From f860f0cff8d5766774481bbb105233d201569b80 Mon Sep 17 00:00:00 2001 From: pulpbot Date: Tue, 3 Nov 2026 03:12:38 +0000 Subject: [PATCH] Update Changelog --- CHANGES.md | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index f3d8754c..a321136c 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -8,6 +8,20 @@ [//]: # (towncrier release notes start) +## 3.38.0 (2026-11-02) {: #3.38.0 } + +#### Features {: #3.38.0-feature } + +- Added custom (non-PEP 740) support for verifying attestations signed with a per-domain public key configured via `ATTESTATION_VERIFICATION_KEYS`. + [#1340](https://github.com/pulp/pulp_python/issues/1340) + +#### Bugfixes {: #3.38.0-bugfix } + +- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871 +- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings. + +--- + ## 3.37.1 (2026-10-08) {: #3.37.1 } #### Bugfixes {: #3.37.1-bugfix } @@ -37,6 +51,14 @@ --- +## 3.36.5 (2026-11-02) {: #3.36.5 } + +#### Bugfixes {: #3.36.5-bugfix } + +- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings. + +--- + ## 3.36.4 (2026-10-08) {: #3.36.4 } #### Bugfixes {: #3.36.4-bugfix } @@ -272,6 +294,14 @@ --- +## 3.27.8 (2026-11-02) {: #3.27.8 } + +#### Bugfixes {: #3.27.8-bugfix } + +- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings. + +--- + ## 3.27.7 (2026-10-08) {: #3.27.7 } #### Bugfixes {: #3.27.7-bugfix } @@ -534,6 +564,14 @@ --- +## 3.19.6 (2026-11-02) {: #3.19.6 } + +#### Bugfixes {: #3.19.6-bugfix } + +- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings. + +--- + ## 3.19.5 (2026-10-08) {: #3.19.5 } #### Bugfixes {: #3.19.5-bugfix }