add error handling coverage for LoadFile/DumpFile (GH#190)
    - Update README


author: Benjamin A. Beasley <code@musicinmybrain.net> - 4.1.0-3
changelog:
  - Simplify testing
  - Always run an import-only “smoke test”
  - Do not run language-specific tests; run only the tests that tox would run


author: Jakub Kadlcik <frostyx@email.cz> 1.132-1
changelog:
  - Discourage from deleting objects while paginating over them
  - Suggest pagination only when a GET request timeouts


author: Jakub Kadlcik <frostyx@email.cz> 2.2-1
changelog:
  - Stop using deprecated %py3_build/%py3_install macros
  - Remove rhel7 conditions and remove python2 support


author: Jakub Kadlcik <frostyx@email.cz> 2.3-1
changelog:
  - Use correct used HTTP methods for delete and update requests
  - Introduce v3.requests.DELETE method


author: Jakub Kadlcik <frostyx@email.cz> 2.6-1
changelog:
  - Don't traceback new-api-token for default config
  - Bypass anubis challenge by setting copr user agent
  - Use Tito to generate component.__version__


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.38.00-4
changelog:
  - Exclude tests for Fedora 43+ on s390x that fail due to hardware
    acceleration in the zlib-ng library.


author: Packit <hello@packit.dev> - 0.34.2-1
changelog:
  - context_management: add a type stub override to fix typing. Type checkers like mypy and pyright can now correctly determine the types for `.sources()`, `.sections()`, and the other `Specfile` methods that return context managers. (#457)
  - Resolves: rhbz#2344364


author: Packit <hello@packit.dev> - 0.35.0-1
changelog:
  - Added support for creating Specfile instances from file objects and strings. (#458)
  - The `context_management` type stubs now use `ParamSpec` from `typing_extensions` to support Python < 3.10. (#466)


author: Packit <hello@packit.dev> - 0.36.0-1
changelog:
  - We have fixed a bug that caused specfile to traceback when section names with conditional macro expansions containing spaces were present in the spec file. (#476)


author: Packit <hello@packit.dev> - 0.38.0-1
changelog:
  - A bug leading to incorrect EVR expansion has been fixed. (#492)
  - Prevented side-effects during condition evaluation that could occur when expanding macros that manipulate other macros, leading to misinterpreted validity of condition branches. (#499)


author: Packit <hello@packit.dev> - 0.40.0-1
changelog:
  - `Specfile()` has a new `sanitize` option that enables best effort sanitization of potentially dangerous constructs such as shell expansions and unsafe Lua macros before they are passed to RPM for parsing. (#519)
  - Fixed incorrect parsing of nested macros. (#522)


author: Packit <hello@packit.dev> - 0.40.2-1
changelog:
  - Trailing whitespaces at the end of specfile sections are now ignored during parsing. (#531)
  - Resolves: rhbz#2461109


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 5.6-1
changelog:
  - Adopt Go Vendor Tools and adopt Go Vendor Tools - Closes rhbz#2458183
    rhbz#2435061
  - Use new go2rpm template
  - Change URL to GitLab repo
  - Remove ShellCheck and golint requirements
  - Other misc changes


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.8.4-1
changelog:
  - Update to version 1.8.4; Fixes RHBZ#2453126
  - Do not expose metapackages for unstable or undocumented features


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.2.16-2
changelog:
  - Don’t mark files included in the library as documentation
  - This affects four Markdown files. Fixes RHBZ#2415111


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.8.9-2
changelog:
  - Stop patching out the smallvec-1 feature
  - The uv package needs it, beginning with version 0.5.19.


author: Attila Kovacs <attipaci@gmail.com> - 1.5.0-1
changelog:
  - Upstream v1.5.0, and streamlined package structure - Switched to CMake
    for the build - devel sub-package now includes CMake / pkgconfig
    configurations - No longer includes cio-data subpackage (no longer needed
    or used) - No longer includes legacy solsys1 / solsys2 ubpackages


author: Pavel Raiskup <praiskup@redhat.com> - 5-1
changelog:
  - support for fast "ruff" analyser
  - --linter-tag option added
  - subproject detection by .vcs-diff-lint.yml


author: Pavel Raiskup <praiskup@redhat.com> 6-1
changelog:
  - bugfix: correctly honor file renames
  - bugfix: fix subproject detection for git worktree
  - ruff: do full project scans (since Ruff is fast enough)
  - check the new (changed) code in a side-directory


author: Pavel Raiskup <praiskup@redhat.com> 6.2-1
changelog:
  - drop unnecessary newline in the output
  - ruff: don't prefix the error locations with absolute path
  - ruff: don't optimize out the full Ruff run
  - print the git sha1 being analyzed
  - bugfix: correct matching filenames with endswith()


author: Pavel Raiskup <praiskup@redhat.com> 6.3-1
changelog:
  - don't require all the linters, just recommend them
  - use requested linters only if they are available
  - nicer info/debug output


author: Pavel Raiskup <pavel@raiskup.cz> 6.7-1
changelog:
  - Handle (no traceback) "invalid-syntax" code from Ruff
  - log.debug() all git commands
  - do not let "git apply" pollute stderr with whitespace errors


author: Orion Poplawski <orion@nwra.com> - 7.0.9-2
changelog:
  - Re-install SELinux module in %posttrans to address "upgrade" from zabbixA.B
    to zabbixX.Y in one transaction


