This release contains plenty of new features, bug-fixes, and general
improvements. Some of the most important highlights include:
* We did it again, the MATE desktop environment is easier to use than before,
once the user starts the session. Do you want to hide applications startup?
Now you can set which applications to show on startup.
* Engrampa now has support for a handful of extra formats, as well as fixed
support for passwords and unicode characters in some of them.
* Eye of MATE now has support for Wayland and we’ve added support for
embedded color profiles.
* The thumbnail generation has been reworked and fixed in several places.
* Added support for webp files.
* Our window manager, marco, has gotten quite a few changes:
* We’ve brought a bunch of window decorations from the past to feed
your nostalgia.
* Finally added invisible resize borders. No more struggling to find a
border to grab with your mouse!
* All window controls (you know, the min, max, close buttons) are now
rendered in HiDPI.
* The Alt+Tab and Workspace Switcher popups have been entirely reworked.
Now they render in beautiful OSD style, are more configurable, and can
respond to keyboard arrows.
* Tiling windows with the keyboard now allows you to cycle through
different window sizes. You no longer need to feel constrained by only
half of your screen.
* The System Monitor panel applet now has support for NVMe drives.
* Calculator now supports using either “pi” or “π”.
* Scientific notation has been improved.
* Some fixes for supporting pre-defined physical constants.
* The Control Center now displays its icons correctly on HiDPI displays.
* A brand new Time And Date Manager app has been added.
* The Mouse app now supports acceleration profiles.
* The Preferred Applications app has been improved for accessibility, as well
as better support for integration with IM clients.
* The Indicator Applet has slightly better interaction with
oddly-sized icons.
* Speaking of icons, the network manager applet icons in our own themes have
been entirely redesigned and can now be enjoyed on HiDPI displays.
* If you’re the type of person that does not like to be disturbed when busy,
or giving a presentation, or watching a movie, you’ll be happy to know that
the notification daemon now supports a Do-Not-Disturb mode.
* The MATE Panel had several bugs that caused crashes in the past when
changing layouts. Those are now fixed!
* Support for Wayland compatibility has improved considerably.
* Status icons (a.k.a. notification area, or system tray) have support
for HiDPI displays.
* Wanda the Fish got a make-over and now you can enjoy her in full
HiDPI glory.
* The window list applet now supports window thumbnails on hover.
* Various accessibility improvements throughout the panel and its
core applets.
* If your system doesn’t, uh, support systemd you might be interested in
knowing that we’ve added support for elogind to both the MATE Screensaver
and the MATE Session.
* We’ve also added a brand new MATE Disk Image Mounter utility.
* Mozo, the menu editor, now supports Undo and Redo actions.
* Pluma plugins have now fully switched to Python 3.
* Pluma no longer has to envy anything from other complex editors, since it
can now show the formatting marks.
* i18n: All applications have been migrated from intltools to gettext.
This is polkit 0.116.
Highlights:
Fix of CVE-2018-19788, high UIDs caused overflow in polkit;
Fix of CVE-2019-6133, kernel vulnerability (Slowfork) allowed local privilege escalation.
Changes since polkit 0.115:
Kyle Walker:
Leaking zombie child processes
Jan Rybar:
Possible resource leak found by static analyzer
Output messages tuneup
Sanity fixes
pkttyagent tty echo disabled on SIGINT
Ray Strode:
HACKING: add link to Code of Conduct
Philip Withnall:
polkitbackend: comment typos fix
Zbigniew Jędrzejewski-Szmek:
configure.ac: fix detection of systemd with cgroups v2
CVE-2018-19788 High UIDs overflow fix
Colin Walters:
CVE-2019-6133 Slowfork vulnerability fix
Matthew Leeds:
Allow unset process-uid
Emmanuele Bassi
Port the JS authority to mozjs-60
Göran Uddeborg:
Use JS_EncodeStringToUTF8
Many thanks to all contributors!
Jan Rybar et al.,
April 25, 2019
3.0.7:
Include OpenSSL libs and binary for Windows 1.1.0j
Remove RANDFILE environment variable
Workaround for bug in win32 mktemp
Handle IP address in SAN and renewals
Workaround for ash and no set -o echo
Shore up windows testing framework
Provide upgrade mechanism for older versions of EasyRSA
Add support for KDC certificates
Add support for Edward Curves
Add support for EASYRSA_PASSIN and EASYRSA_PASSOUT env vars
Add support for RID to SAN
2.9:
* **BACKWARDS INCOMPATIBLE:** Support for Python 3.4 has been removed due to
low usage and maintenance burden.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.0.1 has been removed.
Users on older version of OpenSSL will need to upgrade.
* **BACKWARDS INCOMPATIBLE:** Support for LibreSSL 2.6.x has been removed.
* Removed support for calling
:meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey.public_bytes`
with no arguments, as per our deprecation policy. You must now pass
``encoding`` and ``format``.
* **BACKWARDS INCOMPATIBLE:** Reversed the order in which
:meth:`~cryptography.x509.Name.rfc4514_string` returns the RDNs
as required by :rfc:`4514`.
* Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
OpenSSL 1.1.1f.
* Added support for parsing
:attr:`~cryptography.x509.ocsp.OCSPResponse.single_extensions` in an OCSP
response.
* :class:`~cryptography.x509.NameAttribute` values can now be empty strings.
Version 3.6.13:
** libgnutls: Fix a DTLS-protocol regression (caused by TLS1.3 support), since 3.6.3.
The DTLS client would not contribute any randomness to the DTLS negotiation,
breaking the security guarantees of the DTLS protocol
[GNUTLS-SA-2020-03-31, CVSS: high]
** libgnutls: Added new APIs to access KDF algorithms.
** libgnutls: Added new callback gnutls_keylog_func that enables a custom
logging functionality.
** libgnutls: Added support for non-null terminated usernames in PSK
negotiation.
** gnutls-cli-debug: Improved support for old servers that only support
SSL 3.0.
** API and ABI modifications:
gnutls_hkdf_extract: Added
gnutls_hkdf_expand: Added
gnutls_pbkdf2: Added
gnutls_session_get_keylog_function: Added
gnutls_session_set_keylog_function: Added
gnutls_prf_hash_get: Added
gnutls_psk_server_get_username2: Added
gnutls_psk_set_client_credentials2: Added
gnutls_psk_set_client_credentials_function2: Added
gnutls_psk_set_server_credentials_function2: Added
Features
add mTLS ADC support for HTTP (#457) (bb9215a)
add SslCredentials class for mTLS ADC (#448) (dafb41f)
fetch id token from GCE metadata server (#462) (97e7700)
Bug Fixes
don't use threads for gRPC AuthMetadataPlugin (#467) (ee373f8)
make ThreadPoolExecutor a class var (#461) (b526473)
While the certs dir should exist, pkg_delete of
mozilla-rootcerts-openssl currently removes it, despite it not having
been created by the corresponding pkg_add. Instead of failing if the
directory does not exist, simply emit a warning and create it.
