# changelog

author: Joe Orton <jorton@redhat.com> - 2.0-2
changelog:
  - remove rh-java-common, fix rh-passenger40 (#1206567)
  - also restore newlines at EOF in templated files


author: Vít Ondruch <vondruch@redhat.com> - 1:4.1.5-5
changelog:
  - Fix Timing attack vulnerability in Action Controller.
    Resolves: CVE-2015-7576
  - Fix Possible Object Leak and Denial of Service attack.
    Resolves: CVE-2016-0751
  - Fix Possible Information Leak Vulnerability.
    Resolves: CVE-2016-0752
  - Fix Object leak vulnerability for wildcard controller routes.
    Resolves: CVE-2015-7581


author: Vít Ondruch <vondruch@redhat.com> - 1:4.1.5-6
changelog:
  - Fix Directory traversal and information leak in Action View.
    Resolves: CVE-2016-2097
  - Fix code injection vulnerability.
    Resolves: CVE-2016-2098


author: Vít Ondruch <vondruch@redhat.com> - 1:4.0.2-7
changelog:
  - Update the CVE-2016-2097 patch to the latest upstream version.
    Related: CVE-2016-2097
  - Update the CVE-2016-2098 patch to the latest upstream version.
    Related: CVE-2016-2098


author: Vít Ondruch <vondruch@redhat.com> - 2.6.6-1
changelog:
  - Updated to the latest upstream (#670589).
  - Removed flawed require check.
  - Removed obsolete BuildRoot.
  - Removed obsolete cleanup.
  - Package setup and test execution reworked.
  - Removed bindir magick.


author: Vít Ondruch <vondruch@redhat.com> - 0.5.0-1
changelog:
  - Update to i18n 0.5.0.
  - Documentation moved into subpackage.
  - Removed unnecessary cleanup.
  - Preparetion for test suite execution during build.


author: Vít Ondruch <vondruch@redhat.com> - 1.1-1
changelog:
  - Bump version.
  - Add -scldevel sub-package.
    Resolves: rhbz#1063297
  - Add -build package dependency on scl-utils-build.
    Resolves: rhbz#1058615
  - Add LICENSE, README and man page.
    Resolves: rhbz#1061459


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.448-41
changelog:
  - Use system libyaml for el7.
  - Fix build against OpenSSL with enabled ECC curves.
    * ruby-1.9.3-p482-Fix-build-against-OpenSSL-with-enabled-ECC-curves.patch
    - Resolves: rhbz#1026993
  - Fix test suite issue when compiling against glibc >= 2.17.
  - Workaround pkgconfig provides issue.


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.484-42
changelog:
  - Update to Ruby 1.9.3-p484.
    - Resolves: rhbz#1033904
  - Fix heap overflow in floating point parsing (CVE-2013-4164).
    - Resolves: rhbz#1033492
  - Allow MD5 in OpenSSL for tests.


author: Josef Stribny <jstribny@redhat.com> - 1.9.3.448-43
changelog:
  - Fix depending collections can't point into correct directory
    - Resolves: rhbz#1002434
  - Fix binary extensions cannot be loaded from an scl namespace other than ruby193
    - Resolves: rhbz#998845


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.484-49
changelog:
  - Explicitly depend on libyaml, to workaround issues with scl prefixed libyam.
    Resolves: rhbz#1070763


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.484-50
changelog:
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164004
  - Fix REXML billion laughs attack via parameter entity expansion
    (CVE-2014-8080).
    Related: rhbz#1164004
  - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
    Related: rhbz#1164004


author: Vít Ondruch <vondruch@redhat.com> - 1:3.2.8-7
changelog:
  - Fix i18n missing translation XSS.
    * rubygem-actionpack-3.2.16-CVE-2013-4491-Stop-using-i18ns-built-in-HTML-error-handling.patch
    - Resolves: CVE-2013-4491
  - Fix Action View DoS.
    * rubygem-actionpack-3.2.16-CVE-2013-6414-Only-use-valid-mime-type-symbols-as-cache-keys.patch
    - Resolves: CVE-2013-6414
  - Fix number_to_currency XSS.
    * rubygem-actionpack-3.2.16-CVE-2013-6415-Escape-the-unit-value-provided-to-number_to_currency.patch
    - Resolves: CVE-2013-6415
  - Fix unsafe query generation risk in Ruby on Rails (incomplete fix for
    CVE-2013-0155) (CVE-2013-6417).
    * rubygem-actionpack-3.2.16-CVE-2013-6417-Deep-Munge-the-parameters-for-GET-and-POST.patch
    - Resolves: CVE-2013-6417


author: Vít Ondruch <vondruch@redhat.com> - 1:3.2.8-14
changelog:
  - Fix Timing attack vulnerability in Action Controller.
    Resolves: CVE-2015-7576
  - Fix Possible Object Leak and Denial of Service attack.
    Resolves: CVE-2016-0751
  - Fix Possible Information Leak Vulnerability.
    Resolves: CVE-2016-0752


author: Vít Ondruch <vondruch@redhat.com> - 1:3.2.8-16
changelog:
  - Update the CVE-2016-2097 to the latest upstream version.
    Related: CVE-2016-2097
  - Update the CVE-2016-2098 patch to the latest upstream version.
    Related: CVE-2016-2098


