# changelog

author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.0-1
changelog:
  - Implement Resident Mode Scan (DEF-9194)
  - Add Detached Scan (DEF-9169)
  - Smart scan should be disabled by default (DEF-9448)
  - Add timestamp to scan results (DEF-9464)
  - Optimize file reading approach (DEF-9486)
  - Fixed: Ai-bolit is not showing signature name ("sn") (DEF-9634)
  - Deobfuscator improved.
  - Fixed minor bugs.


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.1.5-1
changelog:
  - Fixed: the cloudscan-size parameter doesn't work properly (DEF-9928)
  - Fixed: PHPMailer is incorrectly detected as vulnerable (DEF-9859)


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.0-2
changelog:
  - Implement Resident Mode Scan (DEF-9194)
  - Add Detached Scan (DEF-9169)
  - The watchdog continuously kills ai-bolit (DEF-9943)


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.1-1
changelog:
  - Fixed: Bitrix file is removed instead of cleaning (DEF-10052)
  - Fixed: Unexpected detection behavior (DEF-9950)


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.2-1
changelog:
  - Detect ELF (binary) Executables as malicious ones (DEF-8992)
  - Smart scan should be disabled by default (DEF-9448)
  - Add timestamp to scan results (DEF-9464)
  - Optimize file reading approach (DEF-9486)
  - Fixed: Too much memory used in new version of aibolit-hoster (DEF-9582)
  - Need to add suspicious tracking in console progress (DEF-9659)
  - Detect ELF (binary) Executables as suspicious ones (DEF-9818)
  - Fixed: The --cloudscan-size doesn't work for single file scannig (DEF-9928)
  - Fixed: procu2.php goes to infinite loop while trying to clean samples with mixture of obfuscation and $_POST (DEF-10216)
  - Improved deobfuscation algorithms.
  - Fixed many other minor bugs.


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 4.4.3-1
changelog:
  - Improve deobfuscator (DEF-10368)
  - Limit max size to scan for all modes (DEF-10436)
  - Find EICAR in smart mode (DEF-10248)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 4.4.4-1
changelog:
  - Improve deobfuscator (DEF-10558)
  - Fixed segmentation fault on PHP 5.6 (DEF-10519)
  - Added support for new HashAPI format for CloudAssist (DEF-10469)
  - Fixed not working --addprefix --noprefix options (DEF-10460)
  - Added log options for ai-bolit resident mode (DEF-10418)
  - Turn off vulnerabilities detection if CMSDetector instance not initialized (DEF-10414)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0116-1
changelog:
  - Fixed garbage in system logs (DEF-10943)
  - Added samples to deobfuscator (DEF-10818, DEF-10757, DEF-10728, DEF-10608, DEF-10603)
  - Removed rules for detect elFinder vulnerability (DEF-10450)
  - Added convertor regular expression before search in deobfuscating code (DEF-10729)
  - Fixed aibolit normalization (DEF-10896, DEF-10609, DEF-10686)
  - Added test for check cleanup malware SMW-SA-13323-php.phish-6 (DEF-10740)
  - Changed normalization in procu2 as used in aibolit (DEF-10717)
  - Created Jenkins job to test integration with IM360 (DEF-10573)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0207-1
changelog:
  - Added new filter option in the scan (DEF-10676) 
  - Fixed a bug in RapidScan (DEF-11212) 
  - Reduced of disk reads (DEF-10611) 
  - Fixed bugs and improved the normalization file (DEF-11124, DEF-10886) 
  - Fixed bug in detached mode (DEF-11083) 
  - Improved deobfuscator (DEF-11142, DEF-10938, DEF-10895, DEF-10940) 
  - Fixed procu2 bug (DEF-10387) 
  - Changed the data transfer protocol for CloudAssisted (DEF-10771) 
  - Added script to gather statistics after the fall of ai-bolit (DEF-10438) 
  - Improved cleanup process (DEF-10849)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 20.0225-1
changelog:
  - Use php_strip_whitespace via stream wrapper to get normalization of custom string (DEF-11198)
  - Added check normalized->deobfuscated version of file for standalone signatures in procu2 (DEF-11244)
  - Fix bug in finder implementation follow dir symlink - by default (DEF-11377)
  - Improved deobfuscator (DEF-11367, DEF-11395)
  - Add alias for param --quite as --quiet (DEF-11243)
  - Fix SIGBUS error (DEF-11343)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0312-1
changelog:
  - Improved deobfuscator (DEF-11495, DEF-11442)
  - Integrated finder implementation in aibolit (DEF-11406, DEF-11414)
  - Added executable bit to Go wrapper (DEF-11530)
  - Fixed detached mode scan for empty folder (DEF-11502)
  - Fixed files counter for resident mode (DEF-11508)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0323-1
changelog:
  - Improved deobfuscator (DEF-11523, DEF-11534, DEF-11541, DEF-11570)
  - Fixed UTF-16, UTF-32 support for procu2 (DEF-11553)
  - Fixed UTF32-BOM encoding detect (DEF-11552)
  - Fixed scan list preparation (DEF-11563, DEF-11606)