Changes since pam-p11-0.1.5 from the NEWS file:
New in 0.3.1; 2019-09-11; Frank Morgner
* CVE-2019-16058: Fixed buffer overflow when creating signatures longer than 256
bytes
New in 0.3.0; 2019-04-24; Frank Morgner
* Add Italian translation
* Add support for matching the PIN-input with a regular expression
* Add support for macOS
* Add support for building with OpenSSL 1.1.1
* Add support for nistp256/384/521 keys in authorized_keys file
New in 0.2.0; 2018-05-16; Frank Morgner
* Add user documentation in Readme.md
* Add support for PIN pad readers
* Add support for changing/unblocking PIN (use with passwd)
* Add support for localized user feedback
* Add support for cards without certificates (e.g. OpenPGP card)
* Add support for PKCS#11 modules with multiple slots
* Add support for building with OpenSSL 1.1
* Merged opensc and openssh module into pam_p11.so
* Fixed memory leaks, coverity issues, compiler warnings
* Created `test-passwd` and `test-login` for testing standard use cases
New in 0.1.6; 2017-03-06; Alon Bar-Lev
* Build system rewritten (NOTICE: configure options was modified).
Changes since libp11-0.2.8 from the NEWS file:
New in 0.4.4; 2017-01-26; Michal Trojnara
* Fixed a state reset caused by re-login on LOAD_CERT_CTRL engine ctrl;
fixes#141 (Michal Trojnara)
* "?" and "&" allowed as URI separators; fixes#142 (Michal Trojnara)
* engine: Unified private/public key and certificate enumeration
to be performed without login if possible (Michal Trojnara)
New in 0.4.3; 2016-12-04; Michal Trojnara
* Use UI to get CKU_CONTEXT_SPECIFIC PINs (Michal Trojnara)
* Added graceful handling of alien (non-PKCS#11) keys (Michal Trojnara)
* Added symbol versioning (Nikos Mavrogiannopoulos)
* Soname tied with with the OpenSSL soname (Nikos Mavrogiannopoulos)
* Added MSYS2, Cygwin, and MinGW/MSYS support (Pawel Witas)
* Workaround implemented for a deadlock in PKCS#11 modules that
internally use OpenSSL engines (Michal Trojnara, Pawel Witas)
* Fixed an EVP_PKEY reference count leak (David Woodhouse)
* Fixed OpenSSL 1.1.x crash in public RSA methods (Doug Engert,
Michal Trojnara)
* Fixed OpenSSL 1.1.x builds (Nikos Mavrogiannopoulos, Michal Trojnara)
* Fixed retrieving PIN values from certificate URIs (Andrei Korikov)
* Fixed symlink installation (Alon Bar-Lev)
New in 0.4.2; 2016-09-25; Michal Trojnara
* Fixed a 0.4.0 regression bug causing the engine finish function to
remove any configured engine parameters; fixes#104 (Michal Trojnara)
New in 0.4.1; 2016-09-17; Michal Trojnara
* Use enginesdir provided by libcrypto.pc if available (David Woodhouse)
* Certificate cache destroyed on login/logout (David Woodhouse)
* Fixed accessing certificates marked as CKA_PRIVATE (David Woodhouse)
* Directly included libp11 code into the engine (Matt Hauck)
* Fixed handling simultaneous make jobs (Derek Straka)
* Reverted an old hack that broke engine initialization (Michal Trojnara)
* Fixed loading of multiple keys due to unneeded re-logging (Matt Hauck)
* Makefile fixes and improvements (Nikos Mavrogiannopoulos)
* Fixed several certificate selection bugs (Michal Trojnara)
* The signed message digest is truncated if it is too long for the
signing curve (David von Oheimb)
* Workaround for broken PKCS#11 modules not returning CKA_EC_POINT
in the ASN1_OCTET_STRING format (Michal Trojnara)
* OpenSSL 1.1.0 build fixes (Michal Trojnara)
New in 0.4.0; 2016-03-28; Michal Trojnara
* Merged engine_pkcs11 (Michal Trojnara)
* Added ECDSA support for OpenSSL < 1.0.2 (Michal Trojnara)
* Added ECDH key derivation support (Doug Engert and Michal Trojnara)
* Added support for RSA_NO_PADDING RSA private key decryption, used
by OpenSSL for various features including OAEP (Michal Trojnara)
* Added support for the ANSI X9.31 (RSA_X931_PADDING) RSA padding
(Michal Trojnara)
* Added support for RSA encryption (not only signing) (Michal Trojnara)
* Added CKA_ALWAYS_AUTHENTICATE support (Michal Trojnara)
* Fixed double locking the global engine lock (Michal Trojnara)
* Fixed incorrect errors reported on signing/encryption/decryption
(Michal Trojnara)
* Fixed deadlocks in keys and certificates listing (Brian Hinz)
* Use PKCS11_MODULE_PATH environment variable (Doug Engert)
* Added support for building against OpenSSL 1.1.0-dev (Doug Engert)
* Returned EVP_PKEY objects are no longer "const" (Michal Trojnara)
* Fixed building against OpenSSL 0.9.8 (Michal Trojnara)
* Removed support for OpenSSL 0.9.7 (Michal Trojnara)
New in 0.3.1; 2016-01-22; Michal Trojnara
* Added PKCS11_is_logged_in to the API (Mikhail Denisenko)
* Added PKCS11_enumerate_public_keys to the API (Michal Trojnara)
* Fixed EVP_PKEY handling of public keys (Michal Trojnara)
* Added thread safety based on OpenSSL dynamic locks (Michal Trojnara)
* A private index is allocated for ex_data access (RSA and ECDSA classes)
instead of using the reserved index zero (app_data) (Michal Trojnara)
* Fixes in reinitialization after fork; addresses #39
(Michal Trojnara)
* Improved searching for dlopen() (Christoph Moench-Tegeder)
* MSVC build fixes (Michal Trojnara)
* Fixed memory leaks in pkcs11_get_evp_key_rsa() (Michal Trojnara)
New in 0.3.0; 2015-10-09; Nikos Mavrogiannopoulos
* Added small test suite based on softhsm (run on make check)
* Memory leak fixes (Christian Heimes)
* On module initialization tell the module to that the OS locking
primitives are OK to use (Mike Gerow)
* Transparently handle applications that fork. That is call C_Initialize()
and reopen any handles if a fork is detected.
* Eliminated any hard coded limits for certificate size (Doug Engert)
* Added support for ECDSA (Doug Engert)
* Allow RSA_NO_PADDING padding mode in PKCS11_private_encrypt
(Stephane Adenot)
* Eliminated several hard-coded limits in parameter sizes.
It is now known that there are people that prefer manual operation via
the mozilla-rootcerts script to the mozilla-rootcerts-openssl package.
Therefore, mention both approaches (without veering into documentation
of them or tutorial -- just enough to make people aware they exist).
Explain the purpose, and then explain the mechanism and why it is
somewhat and very irregular in the pkgsrc and native cases.
Point to mozilla-rootcerts as providing certificates without
configuring them as trust anchors.
* Noteworthy changes in release 4.16.0 (released 2020-02-01) [stable]
- asn1_decode_simple_ber: added support for constructed definite
octet strings. This allows this function decode the whole set of
BER encodings for OCTET STRINGs.
- asn1_get_object_id_der: enhance the range of decoded OIDs (#25).
This also makes OID encoding and decoding more strict on invalid
input. This may break gnutls' test suite before 3.6.12 as it was
relying on decoding some invalid OIDs.
- asn1_object_id_der: New function
* Noteworthy changes in release 4.15.0 (released 2019-11-21) [stable]
- The generated tree no longer contains ASN.1 built-in types even
if they are explicitly defined in the description. Previously
a warning was printed when these types were seen, now they are
ignored.
- Several fixes in ASN.1 definition parser, preventing several
crashes and leaks in the tools due to improper ASN.1.
- Switched to semantic versioning.
Update ruby-sshkit: update to 1.21.0.
pkgsrc change: add "USE_LANGUAGES= # none".
1.20.0 (2019-08-03)
* #468: Make upload! take a :verbosity option like exec does - @grosser
1.19.1 (2019-07-02)
* #465: Fix a regression in 1.19.0 that prevented ~ from being used in
Capistrano paths, e.g. :deploy_to, etc. - @grosser
1.19.0 (2019-07-01)
* #455: Ensure UUID of commands are stable in logging - @lazyatom
* #453: as and within now properly escape their user/group/path arguments,
and the command nested within an as block is now properly escaped before
passing to sh -c. In the unlikely case that you were manually escaping
commands passed to SSHKit as a workaround, you will no longer need to do
this. See #458 for examples of what has been fixed. - @grosser
* #460: Handle IPv6 addresses without port - @will-in-wi
1.18.2 (2019-02-03)
* #448: Fix misbehaving connection eviction loop when disabling connection
pooling - Sebastian Cohnen
1.18.1 (2019-01-26)
* #447: Fix broken thread safety by widening critical section - Takumasa Ochi
Update ruby-rbnacl to 7.1.1.
## [7.1.1] (2020-01-27)
- Test on Ruby 2.7 ([#208])
- Add project metadata to the gemspec ([#207])
- Resolve FFI deprecation warning ([#206])
## [7.1.0] (2019-09-07)
- Attached signature API ([#197], [#202])
- Fix the `generichash` state definition ([#200])
## [7.0.0] (2019-05-23)
- Drop support for Ruby 2.2 ([#194])
## [6.0.1] (2019-01-27)
- Add fallback `sodium_constants` for Argon2 ([#189])
- Support libsodium versions used by Heroku ([#186])
- Sealed boxes ([#184])
Update ruby-openssl-ccm to 1.2.2.
pkgsrc change: add "USE_LANGUAGES= # none".
Version 1.2.2 (2019-01-08)
* Update cipher validation to be case-insensitive
Update ruby-bcrypt to 3.1.13.
pkgsrc change: correct HOMEPAGE.
3.1.13 May 31 2019
- No longer include compiled binaries for Windows. See GH #173.
- Update C and Java implementations to latest versions [GH #182 by @fonica]
- Bump default cost to 12 [GH #181 by @bdewater]
- Remove explicit support for Rubies 1.8 and 1.9
- Define SKIP_GNU token when building extension (Fixes FreeBSD >= 12)
[GH #189 by @adam12]
Update ruby-airbrussh to 1.4.0.
1.4.0 (2019-10-13)
New Features
* Allow ConsoleFormatter context to be configurable (#131) @pblesi
1.3.4 (2019-09-15)
Housekeeping
* Add issues, source code URLs to gemspec metadata (#129) @mattbrictson
* Add changelog_uri to metadata to easily link from rubygems.org (#128)
@nickhammond
1.3.3 (2019-08-18)
Bug Fixes
* Fix LoadError when airbrussh is used without rake installed (#127)
@mattbrictson
Housekeeping
* Migrate to new GitHub Actions config format (#125) @mattbrictson
* Remove chandler from rake release process (#124) @mattbrictson
* Set up release-drafter (#123) @mattbrictson
* Eliminate double CI builds on PRs (#122) @mattbrictson
1.3.2 (2019-06-15)
* #121: Gracefully handle SSH output that has invalid UTF-8 encoding instead
of raising an exception - @mattbrictson
Certbot 1.3.0
Added
Added certbot.ocsp Certbot's API. The certbot.ocsp module can be used to
determine the OCSP status of certificates.
Don't verify the existing certificate in HTTP01Response.simple_verify, for
compatibility with the real-world ACME challenge checks.
Changed
Certbot will now renew certificates early if they have been revoked according
to OCSP.
Fix acme module warnings when response Content-Type includes params (e.g. charset).
Fixed issue where webroot plugin would incorrectly raise Read-only file system
error when creating challenge directories
# Changelog
## 1.10.1 (2020-01-08)
* Fixes
* Add PEM/DER compatibility layer for PKCS-8 incompatibilities with various versions of OTP, `crypto`, and `public_key`; see [#82](https://github.com/potatosalad/erlang-jose/issues/82)
## 1.10.0 (2020-01-03)
* Enhancements
* Remove [base64url](https://github.com/dvv/base64url) dependency and include embedded version.
* Add support for `C20P` and `XC20P` encryption based on [draft-amringer-jose-chacha](https://tools.ietf.org/html/draft-amringer-jose-chacha-01) (ChaCha20/Poly1305 and XChaCha20/Poly1305).
* Add support for ECDH-ES keywrapping for AES-GCM, ChaCha20/Poly1305, and XChaCha20/Poly1305.
* Add support for PBES2 keywrapping for AES-GCM, ChaCha20/Poly1305, and XChaCha20/Poly1305.