author: Lukas Zapletal <lzap+rpm@redhat.com> - 1:3.2.8-7
changelog:
  - RHBZ#969448 - NULLS FIRST/LAST SQL statement fix for PostgreSQL
    - Resolves: rhbz#969486
  - Add BR: rubygem(json), since older version of RDoc does not pull it in.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 1:3.2.6-1
changelog:
  - Update to ActiveResource 3.2.6.
  - Removed no longer needed BuildRoot tag.
  - Run tests without Rake.
  - Introduce -doc subpackage.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 1:3.2.6-1
changelog:
  - Update to ActiveSupport 3.2.6.
  - Removed unneeded BuildRoot tag.
  - Tests no longer fail with newer versions of Mocha, remove workaround.


author: Vít Ondruch <vondruch@redhat.com> - 1.0.9-2
changelog:
  - More concise summary
  - Do not remove manpages, they are used internally
  - Added buildroot cleanup in clean section


author: Matthew Kent <mkent@magoazul.com> - 2.6.5-2
changelog:
  - Move file rename to build stage (#530275).
  - Simplify %check stage (#530275).
  - Remove disable of test_syntax2, fixed by new ruby build (#530275).


author: <Minnikhanov@gmail.com> - 2.2.15-2
changelog:
  - Fix Comment 18 #665560. https://bugzilla.redhat.com/show_bug.cgi?id=665560#c18 
  - Remove create Gemfile.lock at prep-section.


author: Vít Ondruch <vondruch@redhat.com> - 1.9.2-1
changelog:
  - Update to mongo 1.9.2.
  - Enabled test suite for non-SCL builds.
  - Import into ruby193 RHSCL.
    - Resolves: rhbz#1009573


author: Lubomir Rintel (Good Data) <lubo.rintel@gooddata.com> - 0.2.5-2
changelog:
  - Bring tests back
  - Depend on ruby(abi)
  - Replace defines with globals
  - Don't delete the world-writable file, fix permissions instead


author: Bohuslav Kabrda <bkabrda@redhat.com> - 1:1.4.0-1
changelog:
  - Update to Rack 1.4.
  - Moved gem install to %prep to be able to apply patches.
  - Applied two patches that fix test failures with Ruby 1.8.7-p357.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.2.6-1
changelog:
  - Update to Railties 3.2.6.
  - Move some files into -doc subpackage.
  - Remove the unneeded %defattr.
  - Introduce %check section (not running tests yet, as they are part of dependency loop).


author: Josef Stribny <jstribny@redhat.com> - 0.11.0-0.8.beta5
changelog:
  - Don't install v8 scl macros, they should come in v8 scldevel subpackage
    - Resolves: rhbz#1065887


author: Josef Stribny <jstribny@redhat.com> - 0.18.1-2
changelog:
  - Filter auto-generated requires from example .sh script included in tests
    - Related: rhbz#1063274


author: Bohuslav Kabrda <bkabrda@redhat.com> - 1.3.3-1
changelog:
  - Updated to tilt 1.3.3.
  - Removed patch that fixed BZ #715713, as it is a part of this version.
  - Excluded unnecessary files.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 1.3.3-2
changelog:
  - Rebuilt for Ruby 1.9.3.
  - Introduced %bootstrap macro to deal with dependency loop for BuildRequires.


author: Vít Ondruch <vondruch@redhat.com> - 1.1-1
changelog:
  - Bump version.
  - Drop rails dependencies.
    Resolves: rhbz#1056022
  - Add -build package dependency on scl-utils-build.
    Resolves: rhbz#1058616
  - Add LICENSE, README and man page.
    Resolves: rhbz#1061460


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.247-14
changelog:
  - Update to Ruby 2.0.0-p247 (rhbz#979605).
  - Fix CVE-2013-4073.
  - Fix for wrong makefiles created by mkmf (rhbz#921650).
  - Add support for ABRT autoloading.
  - Better support for build without configuration (rhbz#977941).
  - Fix RubyGems version.
  - Fix RubyGems search paths when building gems with native extension
    (rhbz#979133).
  - Fixes multilib conlicts of .gemspec files.
  - Make symlinks for psych gem to ruby stdlib dirs (rhbz#979133).
  - Use system-wide cert.pem.


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.247-15
changelog:
  - Fix depending collections can't point into correct directory
    - Resolves: rhbz#1034638
  - Fix binary extensions cannot be loaded from an scl namespace other than ruby200
    - Resolves: rhbz#1034639
  - Enable OpenSSL MD5 hashes for tests


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-16
changelog:
  - Update to Ruby 2.0.0-p353
    - Fixes heap overflow in floating point parsing (CVE-2013-4164)
    - Resolves: rhbz#1033906


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.353-22
changelog:
  - Fix RubyGems test suite.
    Resolves: rhbz#1069184
  - Do not use bundled libyaml.
    Resolves: rhbz#1069107


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.353-23
changelog:
  - Explicitly depend on libyaml, to workaround issues with scl prefixed libyam.
    Resolves: rhbz#1071347