  - Fixed go-wrapper (DEF-11542, DEF-11543)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0403-1
changelog:
  - Improved deobfuscator (DEF-11737, DEF-11706, DEF-11677, DEF-11642)
  - Improved debug info (DEF-11545, DEF-11609)
  - Added new filter for little files (DEF-10576)
  - Fixed using shared memory in go-wrapper (DEF-11739)
  - Fixed deobfuscator (DEF-11645)
  - Fixed skip option in finder (DEF-11730)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0408-1
changelog:
  - Improved deobfuscator (DEF-11804)
  - Added sqlite and pdo dependencies
  - Fixed cleanup (DEF-11823)
  - Fixed deobfuscator (DEF-11805)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0414-1
changelog:
  - Fixed cleanup (DEF-11901)
  - Fixed using shared memory in go-wrapper (DEF-11739)
  - Added common exclude list for scan (DEF-11832)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0429-1
changelog:
  - Improved deobfuscator (DEF-11884, DEF-12087, DEF-12154, DEF-12171, DEF-12171)
  - Refactoring templates and localization (DEF-10381, DEF-10382)
  - Fixed go-wrapper (DEF-12038)
  - Fixed DataCollection script (DEF-12039)
  - Added parameter --skip-system-owner and --skip-system-owner for finder (DEF-11811, DEF-11813)
  - Added CSV report for ai-bolit (DEF-9615)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0507-1
changelog:
  - Excluded system owner filter from upload job (DEF-12336)
  - Improved deobfuscator (DEF-12306)
  - Refactoring (DEF-12194)
  - Fixed bug with filenames (DEF-12289)
  - Added CSV report for procu2 (DEF-9615)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0521-1
changelog:
  - Added --size to procu2 and set 15Mb to default (DEF-12464)
  - Changed code for optimization and refactoring (DEF-10378, DEF-12196, DEF-12195)
  - Improved deobfuscator (DEF-12459, DEF-12375)
  - Fixed small bugs (DEF-12408, DEF-12042)
  - Removed Windows dependence (DEF-10389)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0601-1
changelog:
  - Improved normalization code (DEF-12426)
  - Optimized code for working in resident mode (DEF-12006)
  - Improved deobfuscator (DEF-12582, DEF-12519)
  - Fixed error in deobfuscator (DEF-12550)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0615-1
changelog:
  - Improved deobfuscator (DEF-12718, DEF-12716, DEF-12663, DEF-12636)
  - Added optimizations for procu2 (DEF-12749, DEF-12749)
  - Changed priority for CloudAssisted (DEF-12772)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0709-1
changelog:
  - Fixed finder module (DEF-13108)
  - Improved deobfuscator (DEF-13028, DEF-12991, DEF-12832, DEF-12998, DEF-12856, DEF-12831)
  - Refactoring (DEF-10383)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 20.0805-1
changelog:
  - Improved deobfuscator (DEF-13205, DEF-13235, DEF-13308, DEF-13333)
  - Homoglyphs normalization added (DEF-13161)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.1.1-1
changelog:
  - Improved deobfuscator (DEF-13777, DEF-13731, DEF-13712, DEF-13648, DEF-13626, DEF-13636, DEF-13515, DEF-13412, DEF-13383, DEF-13425, DEF-13395, DEF-13367, DEF-13437)
  - Added posix dependence for aibolit and procu2 (DEF-13023)
  - Added DB timeouts and limits for imunify_dbscan.php (DEF-13726, DEF-13751)
  - Added reports for correlation server (DEF-13335)
  - Added error reports for problem with CAS (DEF-13365)
  - Separated malware databases for imunify_dbscan.php and ai-bolit (DEF-13652)
  - Added ability to softly cancel imunify_dbscan.php (DEF-13285)
  - Added finder for CMS configs to imunify_dbscan.php (DEF-12224)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.8.1-1
changelog:
  - Improved deobfuscator (DEF-16318, DEF-16345)
  - Added hyperscan feature (DEF-15480, DEF-15481, DEF-15483, DEF-15475, DEF-16141, DEF-16142)
  - Extended ai-bolit help (DEF-16219)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.8.2-1
changelog:
  - Improved deobfuscator (DEF-16486, DEF-16467, DEF-16439, DEF-16352, DEF-16480)
  - Fixed Normalization (DEF-16438)
  - Changed the process of setting files for the report (DEF-16372)
  - Added sort for procu2 signatures DB (DEF-16522)
  - Change php handler in resident mode (DEF-16419)
  - Changed progress.json format (DEF-16276)
  - Fixed warnings and notices (DEF-16374)
  - Changed work with a fallen aibolit in GoWrapper (DEF-16279, DEF-16278, DEF-16277)
  - Changed PHP Handler for GoWrapper (DEF-16418)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.8.3-2
changelog:
  - Improved deobfuscator (DEF-16537)
  - Added full/truncated signatures DB (DEF-16405)
  - Do not add hyperscan.so on el6 (DEF-16365)
  - File-streaming for cloud-assist (DEF-15775)
  - Split full and truncated signatures DB (DEF-16404)
  - Fixed bug when --hs key provided, but DB not exists (DEF-16607)
  - Report all hsdb_maker error's to sentry through wrapper (DEF-16630)
  - Forwarded signals to child process for GoWrapper (DEF-16463)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.8.5-1
changelog:
  - Fixed a bug with the LevelDB database (DEF-16783)
  - Improved GoWrapper (DEF-16747, DEF-16546, DEF-16277)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.9.1-1
changelog:
  - Improved deobfuscator (DEF-16598, DEF-16640, DEF-16757, DEF-16599, DEF-16750, DEF-16771, DEF-16734, DEF-16848, DEF-16903, DEF-16886, DEF-16794)
  - Fixed filters for big ELF binaries(DEF-16691)
  - Fixed a bug with the LevelDB database (DEF-16784)
  - Added new perfomance related fields to json report (DEF-16772)
  - Updated required file locations in MDS (DEF-16868)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.10.2-1
changelog:
  - Improved deobfuscator (DEF-17046, DEF-16928, DEF-16902, DEF-16951)
  - Fixed double urlencode cleanup (DEF-17045)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.2.1-1
changelog:
  - Improved deobfuscator (DEF-13910, DEF-13977, DEF-13967, DEF-13944, DEF-13929, DEF-13889, DEF-13826, DEF-13801)
  - Improved normalization (DEF-13824, DEF-13825, DEF-13958)
  - Changed logic of switch notify and upload jobs (DEF-13732)
  - Changed snippet format (DEF-13897)
  - Added detached mode for MDS (DEF-13765, DEF-13774, DEF-13776, DEF-13780)
  - Added filter for listing files in standart mode (DEF-13208)
  - Added AVD support to MDS (DEF-13764)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.3.1-2
changelog:
  - Improved deobfuscator (DEF-14350, DEF-14227, DEF-14321, DEF-14258, DEF-14294, DEF-14268, DEF-14244, DEF-14409, DEF-14371, DEF-14378, DEF-13946, DEF-14084, DEF-14006, DEF-13869, DEF-13998, DEF-13901, DEF-14157)
  - Improved normalization (DEF-14178, DEF-14337)
  - Added ability to clean serialized content (DEF-11118)
  - Fixed bug in MDS for --path (DEF-14179)
  - Added tables for MDS scan (DEF-14196)
  - Added collecting statistics on suspicious URLs for MDS (DEF-13219)
  - Added ability to clean black urls from DB (DEF-13523)
  - Added ability to report user ids (DEF-11354)
  - Changed users report for --listing (DEF-14401)
  - Added param --stat for collection permissions (DEF-14480)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.1-1
changelog:
  - Improved deobfuscator (DEF-14600, DEF-14515, DEF-14623, DEF-14545, DEF-14466, DEF-14456, DEF-14431)
  - Fixed MDS progress (DEF-14632)
  - Fixed work with filters (DEF-14703)
  - Added fields database_port and app_owner_uid in report (DEF-14443, DEF-14537)
  - Changed the way MDS processes symlinks (DEF-14365)
  - Added fn b64 encoding to resident mode reports (DEF-14620)
  - Added --skip-imunify360-storage option (DEF-13585)
  - Added for a non-existent file when cleaning with --forcibly-cleanup option (DEF-14551)
  - Added migration for rapidscan db (DEF-14536)
  - Added ignore paths in av-admin-paths.txt (DEF-14343)
  - Added --rapid-scan-rescan-frequency option (DEF-14374)
  - Added RX_SKIPPED_SMART verdict for rapidscan (DEF-14376)
  - Changed scan_time instead update_time for rapidscan (DEF-14372)
  - Fixed --smart option (DEF-14375)
  - Removed AIBOLIT-BINMALWARE.db from ai-bolit and procu2 (DEF-14377)
  - Added multiple paths for db scan (DEF-14292)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.5-1
changelog:
  - Improved deobfuscator (DEF-14702, DEF-14655, DEF-14756, DEF-14782, DEF-14875, DEF-14635, DEF-14818)
  - Improved normalization (DEF-14762)
  - Changed heuristics algorithm (DEF-14737)
  - Fixed bug in report generator (DEF-14956)
  - Added field for MDS stat report (DEF-14799)
  - Fixed bug in progress (DEF-14820)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.6-1
changelog:
  - Improved deobfuscator (DEF-14687, DEF-14716, DEF-14942, DEF-14968, DEF-14890, DEF-14904, DEF-15105, DEF-14741)
  - Fixed problem with PCRE in deobfuscator (DEF-14687, DEF-14254)
  - Fixed bug in smart scan (DEF-15058)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.7-1
changelog:
  - Improved deobfuscator (DEF-14989, DEF-15126, DEF-14817, DEF-14748, DEF-14924)
  - Fixed working with LevelDB for functionality with --rapid-scan-rescan-frequency (DEF-15006)
  - Changed malware search algorithm (DEF-15187)
  - Fixed bug with SplFileObject (DEF-15193)
  - Changed filters for ai-bolit (DEF-15206)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.8-1
changelog:
  - Improved deobfuscator (DEF-14984, DEF-15200, DEF-14793, DEF-15054)
  - Fixed bug with --size (DEF-15261)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.9-2
changelog:
  - Improved deobfuscator (DEF-15282, DEF-15297, DEF-15309)
  - Fixed cleanup bug (DEF-15326)
  - Fixed heuristic and suspicious report generation for RapidScan (DEF-15006)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.10-1
changelog:
  - Changed PDO to native sqlite3 extension (DEF-15369)