* Add support for `ECDH-1PU` encryption based on [draft-madden-jose-ecdh-1pu](https://tools.ietf.org/html/draft-madden-jose-ecdh-1pu-02).
* Add support for reading/writing DER format (or PKCS8 format).
* Fixes
* Fix PSS salt length (thanks to [@ntrepid8](https://github.com/ntrepid8), see [#65](https://github.com/potatosalad/erlang-jose/pull/65))
* Speed up and stabilize tests on CI environment.
## 1.9.0 (2018-12-31)
* Enhancements
* Add support for [Jason](https://github.com/michalmuskala/jason) JSON encoding and decoding.
* Add support for Poison 4.x and lexical ordering.
* Use `public_key` over `cutkey` for RSA key generation if available.
* Drop support for older versions of OTP (19+ now required).
* Relicense library under MIT license.
* Fixes
* Add macro so the application compiles without warnings after `erlang:get_stacktrace/0` has been deprecated.
* Extra sanity check for RSA padding modes when falling back.
Update pear-Crypt_GPG to 1.6.4.
1.6.4 (2020-03-22 08:00 UTC)
Changelog:
* Use classmap for autoloading in composer as this package does not follow
PSR-0.
* Support default gpg binary location on NixOS.
* Fix IgnoreVerifyErrors issues with GnuPG 1.4 and PHP5.
* Add possibility to add custom arguments to gpg commands.
* Add option to choose compression algorithm.
* Compatibility with phpunit >= 6.0.
2.067 2020/02/14
- fix memory leak on incomplete handshake
https://github.com/noxxi/p5-io-socket-ssl/issues/92
Thanks to olegwtf
- add support for SSL_MODE_RELEASE_BUFFERS via SSL_mode_release_buffers
This can decrease memory usage at the costs of more allocations
https://rt.cpan.org/Ticket/Display.html?id=129463
- more detailed error messages when loading of certificate file failed
https://github.com/noxxi/p5-io-socket-ssl/issues/89
- fix for ip_in_cn == 6 in verify_hostname scheme
https://rt.cpan.org/Ticket/Display.html?id=131384
- deal with new MODE_AUTO_RETRY default in OpenSSL 1.1.1
- fix warning when no ecdh support is available
- documentation update regarding use of select and TLS 1.3
- various fixes in documentation
https://github.com/noxxi/p5-io-socket-ssl/issues/91https://github.com/noxxi/p5-io-socket-ssl/issues/90https://github.com/noxxi/p5-io-socket-ssl/issues/87https://github.com/noxxi/p5-io-socket-ssl/issues/81
- stability fix t/core.t
2.066 2019/03/06
- fix test t/verify_partial_chain.t by using the newly exposed function
can_partial_chain instead of guessing (wrongly) if the functionality is
available
2.065 2019/03/05
- make sure that Net::SSLeay::CTX_get0_param is defined before using
X509_V_FLAG_PARTIAL_CHAIN. Net::SSLeay 1.85 defined only the second with
LibreSSL 2.7.4 but not the first
https://rt.cpan.org/Ticket/Display.html?id=128716
- prefer AES for server side cipher default since it is usually
hardware-accelerated
2.064 2019/03/04
- make algorithm for fingerprint optional, i.e. detect based on length of
fingerprint - https://rt.cpan.org/Ticket/Display.html?id=127773
- fix t/sessions.t and improve stability of t/verify_hostname.t on windows
- use CTX_set_ecdh_auto when needed (OpenSSL 1.0.2) if explicit curves are set
- update fingerprints for live tests
2.063 2019/03/01
- support for both RSA and ECDSA certificate on same domain
- update PublicSuffix
- Refuse to build if Net::SSLeay is compiled with one version of OpenSSL but
then linked against another API-incompatible version (ie. more than just the
patchlevel differs).
2.062 2019/02/24
- Enable X509_V_FLAG_PARTIAL_CHAIN if supported by Net::SSLeay (1.83+) and
OpenSSL (1.1.0+). This makes leaf certificates or intermediate certificates in
the trust store be usable as full trust anchors too.
2.061 2019/02/23
- Support for TLS 1.3 session reuse. Needs Net::SSLeay 1.86+.
Note that the previous (and undocumented) API for the session cache has been
changed.
- Support for multiple curves, automatic setting of curves and setting of
supported curves in client. Needs Net::SSLeay 1.86+.
- Enable Post-Handshake-Authentication (TLSv1.3 feature) client-side when
client certificates are provided. Thanks to jorton[AT]redhat[DOT]com.
Needs Net::SSLeay 1.86+.
1.88 2019-05-10
- New stable release incorporating all changes from developer
releases 1.86_01 to 1.86_11.
- From this release, Net-SSLeay is switching to an "odd/even"
developer/stable release version numbering system, like that of
many core modules (e.g. ExtUtils::MakeMaker): developer releases
will have an odd minor version number (and the usual "_xx" suffix),
and stable releases will have an even minor version number. This
means there is no Net-SSLeay 1.87.
- Summary of major changes since version 1.85:
- Mike McCauley has stepped down as maintainer. The new maintainers
are Chris Novakovic, Heikki Vatiainen and Tuure Vartiainen.
- The source code has moved from the now-defunct Debian Subversion
server (alioth.debian.org) to GitHub
(https://github.com/radiator-software/p5-net-ssleay).
- Net-SSLeay is provided under the terms of the Artistic License
2.0 - this has been the case since version 1.66, but references
to other licenses remained in the source code, causing ambiguity.
- Perl 5.8.1 or newer is now required to use Net-SSLeay. This has
already been the case for some time in practice, as the test
suite hasn't fully passed on Perl 5.6 for several years.
- Much-improved compatibility with OpenSSL 1.1.1, and improved
support for TLS 1.3.
- Fixed a long-standing bug in cb_data_advanced_put() that caused
memory leaks when callbacks were frequently added and removed.
- Support in the test suite for "hardened" OpenSSL configurations
that set a default security level of 2 or higher (e.g., in the
OpenSSL packages that ship with recent versions of Debian, Fedora
and Ubuntu).
1.52 December 22, 2018
* Add a chi square statistical test. t/chisquare.t
* Uniform can be passed to the constructor of Crypt::Random::Generator.
This should be the default, and will likely be in the next release.
* Fixed minor bugs & typos.
