# changelog

author: fly_1997 <flylove7@outlook.com> -v2.1.1-1
changelog:
  - add hwprobe_analysis for RISC-V
  - fix error logger info
  - support kernel cluster scheduler
  - adapt for kylin-v10-sp3
  - realtime tune add new tuning item
  - fix smc insmod err
  - realtime tune skip grubby update
  - add hwprobe_tune hwprobe_ext_zbb_tune for RISC-V
  - add high_load value check


author: xu_ping <707078654@qq.com> - 3.24.0-1
changelog:
  - Upgrade version to 3.24.0
    * Add support for FIPS-session mode
    * Updates to harden against RSA timing attacks
    * Add option to show the master key verification patterns of secure keys
    * Add support for exporting a key or certificate as URI-PEM file
    * Performance improvements for attribute retrieval
    * Add support for SHA-2 mechanisms
    * Experimental support for IBM Dilithium via OpenSSL OQS provider
    * Support live guest relocation for protected key (PKEY) operations
    * Add support for CKA_ALWAYS_AUTHENTICATE
    * Add support for CKD_*_SP800 KDFs for ECDH
    * Add support for SHA based key derivation mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms
    * Add support for building Opencryptoki on the IBM AIX platform
    * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
    * Add support for protecting tokens with a token specific user group
    * Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
    * Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later


author: zhang_wenyu <zhang_wenyu@hoperun.com> - 3.25.0-1
changelog:
  - Upgrade version to 3.25.0
    * Add support for PKCS#11 v3.0 SHAKE key derivation
    * Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
    * Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
    * Add support for CCA AES CIPHER secure key types
    * Add support for the CKM_ECDH1_DERIVE mechanism
    * Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
    * Add support for the CKM_RSA_AES_KEY_WRAP mechanism
    * Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
    * Add a tool for import and exporting PKCS#11 keys to a KMIP server
    * Add support for opaque secure key blob import via C_CreateObject
    * Add support for key wrapping with AES-GCM
    * Add support for newer CCA versions on s390x and non-s390x platforms
    * Add support for CKM_AES_GCM (single-part operations only)


author: fly_fzc <2385803914@qq.com> - 1:3.0.12-32
changelog:
  - fix CVE-2025-15467,CVE-2025-69418,
        CVE-2025-69419,CVE-2025-69420,
        CVE-2025-69421,CVE-2026-22795,
        CVE-2026-22796


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: Funda Wang <fundawang@yeah.net> - 25.1-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: fix build with wrong permission
  - DESC: fix conflicts with protobuf2
  - DESC: revert:distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: yaoxin <yao_xin001@hoperun.com> - 6.4.1-1
changelog:
  - Update to 6.4.1
    * Parsing of the ``Transfer-Encoding`` header is now stricter.
    * Handling of whitespace in headers now matches the RFC more closely.
    * ``tornado.curl_httpclient`` now prohibits carriage return and linefeed headers in HTTP headers
    (matching the behavior of ``simple_httpclient``).


author: lipengyu <lipengyu@kylinos.cn> - 3.11.6-20
changelog:
  - Type:CVE
  - CVE:CVE-2025-13836 CVE-2025-13837 CVE-2025-12084
  - SUG:NA
  - DESC:fix CVE-2025-13836 CVE-2025-13837 CVE-2025-12084


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-59
changelog:
  - vfio: Fix CSV3 mapping device mmio issue
  - util/cacheflush: Make first DSB unconditional on aarch64
  - block: Zero block driver state before reopening
  - target/arm: Correct STRD atomicity
  - qemu-img: Fix amend option parse error handling
  - qemu-img rebase: don't exceed IO_BUF_SIZE in one operation
  - aio-posix: keep polling enabled with fdmon-io_uring.c


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-60
changelog:
  - qga: Fix truncated output handling in guest-exec status reporting
  - qga/installer: Remove QGA VSS if QGA installation failed
  - qga: Fix channel initialization check in run_agent_once
  - hw/rtc/goldfish: keep time offset when resetting
  - target/arm: Make DisasContext.{fp, sve}_access_checked tristate
  - net: parameterize the removing client from nc list
  - hid: fix incorrect return value for hid
  - util/qemu-timer.c: Don't warp timer from timerlist_rearm()
  - wdt_i6300esb: fix incorrect mask for interrupt type
  - target/arm: Correct LDRD atomicity and fault behaviour