  - Changed dependency to new package alt-php-internal (DEF-15369)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.6.2-1
changelog:
  - Improved deobfuscator (DEF-15425, DEF-14766, DEF-15273, DEF-15609, DEF-15356, DEF-15435, DEF-15119, DEF-15338, DEF-15209, DEF-15260, DEF-15327, DEF-15175, DEF-15083, DEF-15422, DEF-15311, DEF-15152, DEF-15469, DEF-15350)
  - Fixed deobfuscator bugs (DEF-15403, DEF-15589)
  - Changed default systemd watchdog timeout to 60 sec (DEF-15320)
  - Optimized smart scan (DEF-15431)
  - Added cloud-assist key in environment variables(DEF-15241)
  - Changed PDO to native sqlite3 extension (DEF-15369)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.6.3-1
changelog:
  - Improved deobfuscator (DEF-10585, DEF-15771, DEF-15731, DEF-15894, DEF-15913, DEF-15760, DEF-15709, DEF-15779, DEF-15460, DEF-15539, DEF-15631, DEF-15593, DEF-14852, DEF-15550, DEF-15608, DEF-15642)
  - Added workaround for skip log php files (DEF-15674)
  - Adapted signatures for PCRE 8.38 (DEF-15706)
  - Added rescan for procu2 (DEF-9160)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.7.1-1
changelog:
  - Improved deobfuscator (DEF-15991, DEF-16053, DEF-16026, DEF-16064, DEF-15869, DEF-15903, DEF-15983, DEF-15852, DEF-15815, DEF-15934)
  - Enabled smart scan in resident mode (DEF-15981)
  - Fixed normalization (DEF-16113)
  - Changed url for Go wrapper (DEF-15924)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.7.2-1
changelog:
  - Improved deobfuscator (DEF-16133, DEF-16157, DEF-16173, DEF-16181, DEF-16194, DEF-16211, DEF-16280)
  - Fixed work with broken RapidScan db (DEF-16103)


author: Albek Yermek <ayermek@cloudlinux.com> - 30.8.7-1
changelog:
  - Improved deobfuscator (DEF-16598, DEF-16640, DEF-16757, DEF-16599, DEF-16750, DEF-16771, DEF-16734, DEF-16848, DEF-16903, DEF-16886, DEF-16794)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.0.1-2
changelog:
  - Improved deobfuscator (DEF-16977, DEF-17053, DEF-17026, DEF-16986, DEF-17095, DEF-17104, DEF-17068, DEF-17113, DEF-17034, DEF-17174, DEF-17170, DEF-17193, DEF-17248, DEF-17262, DEF-17240, DEF-17281)
  - Fixed bug with SMW-HEUR-ELF signature name in RapidScan (DEF-16966)
  - Fixed a bug with the LevelDB database (DEF-17052)
  - Fixed html entities converting after urldecoding (DEF-17134)
  - Fixed handling 'bad' chinese chars during normalization (DEF-17111)
  - Added separate detached complete messages for separate working modes of MDS (DEF-17066)
  - Fixed cleanup of ELF files: always delete ELF without truncating (DEF-17208)
  - Added cleanup of logs (DEF-16569)
  - Improved cleanup (DEF-17261, DEF-17254)
  - Fixed RAS db rescan for heuristic files (DEF-17273)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.0.2-1
changelog:
  - Improved deobfuscator (DEF-17295, DEF-17393)
  - Added skipping of valid sqlite files when scanning in smart mode (DEF-17330)
  - Switched UTF-8 for MDS (DEF-17328)
  - Removed AppVersionDetector dependency (DEF-17451)
  - Updated EULA (DEF-16810)
  - Fixed deobfuscator (DEF-17437)
  - Fixed normalization (DEF-17364)
  - Fixed cleanup (DEF-17366)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.0.3-1
changelog:
  - Improved deobfuscator (DEF-17333, DEF-17363, DEF-17441, DEF-17285)
  - Changed shared memory permissions (DEF-17553)
  - Fixed deobfuscator (DEF-17365, DEF-17463)
  - Fixed normalization (DEF-17511)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.9.1-1
changelog:
  - Improved deobfuscator (DEF-16598, DEF-16640, DEF-16757, DEF-16599, DEF-16750, DEF-16771, DEF-16734, DEF-16848, DEF-16903, DEF-16886, DEF-16794)
  - Fixed filters for big ELF binaries(DEF-16691)
  - Fixed a bug with the LevelDB database (DEF-16784)
  - Added new performance related fields to json report (DEF-16772)
  - Updated required file locations in MDS (DEF-16868)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.1.1-1
changelog:
  - Improved deobfuscator (DEF-17416, DEF-17460, DEF-17515, DEF-17565, DEF-17552, DEF-17510, DEF-17537, DEF-17496, DEF-17410, DEF-17520, DEF-17600, DEF-17512, DEF-17475, DEF-17619)
  - Fixed MDS detached mode (DEF-17594)
  - Added different folders for different modes MDS in detached mode (DEF-17504)
  - Added wildcard support in MDS scan --path option (DEF-17593)
  - Fixed procu2 --rescan option results (DEF-17688)
  - Changed aibolit hyperscan db generation to server side (DEF-17077)
  - Changed aibolit hyperscan db serialization to mmap method (DEF-17041)
  - Enabled hyperscan in resident mode (DEF-17042)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.2-1
changelog:
  - Improved deobfuscator (DEF-20165, DEF-20103, DEF-20044, DEF-20203, DEF-20176)
  - Added utility to detect SSSE3 and HyperScan support (DEF-19937)
  - Added wrapper to run aibolit in resident mode (DEF-19861)
  - Added config file for aibolit, to store per-system settings (DEF-19856)
  - Added restricted aibolit run with disable_functions option of php (DEF-19859)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.3-1
changelog:
  - Fixed path in wrapper for hs_support utility (DEF-20367)
  - Fixed null file sizes in stats (DEF-20334)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.4-1
changelog:
  - Improved deobfuscator (DEF-20196, DEF-20145, DEF-20097, DEF-20335, DEF-20417, DEF-20250, DEF-20365, DEF-20469, DEF-20289, DEF-20259)
  - Fixed normalization (DEF-20484, DEF-20586)
  - Fixed getting server_id from free license (DEF-20535)
  - Fixed empty report if it contains invalid chars for json_encode (DEF-20614)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.5-1
changelog:
  - Improved deobfuscator (DEF-20386, DEF-20485, DEF-20403, DEF-20347, DEF-20294)
  - Improved file stat usage during scan (DEF-20128)
  - Improved cache usage for stat() function (DEF-20130)
  - Improved regexp usage in finder (DEF-20131)
  - Improved curl object usage during scan (DEF-20133)
  - Removed duplicate filters in finder (DEF-20132)
  - Optimized stats collecting (DEF-20852)
  - Added caching for function_exists() calls (DEF-20853)
  - Adjusted the limit for sequential requests for MDS (DEF-20930)
  - Fixed cleanup of escaped bad urls for MDS (DEF-21042)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.6-1
changelog:
  - Improved deobfuscator (DEF-20117)
  - Improved using pathinfo, basename, realpath functions (DEF-20129)
  - Fixed MDS issue with posix.so module (DEF-21087)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.9.1-1
changelog:
  - Improved deobfuscator (DEF-21309, DEF-21232, DEF-20547, DEF-21139, DEF-20184)
  - Fixed MDS bug (DEF-21243)
  - Added regexps merging with backreferences (DEF-20967)
  - Added processing of white_extended verdicts from CloudAssisted Scan API (DEF-20905)
  - Added saving hashes with verdicts in CloudAssisted (DEF-20904)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.9.3-1
changelog:
  - Improved deobfuscator (DEF-2125, DEF-20842, DEF-20677, DEF-20677, DEF-21325)
  - Fixed jenkins tests and posix bug (DEF-21302)
  - Fixed cache overflow bug (DEF-21485)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.10.1-1
changelog:
  - Improved deobfuscator (DEF-20729)
  - Fixed a bug when scanning a directory with a large number of files with unique extensions (DEF-21642)
  - Fixed build script (DEF-21823)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.10.2-1
changelog:
  - Improved deobfuscator (DEF-21024)
  - Fixed deobfuscator (DEF-21819)
  - Changed success list code for resident mode (DEF-21888)
  - Fixed incorrect hash getting from LevelDB database (DEF-21717)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.11.2-1
changelog:
  - Improved deobfuscator (DEF-20698, DEF-20858)
  - Removed AI_HOSTER constant (DEF-21882)
  - Added rule for scan crontab files if it system owner (DEF-22272)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.12.1-1
changelog:
  - Improved deobfuscator (DEF-22370, DEF-21025, DEF-22589)
  - Optimized deobfuscator (DEF-22626)
  - Fixed deobfuscator (DEF-22382, DEF-22444, DEF-22590)
  - Fixed normalization (DEF-22383, DEF-22591)
  - Fixed using cache (DEF-22442)
  - Added test for current build (DEF-21880)
  - Added version to MDS (DEF-20875)
  - Enabled CAS in resident mode (DEF-22320, DEF-22322)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.13.1-1
changelog:
  - Improved deobfuscator (DEF-22531)
  - Fixed deobfuscator (DEF-22555, DEF-22739, DEF-22750, DEF-22529, DEF-22831, DEF-21736, DEF-22821)
  - Fixed normalization (DEF-22738, DEF-22783)
  - Added reporting for PCRE errors (DEF-22692)
  - Fixed cleanup crontab files (DEF-22342)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.14.1-1
changelog:
  - Improved deobfuscator (DEF-20859, DEF-22972, DEF-22948, DEF-22637, DEF-21763, DEF-20745, DEF-20728, DEF-20814, DEF-21990, DEF-20810, DEF-21627, DEF-21628, DEF-20872)
  - Fixed normalization (DEF-22946, DEF-22949, DEF-22668)
  - Changed cleanup for multi-level obfuscated contents (DEF-22866)
  - Added delay for request to CAS (DEF-22997)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.15.1-1
changelog:
  - Improved deobfuscator (DEF-20885, DEF-23046)
  - Implemented procu2 cloud cleanup (DEF-23237)
  - Added extended-suspicious verdict for scan in standart mode and RapidAccountScan (DEF-23170, DEF-23179, DEF-23180, DEF-23330)
  - Added Grab data from php-emu log and use it in json report (DEF-23313)
  - Changed MRS domain (DEF-23237)
  - Added injection verdict (DEF-23236)
  - Fixed bug in white_extended verdicts from CloudAssisted Scan API (DEF-23212)
  - Changed list from a single signature for extended suspicious signatures (DEF-23383 list)
  - Add Joomla support to MDS (DEF-23353)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.15.1-1
changelog:
  - Improved deobfuscator (DEF-20885, DEF-23046)
  - Implemented procu2 cloud cleanup (DEF-23237)
  - Added extended-suspicious verdict for scan in standard mode and RapidAccountScan (DEF-23170, DEF-23179, DEF-23180, DEF-23330)
  - Added Grab data from php-emu log and use it in json report (DEF-23313)
  - Changed MRS domain (DEF-23237)
  - Added injection verdict (DEF-23236)
  - Fixed bug in white_extended verdicts from CloudAssisted Scan API (DEF-23212)
  - Changed list from a single signature for extended suspicious signatures (DEF-23383)
  - Add Joomla support to MDS (DEF-23353)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.16.0-1
changelog:
  - Added more details about cleanup to report (DEF-19852)
  - Changed cron signature scanning algorithm (DEF-23239)
  - Added auth for CloudAV cleanup (DEF-23511)
  - Fixed CloudAV cleanup error (DEF-23538)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.17.0-1
changelog:
  - Improved deobfuscator (DEF-23460, DEF-23362)
  - Fixed deobfuscator (DEF-23902, DEF-23605)
  - Adapted code to PHP 8.2 (DEF-23517)
  - Fixed a bug when MDS stopped on a broken table (DEF-23509)
  - Changed the process of parsing the config in MDS, it do not take commented lines(DEF-22518)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.18.0-1
changelog:
  - Changed algorithm for working with black files in Rapid Account Scan mode (DEF-24063)
  - Added new field to MDS report (DEF-24135)
  - Changed regexes merge algorithm (DEF-21299)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.19.0-1
changelog:
  - Added extended suspicious signatures (DEF-24158, DEF-24272, DEF-24290)
  - Changed output algorithm to stdout for MDS (DEF-24489)
  - Fixed normalization (DEF-24234)
  - Added ability to cleanup multibyte encoded files (DEF-17450)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.19.1-1
changelog:
  - Fixed code for support PHP 8.2 (DEF-23972)
  - Fixed extended-suspicious id in RAS (DEF-24656)
  - Removed extended-suspicious signatures (DEF-24662)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.19.2-1
changelog:
  - Fixed URL grabbing (DEF-24810)
  - Fixed LevelDB operation (DEF-24903)
  - Fixed hash verdicts transfer (DEF-24666)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.2.1-2
changelog:
  - Improved deobfuscator (DEF-17715, DEF-17707, DEF-17682, DEF-17654)
  - Fixed deobfuscator (DEF-17729)
  - Fixed sqlite3 dependencies
  - Added malware detection in base64 encoded data for MDS (DEF-16955)
  - Added malware detection for cleanup obfuscated black url for MDS (DEF-17779)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.2-1
changelog:
  - Improved deobfuscator (DEF-17885)
  - Improved normalization (DEF-17893)
  - Disabled resolving symlinks with glob if no symlink option (DEF-17860)
  - Fixed ignore lists skipping if symlinks to / used (DEF-17875)
  - Fixed backup creating in MDS (DEF-17934)
  - Fixed fallback if no base64 support on mysql server in MDS (DEF-17910)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.3-1
changelog:
  - Improved deobfuscator (DEF-17769, DEF-17816, DEF-17798, DEF-17727, DEF-17879)
  - Added support for doublequotes in wp-config for MDS (DEF-17997)
  - Added scan counters when clean used for MDS (DEF-18017)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.5-1
changelog:
  - Improved deobfuscator (DEF-18046)
  - Fixed MDS cleanup report (DEF-18022)
  - Fixed MDS scanning by path (DEF-18034)
  - Added ai-bolit resident mode upload job zip scanning by param (DEF-17608)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.6-1
changelog:
  - Improved deobfuscator (DEF-17932, DEF-17914, DEF-17905, DEF-17733, DEF-17754)
  - Fixed procu2 race condition (DEF-18068)
  - Removed MDS hostname resolver (DEF-18117)
  - Fixed MDS report detect counters, extending logs (DEF-18089)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.1-2
changelog:
  - Changed algorithm for creating extended suspicious signatures (DEF-24319)
  - Changed algorithm of using whitelist filter with extended-suspicious files (DEF-24819)
  - Fixed algorithm for detect log files (DEF-25036)
  - Enabled rescan malicious files in RAS (DEF-24922)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.2-1
changelog:
  - Added ability to extract base64 string for MDS (DEF-25115)
  - Fixed cleanup of files with multibyte encodings (DEF-25086)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.3-1
changelog:
  - Fixed report format (DEF-24985)
  - Fixed MDS black url cleanup (DEF-24991)
  - Fixed crontab cleaup (DEF-25364)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.4-1
changelog:
  - Added support for WP tags in MDS (DEF-25440)
  - Fixed HashTable implementation (DEF-25518)
  - Removed outdated vulnerability detection (DEF-22567)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.6-1
changelog:
  - Added option for disable CloudAV (DEF-25765)
  - Moved deobfuscator patterns to separate file (DEF-25888)
  - Changed fast versions deobfuscator regexps for compatible with hyperscan (DEF-25887)
  - Fixed bug in procu2 long cleanup (DEF-25843)
  - Fixed bug in RAS with long inode (DEF-26030)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.7-1
changelog:
  - Changed leveldb key logic (DEF-26031)
  - Fixed MDS parse escaped config values (DEF-25822)
  - Added early-filter Hyperscan DB (DEF-25858)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.2-1
changelog:
  - Added an exception for the user www-data (DEF-26512)
  - Fixed MDS blackurls cleanup (DEF-25817, DEF-26509)
  - Added cgroup accounting to aibolit-resident service (DEF-26582)
  - Removed UID_MAX restriction (DEF-26918)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.3-1
changelog:
  - Removed the use of mbstring (DEF-26805)
  - Added display_errors=stderr to launch params (DEF-26934)
  - Added more error markers to report to sentry (DEF-26799)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.4-1
changelog:
  - Fixed error with empty resident job file (DEF-27062)
  - Fixed warning in procu2.php (DEF-27014, DEF-27104)
  - Fixed large memory consumption when finding blacklisted files (DEF-27091)
  - Added wake up agent on detection in resident mode (DEF-26667)
  - Started using extended-suspicious Hyperscan DB even if Hyperscan is disabled (DEF-26780)
  - Managed the hyperscan parameter for the resident mode according to Imunify360 config (DEF-26767)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.5-1
changelog:
  - Fixed error in cleanup (DEF-27364)
  - Changed the file buffer accumulation order for CloudAV (DEF-27247)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.3.1-1
changelog:
  - Improved deobfuscator (DEF-17896, DEF-17864, DEF-17845, DEF-17852)
  - Fixed imunify_dbscan work on DB scan error (DEF-18241)
  - Fixed cleanup (DEF-18131)
  - Fixed deobfuscator (DEF-18217)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.1-1
changelog:
  - Enabled scanning of archives in resident mode (DEF-18032)
  - Changed work with parameters that accept paths to files (DEF-18143)
  - Fixed MDS url report (DEF-18163)
  - Fixed MDS SQL queries (DEF-18189)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.3-1
changelog:
  - Fixed deobfuscator (DEF-18368)
  - Fixed report with big ELF files (DEF-18354)
  - Fixed ZIP scanning (DEF-18395)
  - Changed ZIP filter (DEF-18389)
  - Changed ZIP scanning limits (DEF-18412)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.4-1
changelog:
  - Improved deobfuscator (DEF-18451, DEF-18290, DEF-18253, DEF-17967, DEF-17998, DEF-18244, DEF-18188, DEF-18353, DEF-18014)
  - Added zip folder count limit (DEF-18448)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.6-1
changelog:
  - Improved deobfuscator (DEF-18325)
  - Added WAL mode for sqlite3 (DEF-18461)
  - Fixed hyperscan working in resident mode (DEF-18544)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.7-1
changelog:
  - Changed the limit for sequential requests for MDS (DEF-18604)
  - Fixed deobfuscator in unwrapGoto function (DEF-18447, DEF-18551, DEF-18622)
  - Fixed syntax error for PHP 7.2 and earlier (DEF-18662)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.5.1-1
changelog:
  - Improved deobfuscator (DEF-18390, DEF-18679)
  - Fixed deobfuscator work with PHP8 (DEF-18452)
  - Fixed deobfuscator (DEF-18755)
  - Fixed resident mode (DEF-18750)
  - Fixed black URL detection with escaped slashes in MDS (DEF-18655)
  - Fixed cleanup inside script tag in MDS (DEF-18657)
  - Improved ability to find black urls for MDS(DEF-18660)
  - Removed app-version-detector module (DEF-18783)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.5.2-1
changelog:
  - Improved deobfuscator (DEF-18732, DEF-18691, DEF-18339, DEF-18712)
  - Fixed normalization (DEF-18621, DEF-18848)
  - Added resident mode stats (DEF-18696, DEF-18835)
  - Fixed bug in procu2.php with trimmed filenames (DEF-18853)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.5.3-1
changelog:
  - Improved deobfuscator (DEF-18620, DEF-18136, DEF-18781, DEF-18824, DEF-18856)
  - Fixed unexpected MDS output on search-configs (DEF-18897)
  - Fixed cyclic cleanuping (DEF-18906)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.1-1
changelog:
  - Improved deobfuscator (DEF-18941, DEF-19068, DEF-19128, DEF-19073, DEF-19095, DEF-18934, DEF-18971, DEF-18949, DEF-18920, DEF-18961, DEF-18733, DEF-18746, DEF-18791, DEF-18098)
  - Fixed normalization (DEF-18946)
  - Added memory limit option for MDS (DEF-19230, DEF-18717)
  - Added imunify filters for directory checking (DEF-19142)
  - Fixed cleanup (DEF-19027)
  - Collection of stat on additional fields for MDS (DEF-19014, DEF-19013, DEF-19015)
  - Fixed MDS progress percents (DEF-19038)