1.51 December 22, 2018
* Test no longer looks for non-eq of two generated numbers as these can be
correctly the same if test is run enough number of times.
https://rt.cpan.org/Ticket/Display.html?id=99880
* Removed outdated dependency info.
https://rt.cpan.org/Ticket/Display.html?id=94441
* Removed /dev/random read from the test, as it can hang when there is
insufficient entropy.
https://rt.cpan.org/Ticket/Display.html?id=30423
* Removed potentially unsafe include in bin/makerandom.
https://rt.cpan.org/Ticket/Display.html?id=128062
There is no chance that line 1 contains an include argument, after being
sent through REPLACE_PERL. And even then, including a relative path would
not make sense.
Major changes between OpenSSL 1.1.1d and OpenSSL 1.1.1e [17 Mar 2020]
o Fixed an overflow bug in the x64_64 Montgomery squaring procedure
used in exponentiation with 512-bit moduli (CVE-2019-1551)
Noteworthy changes in version 2.2.20:
* Protect the error counter against overflow to guarantee that the
tools can't be tricked into returning success after an error.
* gpg: Make really sure that --verify-files always returns an error.
* gpg: Fix key listing --with-secret if a pattern is given.
* gpg: Fix detection of certain keys used as default-key.
* gpg: Fix default-key selection when a card is available.
* gpg: Fix key expiration and key usage for keys created with a
creation date of zero.
* gpgsm: Fix import of some CR,LF terminated certificates.
* gpg: New options --include-key-block and --auto-key-import to
allow encrypted replies after an initial signed message.
* gpg: Allow the use of a fingerprint with --trusted-key.
* gpg: New property "fpr" for use by --export-filter.
* scdaemon: Disable the pinpad if a KDF DO is used.
* dirmngr: Improve finding OCSP certificates.
* Avoid build problems with LTO or gcc-10.
It has long been an issue that heimdal installs "su" which shadows
system su and behaves differently. Now, with openssl 1.1, many people
are getting heimdal installed that did not expect it or ask for it.
(Really, heimdal should be split into libraries and apps, so that
programs can have kerberos support without adding commands to the
user's namespace, but this is vastly easier.)
(In response to on-list complaints, and believing this will not be
contoversial.)
Release 2.2.0
Added support for U2F/FIDO2 security keys, with the following capabilities:
ECDSA (NISTP256) and Ed25519 key algorithms
Key generation, including control over the application and user the key is associated with and whether touch is required when using the key
Certificate generation, both as a key being signed and a CA key
Resident keys, allowing security keys to be used on multiple machines without any information being stored outside of the key
Access to and management of keys loaded in an OpenSSH ssh-agent
Support for both user and host keys and certificates
Support for “no-touch-required” option in authorized_keys files
Support for “no-touch-required” option in OpenSSH certificates
Compatibility with security key support added in OpenSSH version 8.2
Added login timeout client option and limits on the length and number of banner lines AsyncSSH will accept prior to the SSH version header.
Improved load_keypairs() to read public key files, confirming that they are consistent with their associated private key when they are present.
Fixed issues in the SCP server related to handling filenames with spaces.
Fixed an issue with resuming reading after readuntil() returns an incomplete read.
Fixed a potential issue related to asyncio not reporting sockname/peername when a connection is closed immediately after it is opened.
Made SSHConnection a subclass of asyncio.Protocol to please type checkers.
This was marked NOT_FOR_UNPRIVILEGED, but that is only appropriate
when the package (abusively, as a pre-existing well-discussed
compromise) writes outside of the pkgsrc prefix.
Patch by Jason Bacon, with general approval on tech-pkg.
ok dholland@
rvault is a secure and authenticated store for secrets (passwords,
keys, certificates) and small documents. It uses envelope encryption
with one-time password (OTP) authentication. The vault can be operated
as a file system in userspace. It is written in C11 and distributed
under the 2-clause BSD license.
From rmind@
= mbed TLS 2.16.5 branch released 2020-02-20
Security
* Fix potential memory overread when performing an ECDSA signature
operation. The overread only happens with cryptographically low
probability (of the order of 2^-n where n is the bitsize of the curve)
unless the RNG is broken, and could result in information disclosure or
denial of service (application crash or extra resource consumption).
Found by Auke Zeilstra and Peter Schwabe, using static analysis.
* To avoid a side channel vulnerability when parsing an RSA private key,
read all the CRT parameters from the DER structure rather than
reconstructing them. Found by Alejandro Cabrera Aldaya and Billy Bob
Brumley. Reported and fix contributed by Jack Lloyd.
ARMmbed/mbed-crypto#352
Bugfix
* Fix an unchecked call to mbedtls_md() in the x509write module.
* Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some
RSA keys that would later be rejected by functions expecting private
keys. Found by Catena cyber using oss-fuzz (issue 20467).
* Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some
RSA keys with invalid values by silently fixing those values.
## 2.5.3 (2020-01-19)
### Fixed
- Fix a possible database lockout when removing a YubiKey from a KDBX 3.1 database [#4147]
- Fix crash if Auto-Type is performed on a new entry [#4150]
- Fix crash when all entries are deleted from a group [#4156]
- Improve the reliability of clipboard clearing on Gnome [#4165]
- Do not check cmd:// URLs for valid URL syntax anymore [#4172]
- Prevent unnecessary merges for databases on network shares [#4153]
- Browser: Prevent native messaging proxy from blocking application shutdown [#4155]
- Browser: Improve website URL matching [#4134, #4177]
### Added
- Browser: Enable support for Chromium-based Edge Browser [#3359]
Changes from 2.43 to 2.44:
New Features:
* Added option 'Use file transactions for writing [22]configuration
settings' (turned on by default).
* If the option 'Do not store data in the Windows clipboard history
and the cloud clipboard' is turned on (which it is by default),
KeePass now additionally excludes its clipboard contents from
processing by Windows' internal ClipboardMonitor component.
* Added commands to find database files ('File' -> 'Open' -> 'Find
Files' and 'Find Files (In Folder)').
* Added 'Edit' menu in the [23]internal text editor (including new
'Select All' and 'Find' commands with keyboard shortcuts).
* Added keyboard shortcuts for formatting commands in the internal
text editor.
* Added 'Cancel' button in the save confirmation dialog of the
internal text editor.
* Added {CLIPBOARD} and {CLIPBOARD-SET:/T/} [24]placeholders, which
get/set the clipboard content.
* Added support for [25]importing True Key 4 CSV files.
* Added command line options for adding/removing scheme-specific URL
overrides.
* Added an auto-type event for [26]plugins.
* When loading a plugin on a Unix-like system fails, the error
message now includes a hint that the 'mono-complete' package may be
required.
* In order to avoid a Windows Input Method Editor (IME) bug
(resulting in a black screen and/or an IME/CTF process with high
CPU usage), KeePass now disables the IME on [27]secure desktops.
