# changelog

author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.55.5-2.3
changelog:
  - Fix a bad integer conversion that interrupts valid coalesce calls on large VDIs
  - Add 0002-CP-308382-fix-sign-conversion-in-coalesce.patch
  - Add 0003-Fix-coalesced-size-conversion-in-vhd-util-coalesce.patch


author: Anthoine Bourgeois <anthoine.bourgeois@vates.tech> - 3.55.5-6.1
changelog:
  - Sync with 3.55.5-6
  - Revert openssl 3 dependency from XS specfile (no change compared to previous XCP-ng release)
  - Drop patch 0002-CP-308382-fix-sign-conversion-in-coalesce.patch, upstream now
  - Drop patch 0003-Fix-coalesced-size-conversion-in-vhd-util-coalesce.patch, upstream now
  - *** Upstream changelog ***
    * Thu Jul 31 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-6
    - Fix coalesced size conversion in vhd-util-coalesce (CP-308382)
    * Mon Jun 23 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-5
    - Backport fix for CA-408175
    - CP-308382: fix sign conversion in coalesce
    * Mon Apr 07 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-4
    - CP-54256: log when reporting EOPNOTSUPP
    * Fri Feb 21 2025 Deli Zhang <deli.zhang@cloud.com> - 3.55.5-3
    - CP-50273: Move CCM dependency to OpenSSL 3


author: Anthoine Bourgeois <anthoine.bourgeois@vates.tech> - 3.55.5-9.1
changelog:
  - Sync with 3.55.5-9
  - Drop patch 0002-Prevent-segfault-of-vhd-util-scan-on-VHD-with-corrup.patch, upstream now
  - *** Upstream changelog ***
    * Thu Apr 09 2026 Mark Syms <mark.syms@citrix.com> - 3.55.5-9
    - Remove old, obsolete, udev rule override.
    * Wed Jan 28 2026 Mark Syms <mark.syms@citrix.com> - 3.55.5-8
    - Prevent segfault of vhd-util scan on VHD with corrupt footer
    * Thu Aug 28 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-7
    - CA-416464: return BLKIF_RSP_EOPNOTSUPP for EOPNOTSUPP


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 20220801-1.7.4.1
changelog:
  - Sync with 20220801-1.7.4
  - *** Upstream changelog ***
  - * Fri Feb 02 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 20220801-1.7.4
  - - CA-388017: Fix most PixieFail vulnerabilities
  - - Fix CVE-2023-45229 - Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message
  - - Fix CVE-2023-45230 - Buffer overflow in the DHCPv6 client via a long Server ID option
  - - Fix CVE-2023-45231 - Out of Bounds read when handling a ND Redirect message with truncated options
  - - Fix CVE-2023-45232 - Infinite loop when parsing unknown options in the Destination Options header
  - - Fix CVE-2023-45233 - Infinite loop when parsing a PadN option in the Destination Options header
  - - Fix CVE-2023-45234 - Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message
  - - Fix CVE-2023-45235 - Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 20220801-1.7.5.1
changelog:
  - Sync with 20220801-1.7.5
  - *** Upstream changelog ***
  - * Wed Mar 20 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 20220801-1.7.5
  - - CA-390410: Disable some unneeded modules
  - - CA-390410: Downgrade some errors to warnings


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 20220801-1.7.7.1
changelog:
  - Sync with 20220801-1.7.7
  - *** Upstream changelog ***
  - * Thu Jun 06 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 20220801-1.7.7
  - - CA-388489: Fix CVE-2023-45236, CVE-2023-45237, and additional fix for CVE-2023-45229
  - * Tue May 14 2024 Deli Zhang <deli.zhang@cloud.com> - 20220801-1.7.6
  - - CP-46076: Support xs9 build


author: anthony.perard@vates.tech - 20220801-1.7.10.1
changelog:
  - Sync with edk2-20220801-1.7.10
  - *** Upstream changelog ***
  - * Wed Jun 11 2025 Fei Su <fei.su@cloud.com> - 20220801-1.7.10
  - - CA-410587 [XSI-1806] Fix 802.1Q Header Handling in OVS on XS8
  - * Fri Mar 07 2025 Deli Zhang <deli.zhang@cloud.com> - 20220801-1.7.9
  - - CP-53516: Add perl modules require for XS9 build
  - * Thu Oct 31 2024 Deli Zhang <deli.zhang@cloud.com> - 20220801-1.7.8
  - - CP-50542: Upgrade OpenSSL to 3.0.9
  - - CP-52657: Fix CVE-2024-6119


author: Thierry Escande <thierry.escande@vates.tech> - 20220801-1.7.11.1
changelog:
  - Sync with edk2-20220801-1.7.11
  - *** Upstream changelog ***
    * Mon Mar 09 2026 Ross Lagerwall <ross.lagerwall@citrix.com> - 20220801-1.7.11
    - CA-424506: Fix boot from physical CD/DVD drive


author: Thierry Escande <thierry.escande@vates.tech> - 4.19.19-8.0.42.1
changelog:
  - Sync with 4.19.19-8.0.42
  - *** Upstream changelog ***
    * Mon Apr 07 2025 Gerald Elder-Vass <gerald.elder-vass@cloud.com> - 4.19.19-8.0.42
    - XSI-1728: Avoid repeatedly emitting uevents for LUN changes on CHECK_CONDITION
    * Tue Feb 18 2025 Kevin Lampis <klampis@cloud.com> - 4.19.19-8.0.41
    - CP-51825: Add 50G/100G/200G ethtool link modes
    * Tue Feb 18 2025 Kevin Lampis <klampis@cloud.com> - 4.19.19-8.0.40
    - None
    * Thu Jan 09 2025 Gerald Elder-Vass <gerald.elder-vass@citrix.com> - 4.19.19-8.0.39
    - CA-401809: Resolve incorrect coverity warning
    - CA-404447: Improve logging for xhci failures


author: Thierry Escande <thierry.escande@vates.tech> - 4.19.19-8.0.43.1
changelog:
  - Sync with 4.19.19-8.0.43
  - *** Upstream changelog ***
   * Fri Jul 18 2025 Gerald Elder-Vass <gerald.elder-vass@cloud.com> - 4.19.19-8.0.43
   - CA-412882: Register NVMe ns_id attribute(s) as default sysfs groups
   - CA-360450: Fix deadlock on PCI passthrough


author: Quentin Casasnovas <quentin.casasnovas@vates.tech> - 4.19.19-8.0.44.1
changelog:
  - Sync with 4.19.19-8.0.44
  - *** Upstream changelog ***
    * Fri Oct 31 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.19.19-8.0.44
    - CA-399062: NFS timeout causes potential deadlock
    - CA-419803 / CA-419762: Backport patches to fix NBD disconnect crash


author: Thierry Escande <thierry.escande@vates.tech> - 4.19.19-8.0.45.1
changelog:
  - Sync with 4.19.19-8.0.45
  - Add missing patch for CVE-2020-14314 (use-after-free detected by Syzkaller)
  - *** Upstream changelog ***
    * Fri Feb 27 2026 Frediano Ziglio <frediano.ziglio@citrix.com> - 4.19.19-8.0.45
    - CA-400357: Use the correct MAC for rndis_host interfaces
    - CA-395473: Backport a patch to fix CVE-2020-14314
    - XSI-2150: Remove added chunk causing deadlock


author: Thierry Escande <thierry.escande@vates.tech> - 4.19.19-8.0.46.1
changelog:
  - Sync with 4.19.19-8.0.46
  - SUNRPC: Restore call to cancel_work_sync()
  - *** Upstream changelog ***
    * Thu Mar 19 2026 Frediano Ziglio <frediano.ziglio@citrix.com> - 4.19.19-8.0.46
    - XSI-2150: Avoid deadlocks on NFS spinlocks


author: Quentin Casasnovas <quentin.casasnovas@vates.tech> - 4.19.19-8.0.46.5
changelog:
  - Backport for CVE-2026-46300 (Fragnesia), iterative fixes to CVE-2026-43284
  - Backport for CVE-2026-46333 (ssh-key-sign, ptrace_may_dream)
  - Backport for CVE-2026-43494 (pintheft)


author: Daiki Ueno <dueno@redhat.com> - 4.5-1
changelog:
  - Resolves: rhbz#2017352 Rebase libreswan to 4.5
  - Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets


author: Daiki Ueno <dueno@redhat.com> - 4.9-1
changelog:
  - Resolves: rhbz#2128672 Rebase libreswan to 4.9
  - Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary


author: Sahana Prasad <sahana@redhat.com> - 4.9-2
changelog:
  - Fix CVE-2023-30570 Malicious IKEv1 Aggressive Mode packets can crash libreswan
  - Resolves: rhbz#2187179


author: David Morel <david.morel@vates.tech> - 4.12-2.3.1
changelog:
  - Sync with CentOS 8 Stream version 4.12-2.el8.3
  - Build with GCC 11
  - Include fix for CVE-2024-3652 from Alma 8