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-61
changelog:
  - tracetool: fix usage of try_import()
  - gtk: Skip drawing if console surface is NULL
  - vfio/iommufd: Fix SIGSEV in iommufd_cdev_attach()
  - qmp: update vhost-user protocol feature maps
  - hw/intc/arm_gicv3_its: Zero initialize local DTEntry etc structs
  - hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  - replay: Improve assert in replay_char_read_all_load()
  - hw/scsi: Use error_setg_file_open() for a better error message
  - hw/virtio: Use error_setg_file_open() for a better error message
  - ui/vnc: Fix qemu abort when query vnc info


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-62
changelog:
  - iotests: Run iotests with sanitizers
  - tests/qemu-iotest: Add more image formats to the thorough testing
  - hw/intc: fix the issue of vNMI not supporting live migration
  - vfio/pci: VirtCCA adapt Ascend310P bar2 quirk.
  - vdpa:Set the vhostdev character of the VDPA device to the idstr assigned during migration
  - vdpa: Enable the ability of all VDPA devices to obtain backend config
  - hw/misc/psp.c: support live migrate for vpsp device
  - qga: ignore channel_init() fail if 'retry_path' is set
  - docs: fix typo in xive doc


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-63
changelog:
  - chardev/char-pty: Do not ignore chr_write() failures
  - hw/display/exynos4210_fimd: Remove duplicated definition
  - kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  - hw/vfio/hct: fix ci check_code issues
  - hw/vfio/hct: support abort migration when hct exception
  - hw/vfio/hct: fix virtual machine paused due to obtain VQ failed.
  - hw/vfio/hct: support live migration function for virtual machines.
  - hw/vfio/hct: support vfio-pci multiple processes.
  - hw/vfio/hct: support start with ccp.ko driver
  - hw/vfio/hct: remove the operation of reading the value of mdev index in qemu.
  - hw/vfio/hct: fix ccp index error caused by uninitialized buf
  - hw/vfio/hct: compatible with hct.ko modules in versions 0.5 and earlier.
  - hw/vfio/hct: sharing CCP resources between host and virtual machines.
  - aio-posix: fix spurious return from ->wait() due to signals
  - tests/unit: skip test-nested-aio-poll with io_uring
  - tests/qemu-iotests/184: Fix skip message for qemu-img without throttle
  - target/arm/cpu64: remove duplicate include
  - cxl/cdat: Fix header sum value in CDAT checksum
  - hw/virtio: Fix packed virtqueue flush used_idx


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-64
changelog:
  - arm/cpu: fix werrors if CONFIG_USER_ONLY was set
  - crypto/hash-gcrypt: Correct undeclared parameter
  - config/targets: update aarch64_be-linux-user gdb XML list
  - ub: add more check for arry to prevent mem overrun
  - backends: fix node id out of range when set proportion
  - ub: check kvm_usi_via_irqfd when set kvm interrupt
  - ub: fix some mem leak in handle_enum_query_request
  - ub: remove unused param in enum_query_get_max_num_ports
  - ub: fix possible mem overrun in fill_rq
  - ub: do size check for alloc idev ers addr
  - ub: dma memory read wirte with memory flag
  - ub: ummu mcmdq null cmd fix mem leak and enhace safe
  - ub: limits ummu kvtbl max entries to 1024
  - ub: fix some mem leak
  - ub: correct ub cfg setting and values
  - ub: support different versions of the UMMU chips
  - ub: fix compiling error if target is not aarch64


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-65
changelog:
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464)
  - io: release active GSource in TLS channel finalizer
  - io: move websock resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)
  - ub: correct cfg write access


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-66
changelog:
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665)
  - hw/intc/loongarch_ipi_kvm: Fix the bug where the VM would crash when performing save or resume operations.
  - cxl/cdat: Handle cdat table build errors
  - hw/virtio: Fix the de-initialization of vhost-user devices
  - ub: fix memory leak in double pointer


