==============================================================================
* 1.11.3, 2005-06-08

### SECURITY BUGFIXES
- Fetchnews did not detect timeouts while it was downloading an article
  header, which malicious upstream servers could exploit to mount a denial of
  service attack against the fetchnews client. See leafnode-SA-2005-02.txt.
  CVE Name: CAN-2005-1911

### BUGFIXES
- Bugfix sed expression in makesubst script.  (Reported by Jeff Zacharias.)

### CHANGES
- texpire now tags the message.id expired count with "message.id" rather than
  "total:" to avoid misleading the user who assumes that "total:" would have
  to be the sum of the group counts. See also the FAQ change below.
  SourceForge bug #1215453.
- When debugmode and verbose mode are set, leafnode programs now print a
  warning to stdout that the user should check syslog.conf and the syslog
  output rather than the screen print for debugging and sleeps for three
  seconds.

### DOCUMENTATION
- Add FAQ entry to explain discrepancies between texpire group counts and
  message.id expired articles counts.
- Add FAQ entry to explain influence of Gnus' gnus-read-active-file setting 
  on lost subscriptions, and extend stop fetchnews from unsubscribing FAQ.
  Debian bug #307685.
- Drop FAQ entry on license issues as some parts of leafnode are in fact GPLd.
- Drop FAQ entry on why old articles aren't posted, obsolete since 1.9.33.
- INSTALL and INSTALL_de have been polished.
- Add a hint that syslog.conf must be edited to config.example.
- leafnode(8) mentions that LIST ACTIVE keeps an existing subscription fresh.

==============================================================================
* 1.11.2, 2005-05-04

### SECURITY BUGFIXES
For these two bugs together, the CVE Name is CAN-2005-1453.
For further cross-references, see
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1453>
- Fix fetchnews segfault when connection to server dies while fetchnews is
  reading an article body (use-after-free bug).  Regression introduced into
  leafnode v1.9.52.  Denial of service possible, see leafnode-SA-2005-01.txt.
- Fix fetchnews segfault when connection to server dies while fetchnews is
  reading an article header.  Regression in security fix of leafnode v1.9.48.
  Denial of service possible, see leafnode-SA-2005-01.txt

### BUGFIXES
- fetchnews will no longer re-fetch the active file for a server if it has been
  completely received even if fetching articles from this server encounters a
  problem.  Long-standing bug.  Debian bug #70052.
- fetchnews will now properly mark the active for complete re-fetch if it says
  so.  Previously, it forgot the mark in some circumstances.
- A problem fetching the active file or descriptions for a newly added server
  will now mark the active for re-fetch even if articles have successfully
  been retrieved from the same server.

### DOCUMENTATION
- Repair two lines in the German leafnode(8) manual page that became invisible
  as they ran together with a .PP macro.

==============================================================================
* 1.11.1, 2005-04-25

### BUGFIXES
- Fix pluralization bug in "n article[s] posted" message, Debian bug #303157.
- Fix other pluralization bugs.
- Update address of web site in pseudo article, reported by Daniel Zwick.

### PORTABILITY
- Backport leafnode-2 code to prefer /usr/xpg4/bin/id (if present) to
  /usr/bin/id, to improve portability to Solaris and avoid bogus warnings
  during ./configure.

### DOCUMENTATION
- Remove TODO file.
- Update documentation and addresses of mailing lists and web sites,
  there have been obsolete links around in code, pseudo article and
  documentation.
- Add missing IPv6 hints to README files.
- Add incompatibility hint WRT configuration parser to README files.
- Clarify differences between global and server-specific parameters
  in leafnode(8) manual pages.

==============================================================================
* 1.11.0, 2005-03-16

### INCOMPATIBLE BUGFIXES
- fetchnews now supports IPv6 (this causes the version bump to 1.11)
- the configuration parser now supports quoted strings on the right-hand
  side, so that "#" can be used in passwords. See the section
  CONFIGURATION in leafnode(8) for details.

### BUGFIX
- Fix snprintf test that caused leafnode to always use the local
  snprintf rather than the system's. Bug found by Bruno Rohee.
  Regression in leafnode-1.10.7, though with no user-visible effect.

==============================================================================
* 1.10.8, 2005-01-21

### BUGFIX
- Keep interesting groups interesting on LIST ACTIVE and GROUP even if
  they have no articles.  Reported by Brian Sammon.