author: Thierry Escande <thierry.escande@vates.tech> - 1.44.3-1.1
changelog:
  - Fix build errors with gcc 4.8
  - Force use of protobuf system packages from XCP-ng repositories
  - Add conditions for protobuf Requires
  - Remove unneeded Requires for nodejs and BuildRequires for httpd and libpfm-devel
  - Add Requires for libyaml
  - Enable and start systemd service at install
  - Create netdata-ui subpackage
  - Add firewall rules management


author: Thierry Escande <thierry.escande@vates.tech> - 1.47.5-4.1
changelog:
  - Update to Netdata v1.47.5
  - Rework patch for gcc 4.8 build errors
  - Remove _vpath_builddir redefinition needed by cmake
  - Use update-alternatives to handle configuration files swap
  - Remove cap_setuid=pe for plugin files that have the setuid bit set
  - Use netdata.service file for systemd < 235
  - Replace 'ExecStop=sleep 3' in systemd service unit with a nicer script
  - *** Upstream changelog ***
  - * Thu Oct 24 2024 Didier Fabert <didier.fabert@gmail.com> 1.47.5-1
  - - Update from upstream
  - * Thu Oct 10 2024 Didier Fabert <didier.fabert@gmail.com> 1.47.4-1
  - - Update from upstream
  - * Wed Oct 02 2024 Didier Fabert <didier.fabert@gmail.com> 1.47.3-1
  - - Update from upstream
  - * Thu Sep 26 2024 Didier Fabert <didier.fabert@gmail.com> 1.47.2-1
  - - Update from upstream
  - * Tue Sep 10 2024 Didier Fabert <didier.fabert@gmail.com> 1.47.1-1
  - - Update from upstream
  - * Fri Aug 23 2024 Didier Fabert <didier.fabert@gmail.com> 1.47.0-1
  - - Update from upstream
  - * Thu Aug 22 2024 Didier Fabert <didier.fabert@gmail.com> 1.46.3-5
  - - Fix journald access
  -   See https://bugzilla.redhat.com/show_bug.cgi?id=2298058
  - * Thu Aug 15 2024 Didier Fabert <didier.fabert@gmail.com> 1.46.3-4
  - - Remove closed source parts from binary rpms
  -   See https://bugzilla.redhat.com/show_bug.cgi?id=2304167
  - * Wed Aug 07 2024 Didier Fabert <didier.fabert@gmail.com> 1.46.3-3
  - - Change BuildRequires from pkgconfig(libxenlight) and pkgconfig(libxenstat) to xen-devel package
  - - Enable go plugin only for Fedora 40+
  - * Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 1.46.3-2
  - - convert license to SPDX
  - * Fri Jul 26 2024 Didier Fabert <didier.fabert@gmail.com> 1.46.3-1
  - - Update from upstream
  - * Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.46.2-2
  - - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
  - * Mon Jul 15 2024 Didier Fabert <didier.fabert@gmail.com> 1.46.2-1
  - - Update from upstream
  - * Fri Jun 21 2024 Didier Fabert <didier.fabert@gmail.com> 1.46.1-1
  - - Update from upstream
  - - Disable go plugin for all builds
  - * Wed Jun 19 2024 Didier Fabert <didier.fabert@gmail.com> 1.46.0-1
  - - Update from upstream
  - * Thu Jun 06 2024 Didier Fabert <didier.fabert@gmail.com> 1.45.6-1
  - - Update from upstream
  - * Thu May 23 2024 Didier Fabert <didier.fabert@gmail.com> 1.45.5-1
  - - Update from upstream
  - * Thu May 09 2024 Didier Fabert <didier.fabert@gmail.com> 1.45.4-1
  - - Update from upstream
  - * Sat Apr 13 2024 Didier Fabert <didier.fabert@gmail.com> 1.45.3-1
  - - Update from upstream
  - * Fri Apr 05 2024 Didier Fabert <didier.fabert@gmail.com> 1.45.2-1
  - - Update from upstream
  - * Wed Mar 27 2024 Didier Fabert <didier.fabert@gmail.com> 1.45.1-1
  - - Update from upstream
  - * Thu Mar 21 2024 Didier Fabert <didier.fabert@gmail.com> 1.45.0-1
  - - Update from upstream


author: Vincent Michel <vincent.michel@vates.tech> - 1.47.5-4.3
changelog:
  - Fix the %patch macro in the specfile to be compatible with rpm 4.20 and above
  - Rebuild with openssl version 3


author: Alex Brett <alex.brett@cloud.com> - 7.4p1-23.1 + 0.10.3-2
changelog:
  - Imported openssh-7.4p1-23.el7_9 from CentOS, including:
  - Fix for CVE-2023-38408
  - Fix for CVE-2021-41617
  - Fix for CVE-2018-15473
  - Fix for CVE-2017-15906


author: Thierry Escande <thierry.escande@vates.tech> - 7.4p1-23.2.1 + 0.10.3-2.23.2.1
changelog:
  - Harden default ciphers and algorithms
  - Disable GSSAPIAuthentication in sshd_config
  - Remove build dependency on xauth (used for X11 forwarding not supported on XCP-ng hosts)
  - Make use of xcpng_subrel macro for versioning
  - Disable gnome_askpass
  - Add BuildRequires for gcc


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 7.4p1-23.3.1 + 0.10.3-2.23.3.1
changelog:
  - Sync with 7.4p1-23.3 + 0.10.3-2.23.3
  - *** Upstream changelog ***
  - * Tue Jul 02 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 7.4p1-23.3 + 0.10.3-2
  - - CP-50166: Remove libsystemd integration
  - - CA-395182: Fix CVE-2024-6387 - use of non-async-signal-safe fn in sighandler


author: Philippe Coval <philippe.coval@vates.tech> - 9.8p1-1.2.1
changelog:
  - Refresh XCP-ng patches:
    - Drop unnecessary hardening and gssapi patches
    - Replace CVE-2025-26465 backport with upstream patch from 9.9p1
  - Sync with 9.8p1-1.2
  - *** Upstream changelog ***
  - * Fri Nov 07 2025 Alex Brett <alex.brett@citrix.com> - 9.8p1-1.2
  - - CA-420416: Remove diffie-hellman-group14-sha1 KexAlgorithm
  - * Thu Jan 02 2025 Deli Zhang <deli.zhang@cloud.com> - 9.8p1-1.1
  - - CA-400917: Disable PerSourcePenalties
  - - CA-401322: Revert sshd.pam to xs8 default
  - - CA-401322: Ensure new config files applied
  - * Fri Sep 13 2024 Deli Zhang <deli.zhang@citrix.com> - 9.8p1-1
  - - CP-50298: Upgrade to version 9.8p1
  - * Wed Jul 31 2024 Lin Liu <lin.liu@citrix.com> - 8.8p1-3
  - - CP-50477: Customize ssh configurations
  - * Mon Sep 25 2023 Lin Liu <lin.liu@citrix.com> - 8.8p1-2
  - - CP-45435: Permit root ssh login
  - * Thu Jul 20 2023 Lin Liu <lin.liu@citrix.com> - 8.8p1-1
  - - First imported release


author: Lucas Ravagnier <lucas.ravagnier@vates.tech> - 9.8p1-1.2.3
changelog:
  - Add patch upstream log when refusing a certificate as dependency for CVE-2026-35414 patch
  - Fix CVE-2026-35414 (Bypass of authorized_keys)
  - Test for CVE-2026-35414 (with a fix for this test)
  - Fix ECDSA Bypass


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.9
changelog:
  - CA-391031: Reinstate rate limiting of RTC_CHANGE events
  - CA-391069: Avoid livelock due to buffered ioreqs


author: Yann Dirson <yann.dirson@vates.tech> - 4.2.1-5.2.12.1
changelog:
  - Sync with xs8 4.2.1-5.2.12, no code change, only rebuild against libjemalloc.so.2:
    * Fri Aug 02 2024 Stephen Cheng <stephen.cheng@cloud.com> - 4.2.1-5.2.12
    - CP-46112: Rebuild after new version of jemalloc

    * Fri Aug 02 2024 Stephen Cheng <stephen.cheng@cloud.com> - 4.2.1-5.2.11
    - CP-46112: Rebuild with new version of jemalloc


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 4.2.1-5.2.14.1
changelog:
  - Sync with 4.2.1-5.2.14
  - Remove 0001-nvme-Don-t-check-NSID-in-NVME_VOLATILE_WRITE_CACHE.patch in favor of XenServer's fix
  - *** Upstream changelog ***
    * Wed Oct 15 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.14
    - CA-418876: Fix NVMe namespace indexing

    * Thu Oct 02 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.13
    - CA-417654: Fix NVME bug which causes WS2025 install failures


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 4.2.1-5.2.15.1
changelog:
  - Sync with 4.2.1-5.2.15
  - *** Upstream changelog ***
    * Thu Oct 23 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.2.1-5.2.15
    - Allow passthrough of devices from a PCI segment different than 0.


