# changelog

author: vzhestkov@suse.com
changelog:
  - Add python3.11 as preferable for salt-ssh to avoid tests fails
  - Added:
    * add-python3.11-as-preferable-for-salt-ssh-to-avoid-t.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Fix known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  - Added:
    * allow-libgit2-to-guess-sysdir-homedir-successfully-b.patch


author: vzhestkov@suse.com
changelog:
  - Use versioned python interpreter for salt-ssh
  - Added:
    * use-versioned-python-interpreter-for-salt-ssh.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Fix payload signature verification on Tumbleweed (bsc#1251776)
  - Added:
    * do-not-break-signature-verification-on-latest-m2cryp.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Fix Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    * Use external tornado on Python > 3.11
    * Make tls and x509 to use python-cryptography
    * Remove usage of spwd
  - Added:
    * fix-salt-for-python-3.11.patch


author: marek.czernek@suse.com
changelog:
  - Fix TLS and x509 modules for OSes with older cryptography module
  - Added:
    * fix-tls-and-x509-modules-for-older-cryptography-modu.patch


author: alexander.graul@suse.com
changelog:
  - Add minimum_auth_version to enforce security (CVE-2025-62349)
  - Backport security fixes for vendored tornado
    * BDSA-2024-3438
    * BDSA-2024-3439
    * BDSA-2024-9026
  - Junos module yaml loader fix (CVE-2025-62348)
  - Added:
    * backport-3006.17-security-fixes-739.patch


author: marek.czernek@suse.com
changelog:
  - Use internal deb classes instead of external aptsource lib
    * Drop dependency on saltbundlepy-apt
  - Speed up wheel key.finger call (bsc#1240532)
  - Add security patches (bsc#1254903,bsc#1254905,bsc#1254904)
  - Simplify and speed up utils.find_json function (bsc#1246130)
  - Added:
    * use-internal-salt.utils.pkg.deb-classes-instead-of-a.patch
    * speedup-wheel-key.finger-call-bsc-1240532-713.patch
    * fixes-for-security-issues-cve-2025-13836-cve-2025-67.patch
    * simplify-utils.json.find_json-function.patch
  - Modified:
    * include-deb


author: marek.czernek@suse.com
changelog:
  - Make syntax in httputil_test compatible with Python 3.6
  - Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
  - Added:
    * fix-tornado-s-httputil_test-syntax-for-python-3.6.patch
    * backport-add-maintain-m-privilege-to-postgres-module.patch


author: alexander.graul@suse.com
changelog:
  - CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
  - Backport security fixes for vendored tornado
    * BDSA-2024-3438
    * BDSA-2024-3439
    * BDSA-2024-9026
  - CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)
  - Added:
    * backport-3006.17-security-fixes-739.patch


author: marek.czernek@suse.com
changelog:
  - Use internal deb classes instead of external aptsource lib
    * Drop dependency on saltbundlepy-apt
  - Speed up wheel key.finger call (bsc#1240532)
  - Backport security patches for Salt vendored tornado:
    * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
    * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
    * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
  - CVE-2025-13836: limit http.client response read in NXOS modules
  - Simplify and speed up utils.find_json function (bsc#1246130)
  - Added:
    * use-internal-salt.utils.pkg.deb-classes-instead-of-a.patch
    * speedup-wheel-key.finger-call-bsc-1240532-713.patch
    * fixes-for-security-issues-cve-2025-13836-cve-2025-67.patch
    * simplify-utils.json.find_json-function.patch
  - Modified:
    * include-deb


author: vzhestkov@suse.com
changelog:
  - Fix the issue preventing SELinux profile to be loaded on SLES 16
    deployed using cloud images (bsc#1258957)


author: vzhestkov@suse.com
changelog:
  - Add x86_64_v2 as a possible rpm package architecture
  - Make users with backslash working for salt-ssh (bsc#1254629)
  - Fix ansible.playbooks extra-vars quoting (bsc#1257831)
  - Fix virtualenv call in test helper to use proper python version
  - Added:
    * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
    * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
    * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
    * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch


author: vzhestkov@suse.com
changelog:
  - Backport security patch for Salt vendored tornado (bsc#1259554):
    * CVE-2026-31958: Add limits on multipart form data parsing
  - Added:
    * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch


author: marek.czernek@suse.com
changelog:
  - BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
  - Read full URI from ldap pillar config (bsc#1254900)
  - Added:
    * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
    * read-full-uri-from-ldap-pillar-config-753.patch


author: vzhestkov@suse.com
changelog:
  - Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  - Added:
    * use-non-vendored-tornado-with-python-3.11.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Add 'show_changes' arg to 'file.append/file.prepend" states
  - Added:
    * add-show_changes-to-file.append-and-file.prepend-sta.patch


author: yeray.gutierrez@suse.com
changelog:
  - Calculate UUID grain for Xen PV guests (bsc#1255418)
  - Added:
    * calculate-uuid-grain-for-xen-pv-guests-759.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Fix deprecation warnings when running on Python 3.13
  - Added:
    * fix-deprecation-warnings-when-running-on-python-3.13.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Fix ImportError during reentrant SIGTERM shutdown
  - Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
  - Added:
    * fix-importerror-during-reentrant-sigterm-shutdown.patch
    * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Fix refresh of osrelease and related grains on Python 3.10+
  - Added:
    * fix-refresh-of-osrelease-and-related-grains-on-pytho.patch


author: vzhestkov@suse.com
changelog:
  - Make the path to venvjail track file calculable to prevent fails
    with some new build targets like openSUSE Tumbleweed.


author: marek.czernek@suse.com
changelog:
  - Fix Ubuntu 24.04 edge-case test failures
  - Added:
    * fix-ubuntu-24.04-specific-failures-716.patch


author: vzhestkov@suse.com
changelog:
  - Fix VIRTUAL_ENV variable in activate file to point to actual path
  - Fix the bundle path in pyvenv.cfg


author: pablo.suarezhernandez@suse.com
changelog:
  - Add subsystem filter to udev.exportdb (bsc#1236621)
  - tornado.httputil: raise errors instead of logging in
    multipart/form-data parsing (CVE-2025-47287, bsc#1243268)
  - Added:
    * add-subsystem-filter-to-udev.exportdb-bsc-1236621-71.patch
    * fix-of-cve-2025-47287-bsc-1243268-718.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Several fixes for security issues
    (bsc#1244561, CVE-2024-38822)
    (bsc#1244564, CVE-2024-38823)
    (bsc#1244565, CVE-2024-38824)
    (bsc#1244566, CVE-2024-38825)
    (bsc#1244567, CVE-2025-22240)
    (bsc#1244568, CVE-2025-22236)
    (bsc#1244570, CVE-2025-22241)
    (bsc#1244571, CVE-2025-22237)
    (bsc#1244572, CVE-2025-22238)
    (bsc#1244574, CVE-2025-22239)
    (bsc#1244575, CVE-2025-22242)
    * Request server hardening
    * Prevent traversal in local_cache::save_minions
    * Add test and fix for file_recv cve
    * Fix traversal in gitfs find_file
    * Fix traversal in salt.utils.virt
    * Fix traversal in pub_ret
    * Reasonable failures when pillars timeout
    * Make send_req_async wait longer
    * Remove token to prevent decoding errors
    * Fix checking of non-url style git remotes
    * Allow subdirs in GitFS find_file check
  - Added:
    * several-fixes-for-security-issues.patch


author: pablo.suarezhernandez@suse.com
changelog:
  - Prevent tests failures when pygit2 is not present
  - Added:
    * fix-tests-issues-in-salt-shaker-environments-721.patch


author: vzhestkov@suse.com
changelog:
  - Use more strict way to fix shebang in the bundle scripts
  - Remove unused activate script (bsc#1245740)
  - Filter out zero-length check as the empty files are expected there
  - Filter out env-script-interpreter for ssh-id-wrapper as not used
    with the Salt Bundle, but present inside the salt module
  - Modified:
    * venv-salt-minion-rpmlintrc


author: vzhestkov@suse.com
changelog:
  - Improve SL Micro 6.2 detection with grains
  - Fix functional.states.test_user for SLES 16 and Micro systems
  - Fix the tests failing on AlmaLinux 10 and other clones
  - Add `minion_legacy_req_warnings` option to avoid noisy warnings
  - Added:
    * improve-sl-micro-6.2-detection-with-grains.patch
    * fix-functional.states.test_user-for-sles-16-and-micr.patch
    * fix-the-tests-failing-on-almalinux-10-and-other-clon.patch
    * add-minion_legacy_req_warnings-option-to-avoid-noisy.patch