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.353-24
changelog:
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164005
  - Fix REXML billion laughs attack via parameter entity expansion
    (CVE-2014-8080).
    Related: rhbz#1164005
  - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
    Related: rhbz#1164005


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.645-25
changelog:
  - Update to Ruby 2.0.0-p645.
    * Remove Patch18: ruby-2.0.0-p247-Revert-mkmf.rb-prefix-install_dirs-only-
         with-DESTDIR.patch; subsumed
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch23: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch29: ruby-2.0.0-p594-CVE-2014-8080-REXML-billion-laughs-
        attack.patch; subsumed
    * Remove Patch30: ruby-2.0.0-p598-CVE-2014-8090-REXML-incomplete-fix-for-
        CVE-2014-8080.patch; subsumed
    Resolves: rhbz#1070594


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Severin Gehwolf <sgehwolf@redhat.com> - 1-9
changelog:
  - Depend on minimal scl-utils version which contains
    the scl_source file.
  - Include release in requires for thermostat1-common.
  - Resolves: RHBZ#1051576


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.2-70.6
changelog:
  - Add sub-packages to list of obsoletes which are only carried
    in the RHEL-6-based collection.
  - Add scl-ized mvn() provides to list of obsoletes as well.
  - Resolves: RHBZ#1088188


author: Severin Gehwolf <sgehwolf@redhat.com> - 2.0-70.1
changelog:
  - Start RHSCL 2.0 development.
  - Don't use hard-coded collection names other than in BR.
  - Enable resolving from java common collection.
  - Also use maven30 collection rather than base maven.


author: Severin Gehwolf <sgehwolf@redhat.com> 0:3.6.0-10
changelog:
  - Upload new tarball for dev-tools as checksum could not be
    reproduced with given commands listed in comment.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.0.0-4
changelog:
  - Fix FTBFS since osgi()-style provides have been removed from
    SCL-ized deps.
  - Resolves: RHBZ#1045550


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.0.0-9
changelog:
  - Fix path to java and tools.jar in boot scripts.
  - Add sanity check for correct paths in boot scripts
    in check section.
  - Resolves: RHBZ#1053123 RHBZ#1052992


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.0.2-1
changelog:
  - Update to latest upstream release.
  - Also fixes RHBZ#1045016 (Keyring issue).
  - Require exact version of thermostat core in webapp subpackage.
  - Resolves: RHBZ#1064987


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-70.1
changelog:
  - Update to latest upstream bugfix release (v1.0.4).
  - Depend on mvn()-style auto-requires over manual requires.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-70.3
changelog:
  - Fix dangling symlinks for jline2, google-gson and apache-commons-fileupload
    dependencies.
  - Resolves: RHBZ#1119757


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.2.0-70.5
changelog:
  - Install setup complete stamp file for
    thermostat1-thermostat-storage.service
  - Resolves: RHBZ#1202300.


author: Jon VanAlten <jvanaltj@redhat.com> - 1.2.0-70.7
changelog:
  - Remove redundant symlinks to lucene jars
  - Resolves: RHBZ#1193828
  - Replace mongodb's deprecated userAdd with userCreate in thermostat-setup
  - Resolves: RHBZ#1193837


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.2.0-70.11
changelog:
  - Make deployment mechanism for the web endpoint using system
    tomcat work on RHEL-7.0 and RHEL-7.1. For RHEL-7.0 tomcat needs
    to get started via "service thermostat1-thermostat-tomcat start".
    On RHEL-7.1 it's "service tomcat@thermostat start".
  - Resolves: RHBZ#1215804


author: Akira TAGOH <tagoh@redhat.com> - 0.1-0.15.1617svn
changelog:
  - Update rpm macros to the latest guidelines.
  - Build against python26 for EPEL5.

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild


author: T.C. Hollingsworth <tchollingsworth@gmail.com> - 1:3.14.5.10-2
changelog:
  - backport fix for remote DoS or unspecified other impact via type confusion
    (RHBZ#991116; CVE-2013-2882)


author: Tomas Hrcka <thrcka@redhat.com> - 1:3.14.5.10-4
changelog:
  - multiple CVE fixes
  - CVE-2013-6639 CVE-2013-6640 CVE-2013-6650 
  - CVE-2013-6668 CVE-2014-1704 CVE-2014-5256


author: Tomas Hrcka <thrcka@redhat.com> - 1:3.14.5.10-7
changelog:
  - Backport api for aborting on uncaught exception
  - https://github.com/joyent/node/commit/fbff7054a47551387a99244e2cf0631f30406798


author: Tomas Hrcka <thrcka@redhat.com> - 1:3.14.5.10-8
changelog:
  - Backport Apply REPLACE_INVALID_UTF8 patch
  - https://github.com/joyent/node/commit/881ac26f27f4ac9585d66c8d8a67d5b246a23d1b


author: Tomas Hrcka <thrcka@redhat.com> - 1:3.14.5.10-9
changelog:
  - Include upstream patch: Meaningful name for builtins in JitCodeEvent API
  - https://github.com/joyent/node/commit/5a60e0d904c38c2bdb04785203b1b784967c870d