author: Quentin Casasnovas <quentin.casasnovas@vates.tech> - 4.2.1-5.2.17.1
changelog:
  - Sync with 4.2.1-5.2.17
  - *** Upstream changelog ***
    * Thu Jan 08 2026 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.17
    - CA-407410: qmp: Fix race causing events to be sent during negotiation
    * Mon Dec 01 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.16
    - CA-420202: xen-hvm: Handle framebuffer relocation


author: Thierry Escande <thierry.escande@vates.tech> - 4.2.1-5.2.18.1
changelog:
  - Sync with 4.2.1-5.2.18
  - *** Upstream changelog ***
    * Thu Feb 26 2026 Frediano Ziglio <frediano.ziglio@citrix.com> - 4.2.1-5.2.18
    - CA-422649: xen: mapcache: Fix finding matching entry


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.2.0-2.1
changelog:
  - Sync with 1.2.0-2
  - *** Upstream changelog ***
  - * Fri Jan 26 2024 Andrew Cooper <andrew.cooper3@citrix.com> - 1.2.0-2
  - - Rebuild against libxenstore.so.4


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-2.2
changelog:
  - Auth: Add support to make KEK and DB files optional
  - Auth: Enable AUTH_ONLY_PK_REQUIRED build macro


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-2.3
changelog:
  - Remove generation and installation of KEK and db files
  - Add helper script to remove pem file from source archive
  - Update source archive with pem files removed


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 1.2.0-2.4
changelog:
  - Add gen-sbvar.py
  - Add self-signed PK.auth blob
  - Generate {KEK,db,dbx}.auth using gen-sbvar.py
  - Update secureboot-certs to take builtin KEK/db/dbx
  - Update Secure Boot certs from microsoft/secureboot_objects@3f69ef4


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-3.1
changelog:
  - Sync with 1.2.0-3
  - *** Upstream changelog ***
    * Wed Jan 22 2025 XenServer Rebuild <rebuild@xenserver.com> - 1.2.0-3
    - Add yangtze release branch
    - CP-53310: XenServer 9 rebuild


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 1.2.0-3.4
changelog:
  - Fix owner GUID of EFI_SIGNATURE_DATA structures
  - Restore dbx generation
  - Update dbx info to microsoft/secureboot_objects@e64d1a5c89e5 (v1.6.1)
  - Add fix-efivars.py script


author: Andriy Sultanov <andriy.sultanov@vates.tech> - 1.3.1-2.1
changelog:
  - Sync with 1.3.1-2
  - *** Upstream changelog ***
    * Mon Jan 12 2026 Andrew Cooper <andrew.cooper3@citrix.com> - 1.3.1-2
    - Fix for XSA-478 / CVE-2025-58151

    * Thu Nov 13 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 1.3.1-1
    - CA-419599: Check DATA_LIMIT when appending

    * Mon Oct 06 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 1.3.0-1
    - CP-309775: Add new Microsoft certificates
    - Fix varstore-sb-state exit code
    - Don't fail setup_keys if the optional dbx is missing


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 1.3.2-2.1
changelog:
  - Sync with 1.3.2-2
  - No change in auth data
  - *** Upstream changelog ***
    * Wed Apr 08 2026 Alex Brett <alex.brett@citrix.com> - 1.3.2-2
    - CP-311096: Use pre-signed auth data

    * Fri Mar 20 2026 Stephen Cheng <stephen.cheng@citrix.com> - 1.3.2-1
    - CP-311837: Add -g option for GUID in create-auth
    - CP-311836: Support detached signatures in create-auth utility
    - Remove xsa478.patch since the fix is now in upstream


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 26.1.3-1.4
changelog:
  - Switch to optimized data cluster format for VHD and QCOW,
    reducing memory consumption on QCOW import


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 26.1.3-1.6
changelog:
  - When exporting QCOW2-backed VDIs, read headers of the whole snapshot chain
  - Fix duplicated chunks during VM export resulting in an invalid XVA


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 26.1.3-1.10
changelog:
  - Fix for expiring sessions breaking long migrations
  - More fixes for XSA-489 (CVE-2026-23562, CVE-2026-42486)


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 26.1.4-3.1
changelog:
  - Update to upstream 26.1.4-3
  - *** Upstream changelog ***
    * Wed Apr 29 2026 Rob Hoes <rob.hoes@citrix.com> - 26.1.4-3
    - Final security patch from xapi-89

    * Fri Apr 24 2026 Rob Hoes <rob.hoes@citrix.com> - 26.1.4-2
    - Security patches from xapi-89

    * Fri Mar 06 2026 Rob Hoes <rob.hoes@citrix.com> - 26.1.4-1
    - XSI-2155: keep track of outstanding domain builds in NUMA placement
    - CA-424055: NUMA: avoid using up the entire memory on node0