Improvements:
* [28]Auto-Type: improved compatibility with VMware Workstation.
* Auto-Type into virtual machines: improved compatibility with
certain guest systems.
* The option to use the 'Clipboard Viewer Ignore' clipboard format is
now turned on by default.
* Improved menu/toolbar item state updating in the internal text
editor.
* Improved performance of Spr compilations.
* Before writing a local configuration file whose path has been
specified using the '-cfg-local:' [29]command line parameter,
KeePass now tries to create the parent directory, if it does not
exist yet.
* Improved conversion of file URIs to local file paths.
* Improved compatibility of the list view dialog with plugins.
* If ChaCha20 is selected as file [30]encryption algorithm, the
database is now saved in the [31]KDBX 4 format (thanks to
[32]AMOSSYS).
* Minor [33]process memory protection improvements.
* HTML export/printing: KeePass now generates HTML 5 documents
(instead of XHTML 1.0 documents).
* HTML export/printing: improved internal CSS.
* HTML exports do not contain temporary content identifiers anymore.
* XSL files: HTML output now conforms to HTML 5 instead of XHTML 1.0.
* XSL files: improved internal CSS.
* CHM pages are now rendered in the highest standards mode supported
by Internet Explorer (EdgeHTML mode).
* Migrated most of the documentation from XHTML 1.0 to HTML 5.
* Various code optimizations.
* Minor other improvements.
Bugfixes:
* In the internal text editor, the 'Delete' command does not reset
RTF text formattings anymore.
* The [34]KeyCreationFlags bit 2^19 (for hiding the passwords) now
works as intended.
Security
* Fix side channel vulnerability in ECDSA. Our bignum implementation is not
constant time/constant trace, so side channel attacks can retrieve the
blinded value, factor it (as it is smaller than RSA keys and not guaranteed
to have only large prime factors), and then, by brute force, recover the
key. Reported by Alejandro Cabrera Aldaya and Billy Brumley.
* Zeroize local variables in mbedtls_internal_aes_encrypt() and
mbedtls_internal_aes_decrypt() before exiting the function. The value of
these variables can be used to recover the last round key. To follow best
practice and to limit the impact of buffer overread vulnerabilities (like
Heartbleed) we need to zeroize them before exiting the function.
Issue reported by Tuba Yavuz, Farhaan Fowze, Ken (Yihang) Bai,
Grant Hernandez, and Kevin Butler (University of Florida) and
Dave Tian (Purdue University).
* Fix side channel vulnerability in ECDSA key generation. Obtaining precise
timings on the comparison in the key generation enabled the attacker to
learn leading bits of the ephemeral key used during ECDSA signatures and to
recover the private key. Reported by Jeremy Dubeuf.
* Catch failure of AES functions in mbedtls_ctr_drbg_random(). Uncaught
failures could happen with alternative implementations of AES. Bug
reported and fix proposed by Johan Uppman Bruce and Christoffer Lauri,
Sectra.
Bugfix
* Remove redundant line for getting the bitlen of a bignum, since the variable
holding the returned value is overwritten a line after.
Found by irwir in #2377.
* Support mbedtls_hmac_drbg_set_entropy_len() and
mbedtls_ctr_drbg_set_entropy_len() before the DRBG is seeded. Before,
the initial seeding always reset the entropy length to the compile-time
default.
Changes
* Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx()
from the cipher abstraction layer. Fixes#2198.
* Clarify how the interface of the CTR_DRBG and HMAC modules relates to
NIST SP 800-90A. In particular CTR_DRBG requires an explicit nonce
to achieve a 256-bit strength if MBEDTLS_ENTROPY_FORCE_SHA256 is set.
1.2.0:
Added
Added support for Cloudflare's limited-scope API Tokens
Added support for $hostname in nginx server_name directive
Changed
Add directory field to error message when field is missing.
If MD5 hasher is not available, try it in non-security mode (fix for FIPS systems)
Disable old SSL versions and ciphersuites and remove SSLCompression off setting to follow Mozilla recommendations in Apache.
Remove ECDHE-RSA-AES128-SHA from NGINX ciphers list now that Windows 2008 R2 and Windows 7 are EOLed
Support for Python 3.4 has been removed.
Fixed
Fix collections.abc imports for Python 3.9.
More details about these changes can be found on our GitHub repo.
1.1.0:
Changed
Removed the fallback introduced with 0.34.0 in acme to retry a POST-as-GET request as a GET request when the targeted ACME CA server seems to not support POST-as-GET requests.
certbot-auto no longer supports architectures other than x86_64 on RHEL 6 based systems. Existing certbot-auto installations affected by this will continue to work, but they will no longer receive updates. To install a newer version of Certbot on these systems, you should update your OS.
Support for Python 3.4 in Certbot and its ACME library is deprecated and will be removed in the next release of Certbot. certbot-auto users on x86_64 systems running RHEL 6 or derivatives will be asked to enable Software Collections (SCL) repository so Python 3.6 can be installed. certbot-auto can enable the SCL repo for you on CentOS 6 while users on other RHEL 6 based systems will be asked to do this manually.
Update clamav to 0.102.2.
## 0.102.2
ClamAV 0.102.2 is a bug patch release to address the following issues.
- [CVE-2020-3123](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3123):
An Denial-of-Service (DoS) condition may occur when using the optional credit
card data-loss-prevention (DLP) feature. Improper bounds checking of an
unsigned variable resulted in an out-of-bounds read which causes a crash.
- Significantly improved scan speed of PDF files on Windows.
- Re-applied a fix to alleviate file access issues when scanning RAR files in
downstream projects that use libclamav where the scanning engine is operating
in a low-privelege process. This bug was originally fixed in 0.101.2 and the
fix was mistakenly omitted from 0.102.0.
- Fixed an issue wherein freshclam failed to update if the database version
downloaded is 1 version older than advertised. This situation may occur after
a new database version is published. The issue affected users downloading the
whole CVD database file.
- Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
The ReceiveTimeout had caused needless database update failures for users with
slower internet connections.
- Correctly display number of kilobytes (KiB) in progress bar and reduced the
size of the progress bar to accomodate 80-char width terminals.
- Fixed an issue where running freshclam manually causes a daemonized freshclam
process to fail when it updates because the manual instance deletes the
temporary download directory. Freshclam temporary files will now download to a
unique directory created at the time of an update instead of using a hardcoded
directory created/destroyed at the program start/exit.
- Fix for Freshclam's OnOutdatedExecute config option.
- Fixes a memory leak in the error condition handling for the email parser.
- Improved bound checking and error handling in ARJ archive parser.