==============================================================================
* 1.10.7, 2004-11-22

### BUGFIX
- The shipped snprintf function didn't report the proper size for
  literals. It now does. Report by Michael Buerle.
- Pull snprintf/vsnprintf replacements from the libc's name space,
  prefixing them with ln_ on linker level. This avoids our overriding
  libc's snprintf/vsnprintf which may cause bogus aborts when other
  parts of the libc (syslog for instance) use formatting characters that
  our minimal vsnprintf implementation does not support.
  Fixes an abort reported by Michael Buerle on a system that had
  a non-working snprintf function.

### CHANGE
- The "GROUP.NAME not found in groupinfo file" message will now only
  appear at verbose levels 2 and higher, to avoid uninteresting output
  when a group has just been deleted but is still in interesting.groups.
  Reported by Berthold Hllmann.

### INTERNAL
- The use of the shipped snprintf function for testing purposes can now
  be forced by running: env FORCE_SHIPPED_SNPRINTF=yes ./configure --opts

==============================================================================
* 1.10.6, 2004-09-22

### BUGFIX
- If a server that was configured with "noactive" was unavailable,
  fetchnews would still mark the active file for download. Patch by
  Brian Sammon.

### DOCUMENTATION
- History up to and including 1.9.54 has been split off into an OLDNEWS file.

==============================================================================
* 1.10.5, 2004-08-26

### BUGFIX
- classic delaybodymode (delaybody set, delaybody_in_situ unset) stored
  articles with inaccessible Message-ID file and caused duplicates.
  Reported by Til Schubbe.

==============================================================================
* 1.10.4, 2004-08-15

### CRITICAL BUGFIX
- Only texpire will now delete the message.id/DDD/mids files and only after it
  has the lock, to prevent premature (but reversible) expiry of message.id
  files followed by gazillions of relinks at the next texpire run.
  Bug located and fix tested by Rein Klazes, thanks a lot.

### CHANGES
- Make debug mode logging of texpire a bit more verbose, log the reason why a
  message.id file was unlinked.
- Minor internal cleanups to make the code a bit more efficient, reduced
  memory use in texpire a bit.

==============================================================================
* 1.10.3, 2004-07-28

### BUGFIX
- LIST and LIST ACTIVE reported "empty group" for pseudo groups, rather than
  a group with one article. Reported by Brian Sammon.

### COMPATIBILITY
- Also refresh newsgroup subscription if the newsreader uses LIST ACTIVE
  news.group (when news.group is not a pattern). Suggested by Brian Sammon.

==============================================================================
* 1.10.2, 2004-07-20

### BUGFIX
- Remove old .overview.?????? files from the spool, in order to avoid
  "cannot rmdir(/var/spool/news/group/name): Directory not empty" error.
  Reported by Johannes Berg, Debian Bug #257281.

==============================================================================
* 1.10.1, 2004-06-23

### BUGFIX
- Make sure that the overview (NOV, XOVER) does not cut off the Xref
  information. Regression in leafnode 1.9.50, older versions were fine.
  Reported by Jrg Lders after a thread in news.software.readers started by
  the pseudonymous SINNER.

### PORTABILITY
- the .spec file now lists BuildPrereq: libpcre.so.0 rather than pcre, to
  become independent of the actual package name, for Mandrake 10.0
  compatibility. Reported and fix tested by Kevin Bulgrien.

==============================================================================
* 1.10.0, 2004-06-10

### INCOMPATIBLE SOURCE-ONLY CHANGE
- PCRE was dropped from the distribution. If it does not come with your
  operating system, you can get it separately from http://www.pcre.org/

### BUGFIXES
- Bugfix: texpire could crash when expiring groups that are on disk but not
  longer in the active file. Reported by Johannes Berg, Debian bug #248824.
- Bugfix: texpire could crash when all-numeric name components were in the
  newsgroup name or in the path. Reported by Jos Mara Mateos.
- Bugfix: texpire memory leaks in error handling paths.
- Bugfix: print expiry time for groups that are no longer in the active file.
- Portability: fetchnews aborted on systems with a broken [v]snprintf
  function (such as FreeBSD 4.8 or 5.1) because it used the %p formatting that
  isn't supported by the replacement snprintf that leafnode uses on these
  systems. Fixes FreeBSD PR #67111, reported first by Jeff King.

==============================================================================
 vim:tw=78:
