# changelog

author: David Lanning <david.lanning@webpros.com> - 2.4.1-1.cp118
changelog:
  - Upstream update to 2.4.1-4 built into 2.4.1-1.cp118.
  - Remove xaps plugin which was vestigial at this point.


author: Andy Baugh <andy.baugh@webpros.com> - 2.4.1-4.cp130~el10
changelog:
  - Fix issue on debian where dsync symlink was still shipped
  - Fix issue on debian where devel files were shipped in main package


author: Todd Rinaldo <toddr@cpanel.net> 4.98.2-1.cp130
changelog:
  - Re-build for cp130
  - perl 5.42
  - U24/A10
  - Turn off external dep generator for this package.
  - Switch to sqlite3 from the distro.
  - Remove conditional init.d logic


author: Donald Holl <donald.holl@webpros.com> 4.98.2-2.cp130
changelog:
  - Rebuild for cPanel v130 to ensure AlmaLinux 10 (EL10) & Ubuntu 24 support
  - Fix sendmail wrapper compilation error on AlmaLinux 10 (EL10)


author: Sloane Bernstein <sloane.bernstein@webpros.com> - 4.98.2-3.cp130~el10
changelog:
  - Fix issue with Ubuntu package post-installation script only encountered in non-cPanel build environments.


author: Donald Holl <donald.holl@webpros.com> - 2.48.2-1.cp130~el10
changelog:
  - New upstream release
  - Fixes CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, CVE-2025-48386


author: Jason Kiniry <jason.kiniry@webpros.com> - 2.2.0.24-1.cp126
changelog:
  - Fixes CPANEL-46545
  - Fixes list message decoration for Japanese messages sent in Content-Transfer-Encoding: base64
  - Fixes list message decoration for unicode encoded messages sent in Content-Transfer-Encoding: 8bit
  - Fixes issue with sending messages to the list without a subject


author: Donald Holl <donald.holl@webpros.com> - 2.0.73-1.cp130~el10
changelog:
  - Rebuild for cPanel v130 to add AlmaLinux 10 & Ubuntu 24 support
  - Switch from Perl 5.36 to Perl 5.42
  - Remove conditional init.d script installation for legacy RHEL OSs < EL7


author: Donald Holl <donald.holl@webpros.com> - 3.09b-1.cp130~el10
changelog:
  - Rebuild for cPanel v130 to add AlmaLinux 10 & Ubuntu 24 support
  - Add patch to fix compilation failure on EL 10 derivatives.


author: Sloane Bernstein <sloane.bernstein@webpros.com> - 4.9.0-1.cp122
changelog:
  - Upstream update to version 4.9.0
  - Adjust TXT record handling fix: special SOA handling was not being applied.


author: Tim Mullin <tim@cpanel.net> - 5.36.0-4.cp108
changelog:
  - Added patches to address security vulnerabilities
  - CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property
  - CVE-2023-47039 - Perl for Windows binary hijacking vulnerability


author: Todd Rinaldo <toddr@cpanel.net> - 5.42.0-2.cp130~el10
changelog:
  - New Perl 5.42.0
  - Turn off 0009-Disable-xs-handshake.patch
  - Revert upstream error handling for perl IO


author: Sloane Bernstein <sloane.bernstein@webpros.com> - 3.098008-1.cp130
changelog:
  - Update DBI to 1.647
  - Update PerlIO::utf8_strict to 0.010
  - Update Template-Toolkit to 3.102
  - IO::CloseFDs for SpamAssassin


author: Tim Mullin <tim.mullin@webpros.com> - 8.3.12-1.cp118
changelog:
  - Upstream update to php 8.3.12
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Sloane Bernstein <sloane.bernstein@webpros.com> - 8.4.10-2.cp130~el10
changelog:
  - Clarify on AlmaLinux 10 that we want to build against libpq-devel rather than postgresql-private-devel.


author: Todd Rinaldo <todd.rinaldo@webpros.com> - 0.3.0-1.cp118
changelog:
  - feature: PHP8.2 ready
  - bugfix: scram-sha-224 broken #11
  - task: mark authentication methods cram-md5, digest-md5, and login as deprecated #11


author: Thomas "Andy" Baugh <andy.baugh@webpros.com> -5.2.2-3.cp110
changelog:
  - Patch file upload form JS to reject attempts to upload files larger than
    MAX_UPLOAD_SIZE and point them to the FAQ instead


author: David Lanning <david.lanning@webpros.com> - 1.23.1-1.cp130~el10
changelog:
  - Upstream Release Unbound 1.23.1
  - This security release fixes the Rebirthday Attack CVE-2025-5994.