- Improved error handling in PDF parser.
- Fix for memory leak in byte-compare signature handler.
- Updates to the unit test suite to support libcheck 0.13.
- Updates to support autoconf 2.69 and automake 1.15.
Special thanks to the following for code contributions and bug reports:
- Antoine Deschênes
- Eric Lindblad
- Gianluigi Tiesi
- Tuomo Soini
Upstream changes:
OpenDNSSEC 2.1.6 - 2020-02-11:
* OPENDNSSEC-913: verify database connection upon every use.
* OPENDNSSEC-944: bad display of date of next transition (regression)
* SUPPORT-250: missing signatures on using combined keys (CSK)
* OPENDNSSEC-945: memory leak per command to enforcer.
* OPENDNSSEC-946: unclean enforcer exit in case of certain config
problems.
* OPENDNSSEC-411: set-policy command to change policy of zone
(experimental). Requestes explicit enforce command to take effect.
snallygaster is a tool that looks for files accessible on web servers that
shouldn't be public and can pose a security risk.
Typical examples include publicly accessible git repositories, backup files
potentially containing passwords or database dumps. In addition it contains a
few checks for other security vulnerabilities.
Noteworthy changes in version 1.37:
* Fixes a build problems when using Gawk 5.0
* Fixes Bourne shell incompatibilities on Solaris.
* Improves cross-comiling support.
* On Windows strerror_s is now used to emulate strerror_r.
* New error codes to map SQLite primary error codes.
* Now uses poll(2) instead of select(2) in gpgrt_poll if possible.
* Fixes a bug in gpgrt_close.
* Fixes build problem under Cygwin.
* Fixes a few minor portability bugs.
* Version 3.6.12 (released 2020-02-01)
** libgnutls: Introduced TLS session flag (gnutls_session_get_flags())
to identify sessions that client request OCSP status request (#829).
** libgnutls: Added support for X448 key exchange (RFC 7748) and Ed448
signature algorithm (RFC 8032) under TLS (#86).
** libgnutls: Added the default-priority-string option to system configuration;
it allows overriding the compiled-in default-priority-string.
** libgnutls: Added support for GOST CNT_IMIT ciphersuite (as defined by
draft-smyshlyaev-tls12-gost-suites-07).
By default this ciphersuite is disabled. It can be enabled by adding
+GOST to priority string. In the future this priority string may enable
other GOST ciphersuites as well. Note, that server will fail to negotiate
GOST ciphersuites if TLS 1.3 is enabled both on a server and a client. It
is recommended for now to disable TLS 1.3 in setups where GOST ciphersuites
are enabled on GnuTLS-based servers.
** libgnutls: added priority shortcuts for different GOST categories like
CIPHER-GOST-ALL, MAC-GOST-ALL, KX-GOST-ALL, SIGN-GOST-ALL, GROUP-GOST-ALL.
** libgnutls: Reject certificates with invalid time fields. That is we reject
certificates with invalid characters in Time fields, or invalid time formatting
To continue accepting the invalid form compile with --disable-strict-der-time
(#207, #870).
** libgnutls: Reject certificates which contain duplicate extensions. We were
previously printing warnings when printing such a certificate, but that is
not always sufficient to flag such certificates as invalid. Instead we now
refuse to import them (#887).
** libgnutls: If a CA is found in the trusted list, check in addition to
time validity, whether the algorithms comply to the expected level prior
to accepting it. This addresses the problem of accepting CAs which would
have been marked as insecure otherwise (#877).
** libgnutls: The min-verification-profile from system configuration applies
for all certificate verifications, not only under TLS. The configuration can
be overriden using the GNUTLS_SYSTEM_PRIORITY_FILE environment variable.
** libgnutls: The stapled OCSP certificate verification adheres to the convention
used throughout the library of setting the 'GNUTLS_CERT_INVALID' flag.
** libgnutls: On client side only send OCSP staples if they have been requested
by the server, and on server side always advertise that we support OCSP stapling
(#876).
** libgnutls: Introduced the gnutls_ocsp_req_const_t which is compatible
with gnutls_ocsp_req_t but const.
** certtool: Added the --verify-profile option to set a certificate
verification profile. Use '--verify-profile low' for certificate verification
to apply the 'NORMAL' verification profile.
** certtool: The add_extension template option is considered even when generating
a certificate from a certificate request.
** API and ABI modifications:
GNUTLS_SFLAGS_CLI_REQUESTED_OCSP: Added
GNUTLS_SFLAGS_SERV_REQUESTED_OCSP: Added
gnutls_ocsp_req_const_t: Added
3.9.6:
Resolved issues
* Fix building of wheels for OSX by explicitly setting `sysroot` location.
3.9.5:
Resolved issues
* RSA OAEP decryption was not verifying that all ``PS`` bytes are zero.
* GH-372: fixed memory leak for operations that use memoryviews when `cffi` is not installed.
* Fixed wrong ASN.1 OID for HMAC-SHA512 in PBE2.
New features
* Updated Wycheproof test vectors to version 0.8r12.
In addition to about two years of changes, this contains notably the
following security fix:
When int is 32 bits wide (on 32-bit architectures like 386 and arm), an
overflow could occur, causing a panic, due to malformed ASN.1 being
passed to any of the ASN1 methods of String.
Tested on linux/386 and darwin/amd64.
This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof
test vectors.
pkgsrc changes:
Once again, the acme subdirectory was removed as it introduces a circular
dependency with go-net.
Prodded several times by ng0@
What's new:
* Fixed CVE-2019-18634, a buffer overflow when the "pwfeedback"
sudoers option is enabled on systems with uni-directional pipes.
* The "sudoedit_checkdir" option now treats a user-owned directory
as writable, even if it does not have the write bit set at the
time of check. Symbolic links will no longer be followed by
sudoedit in any user-owned directory. Bug #912
* Fixed sudoedit on macOS 10.15 and above where the root file system
is mounted read-only. Bug #913.
* Fixed a crash introduced in sudo 1.8.30 when suspending sudo
at the password prompt. Bug #914.
* Fixed compilation on systems where the mmap MAP_ANON flag
is not available. Bug #915.
RFC 8624 says "MUST NOT" for signing and "MAY" for sig-checking.
The sqlite3 change is related to the OpenDNSSEC v2 change, to be
consistent with the choice there.
PKGREVISION bumped.
build with qt5 5.14
All frameworks
Port from QRegExp to QRegularExpression
Port from qrand to QRandomGenerator
Fix compilation with Qt 5.15 (e.g. endl is now Qt::endl,
QHash insertMulti now requires using QMultiHash...)