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-69
changelog:
  - Migration/urma:reduce plflash update time
  - Migration/urma:avoid clearing remote dirty bitmap after migration completes
  - Migration/urma:add detailed downtime statistics for live migration
  - Migration/urma:support jfr post list mode over URMA
  - Migration/urma:move registration and unregistration ram to thread
  - Migration/urma:Fix VM crash due to packet loss during URMA-based memory migration
  - target/i386: csv: Enhance get/release logic for shared memory region of CSV3 VM
  - target/i386: csv: Remove all nodes within dma unmapping addr range
  - vfio/container: unregister csv3 mmio listener in vfio_disconnect_container()
  - system/physmem: Try to use 2M THP if CSV3 guest RAM backend is memfd
  - target/i386: csv: Support issuing the LAUNCH_FINISH_EX API with host-data for CSV3 guest
  - target/i386: csv: Introduce host-data=str option
  - arm/vfio: provide a vfio-platform device type that supports passthrough of mmcd(MAMI config device) into virtual machines.
  - Migration/urma:fix memory leak caused by hashmap in urma migration
  - bugfix: add PAS_EXPANSION config to support mmcd device
  - ub: fix ub ers map failed 
  - ub: fix vm reset core when config vfio-ub device


author: fanmingzhan <fanmingzhan@h-partners.com> - 11:8.2.0-70
changelog:
  - vfio: fix tpm test case, align the hignmem_platform_bus parameter, and modify the pas_expansion assignment


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-71
changelog:
  - Revert "target/arm/kvm-rme: Add DMA remapping for the shared memory region"
  - arm/kvm-rme: Add support for hisi-cca huge page mapping method
  - arm/kvm-rme: Add device assignment method for cca realm vm
  - arm/kvm-rme: fix qom definition and update KVM_EXIT_ARM_RME_DEV value


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-72
changelog:
  - ub: don't check ers addr size is power of 2
  - ub: support process msg code exch
  - ub: replace malloc with g_malloc0
  - Migration/urma:explicitly set URMA JFS tp_type to URMA_CTP
  - MAINTAINERS: add me as maintainer to virtio-snd
  - virtio-snd: remove TODO comments
  - virtio-snd: handle 5.14.6.2 for PCM_INFO properly(CVE-2026-3196)
  - virtio-snd: fix max_size bounds check in input cb(CVE-2026-3195)
  - virtio-snd: tighten read amount in in_cb(CVE-2026-3195)
  - hw/arm: Close unreleased out_fault_fd
  - pci: avoid the info qtree crash caused by arm-smmuv3-accel


author: jinlun<jinlun@huawei.com> - 40.7-1
changelog:
  - update version to 40.7
    - Allow chronyd-restricted read chronyd key files
    - Allow systemd-sleep set attributes of efivarfs files
    - Make name_zone_t and named_var_run_t a part of the mountpoint attribute
    - Update cifs interfaces to include fs_search_auto_mountpoints()
    - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
    - Add map_read map_write to kernel_prog_run_bpf
    - Add policy for nvme-stas
    - Make new virt drivers permissive
    - Allow named and ndc use the io_uring api
    - Allow sssd send SIGKILL to passket_child running in ipa_otpd_t


author: xinghe <xingheyd@163.com> - 7:6.6-8
changelog:
  - Type:cves
  - ID:CVE-2026-33526 CVE-2026-33515 CVE-2026-32748
  - SUG:NA
  - DESC:fix CVE-2026-33526 CVE-2026-33515 CVE-2026-32748


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: openEuler <contact@openeuler.org> - 0.10.2-2
changelog:
  - Add internationalization support (currently supports English and Simplified Chinese)
  - Fix issue where settings page may reopen multiple times


author: openEuler <contact@openeuler.org> - 0.10.2-4
changelog:
  - Fix timeout when executing complex MCP tasks
  - Feature: Add login through browser (requires proper desktop environment)


author: openEuler <contact@openeuler.org> - 0.10.2-6
changelog:
  - installer: Add support for package name and alternative package name formats
  - cli: Fix TUI keyboard interaction issue in some environments


author: openEuler <contact@openeuler.org> - 2.0.0-3
changelog:
  - feat: Add Witty Assistant welcome screen & LOGO
  - refactor: Improve Markdown rendering performance in TUI


author: openEuler <contact@openeuler.org> - 2.0.1-1
changelog:
  - feat: Set defautl chat model during installation
  - feat: Add shell completion installation command
  - fix: Markdown rendering issue in TUI
  - chore: Remove deprecated scripts in installer


author: openEuler <contact@openeuler.org> - 2.0.2-1
changelog:
  - feat: Add option to launch OpenCode through Witty Assistant
  - installer: Install OpenCode-AI during deployment


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-42
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