Attica
Don't use a verified nullptr as a data source
Support multiple children elements in comment elements
Set a proper agent string for Attica requests
Baloo
Correctly report if baloo_file is unavailable
Check cursor_open return value
Initialise QML monitor values
Move URL parsing methods from kioslave to query object
Breeze Icons
Change XHTML icon to be a purple HTML icon
Merge headphones and zigzag in the center
Add application/x-audacity-project icon
Add 32px preferences-system
Add application/vnd.apple.pkpass icon
icon for ktimetracker using the PNG in the app repo, to be replaced
with real breeze SVG
add kipi icon, needs redone as a breeze theme svg [or just kill off kipi]
Extra CMake Modules
[android] Fix apk install target
Support PyQt5 compiled with SIP 5
Framework Integration
Remove ColorSchemeFilter from KStyle
KDE Doxygen Tools
Display fully qualified class/namespace name as page header
KCalendarCore
Improve README.md to have an Introduction section
Make incidence geographic coordinate also accessible as a property
Fix RRULE generation for timezones
KCMUtils
Deprecate KCModuleContainer
KCodecs
Fix invalid cast to enum by changing the type to int rather than enum
KCompletion
Deprecate KPixmapProvider
[KHistoryComboBox] Add method to set an icon provider
KConfig
kconfig EBN transport protocol cleanup
Expose getter to KConfigWatcher's config
Fix writeFlags with KConfigCompilerSignallingItem
Add a comment pointing to the history of Cut and Delete sharing a shortcut
KConfigWidgets
Rename "Configure Shortcuts" to "Configure Keyboard Shortcuts"
KContacts
Align ECM and Qt setup with Frameworks conventions
Specify ECM dependency version as in any other framework
KCoreAddons
Add KPluginMetaData::supportsMimeType
[KAutoSaveFile] Use QUrl::path() instead of toLocalFile()
Unbreak build w/ PROCSTAT: add missing impl. of KProcessList::processInfo
[KProcessList] Optimize KProcessList::processInfo
[KAutoSaveFile] Improve the comment in tempFileName()
Fix KAutoSaveFile broken on long path
KDeclarative
[KeySequenceHelper] Grab actual window when embedded
Add optional subtitle to grid delegate
[QImageItem/QPixmapItem] Don't lose precision during calculation
KFileMetaData
Partial fix for accentuated characters in file name on Windows
Remove unrequired private declarations for taglibextractor
Partial solution to accept accentuated characters on windows
xattr: fix crash on dangling symlinks
KIconThemes
Set breeze as default theme when reading from configuration file
Deprecate the top-level IconSize() function
Fix centering scaled icons on high dpi pixmaps
KImageFormats
pic: Fix Invalid-enum-value undefined behaviour
KIO
[KFilePlacesModel] Fix supported scheme check for devices
Embed protocol data also for Windows version of trash ioslave
Adding support for mounting KIOFuse URLs for applications that don't use KIO
Add truncation support to FileJob
Deprecate KUrlPixmapProvider
Deprecate KFileWidget::toolBar
[KUrlNavigator] Add RPM support to krarc:
KFilePlaceEditDialog: fix crash when editing the Trash place
Add button to open the folder in filelight to view more details
Show more details in warning dialog shown before starting a
privileged operation
KDirOperator: Use a fixed line height for scroll speed
Additional fields such as deletion time and original path are now
shown in the file properties dialog
KFilePlacesModel: properly parent tagsLister to avoid memleak.
HTTP ioslave: call correct base class in virtual_hook(). The
base of HTTP ioslave is TCPSlaveBase, not SlaveBase
Ftp ioslave: fix 4 character time interpreted as year
Re-add KDirOperator::keyPressEvent to preserve BC
Use QStyle for determining icon sizes
Kirigami
ActionToolBar: Only show the overflow button if there are visible
items in the menu
Don't build and install app templates on android
Don't hardcode the margin of the CardsListView
Add support for custom display components to Action
Let the other components grow if there's more things on the header
Remove dynamic item creation in DefaultListItemBackground
reintroduce the collapse button
Show application window icon on AboutPage
KItemModels
Add KColumnHeadersModel
KJS
Added tests for Math.exp()
Added tests for various assignment operators
Test special cases of multiplicate operators (*, / and %)
KNewStuff
Ensure the dialog title is correct with an uninitialised engine
Don't show the info icon on the big preview delegate
Support archive installs with adoption commands
Send along the config name with requests
KPeople
Expose enum to the metaobject compiler
KQuickCharts
Also correct the shader header files
Correct license headers for shaders
KService
Deprecate KServiceTypeProfile
KTextEditor
Add "line-count" property to the ConfigInterface
Avoid unwanted horizontal scrolling
KWayland
[plasmashell] Update docs for panelTakesFocus to make it generic
[plasmashell] Add signal for panelTakesFocus changing
KXMLGUI
KActionCollection: provide a changed() signal as a replacement for removed()
Adjust keyboard shortcut configuration window's title
NetworkManagerQt
Manager: add support for AddAndActivateConnection2
cmake: Consider NM headers as system includes
Sync Utils::securityIsValid with NetworkManager
Plasma Framework
[ToolTip] Round position
Enable wheel events on Slider {}
Sync QWindow flag WindowDoesNotAcceptFocus to wayland plasmashell interface
[calendar] Check out of bounds array access in QLocale lookup
[Plasma Dialog] Use QXcbWindowFunctions for setting window types Qt
WindowFlags doesn't know
[PC3] Complete plasma progress bar animation
[PC3] Only show progress bar indicator when the ends won't overlap
[RFC] Fix Display Configuration icon margins
[ColorScope] Work with plain QObjects again
[Breeze Desktop Theme] Add monochrome user-desktop icon
Remove default width from PlasmaComponents3.Button
[PC3 ToolButton] Have the label take into account complementary color schemes
Added background colors to active and inactive icon view
QQC2StyleBridge
[ToolTip] Round position
Update size hint when font changes
Solid
Display first / in mounted storage access description
Ensure mounted nfs filesystems matches their fstab declared counterpart
Sonnet
The signal done is deprecated in favour of spellCheckDone, now correctly emitted
Syntax Highlighting
LaTeX: fix brackets in some commands
TypeScript: add "bigint" primitive type
Python: improve numbers, add octals, binaries and "breakpoint" keyword
SELinux: add "glblub" keyword and update permissions list
Several enhancements to gitolite syntax definition
pkglint -r --network --only "migrate"
As a side-effect of migrating the homepages, pkglint also fixed a few
indentations in unrelated lines. These and the new homepages have been
checked manually.