  - Added 0027 umask (DEF-18650)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.3-1
changelog:
  - Improved deobfuscator (DEF-19026, DEF-19157, DEF-19205, DEF-19203, DEF-19244)
  - Fixed normalization (DEF-19266)
  - Fixed MDS cleanup for blackurl (DEF-19279)
  - Added flag --standard-only (DEF-19192)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.4-1
changelog:
  - Improved deobfuscator (DEF-19522, DEF-19531, DEF-19513, DEF-19353, DEF-19492, DEF-19420, DEF-19398, DEF-19370, DEF-19308, DEF-19222, DEF-19161, DEF-19195, DEF-19257, DEF-19286, DEF-19273, DEF-19441)
  - Added parameter --size for MDS (DEF-19154)
  - Added collecting aibolit decisions statistics (DEF-17810, DEF-17811, DEF-17812, DEF-17813)
  - Changed limit for cleanup iterations (DEF-19586)
  - Changed limits for scan archive and upload jobs (DEF-19395)
  - Extended resident mode reporting (DEF-19396)
  - Refactoring procu2 and added to restore original permissions after clean (DEF-18135)
  - Switched to using the hrtime function to measure performance in aibolit (DEF-19473)
  - Fixed MDS in terms of working with different encodings (DEF-19589)
  - Fixed cleanup errors (DEF-19349)
  - Fixed MDS url parser (DEF-19470)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.5-1
changelog:
  - Improved deobfuscator (DEF-19635, DEF-19363, DEF-19634, DEF-19602)
  - Changed non-blocking socket for MDS (DEF-19644)
  - Fixed data format for stats (DEF-19702)
  - Fixed bug with AVD DB selecting (DEF-19593)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.6-1
changelog:
  - Fixed deobfuscator (DEF-19950)
  - Expanded aibolit report with files that were scanned for a long time in debug_performance mode (DEF-19928)
  - Expanded MDS report with additional_data field (DEF-19985)
  - Added checker_size_range_sig_scan checker (DEF-20001)


author: Albek Yermek <ayermek@cloudlinux.com> - 31.7.1-1
changelog:
  - Switched to hrtime function for collecting statistics for MDS and Procu2 (DEF-19624)
  - Improved deobfuscator (DEF-20018, DEF-19950, DEF-19902, DEF-19808, DEF-19659, DEF-19838, DEF-19650, DEF-19735, DEF-19840, DEF-19682, DEF-19670, DEF-19662, DEF-19760, DEF-19945, DEF-20004)
  - Extended DEBUG_PERFOMANCE mode to measure deobfuscation (DEF-19839)
  - Expanded aibolit report with files that were scanned for a long time in debug_performance mode (DEF-19928)
  - Expanded MDS report with additional_data field (DEF-19985)
  - Added checker_size_range_sig_scan checker (DEF-20001)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.9.3-1
changelog:
  - Improved deobfuscator (DEF-2125, DEF-20842)
  - Fixed jenkins tests and posix bug (DEF-21302)
  - Fixed cache overflow bug (DEF-21485)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 32.1.5-1
changelog:
  - Changed the cleaning algorithm when using cloudav (DEF-27781)
  - Fixed MDS cleanup error (DEF-27226)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.6-1
changelog:
  - Added CAS check for files being cleaned (DEF-25914)
  - Added suspicious scan in resident mode for inotify_jobs (DEF-27522)
  - Fixed MDS cleanup error (DEF-27619)
  - Fixed CAS with RAS error reporting to Sentry (DEF-27966)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.9-1
changelog:
  - Use uniformity in reports (DEF-28429)
  - Changed to not use CAS / CloudAV when working with cron files (DEF-28365)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.1.10-1
changelog:
  - Fixed allocating memory error in imunify_dbscan.php (DEF-28213)
  - Improved grouping of AI-Bolit Sentry events (DEF-28553)
  - Fixed MDS Cleanup error (DEF-28634)
  - Fixed regex for URL cleanup (DEF-28584)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.7-1
changelog:
  - Added support for WordPress postmeta table in MDS (DEF-27350)
  - Added mapping file and new signature DB for Patchman (DEF-28172, DEF-28173)
  - Changed license check for Cloudways (DEF-28216)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.11-1
changelog:
  - Fixed most frequent PCRE errors cause by deobfuscator (DEF-26429)
  - Fixed number total objects (rows_count) in MDS report (DEF-28703)
  - Changed MDS prefiltering rules to capture PHP opening tags (DEF-28758)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.12-1
changelog:
  - Changed size limit for ELF files to 100 MB to include them in cloud assisted scan (DEF-28627)
  - Added support for paths containing references to /./ and /../ for MDS (DEF-29081)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.1.13-1
changelog:
  - Improved Sentry errors logging (DEF-28661, DEF-29052)
  - Improved the normalization process for covering mixed encodings case (DEF-29028)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.1.14-1
changelog:
  - Improved Sentry errors logging (DEF-28661, DEF-29052)
  - Improved the normalization process for covering mixed encodings case (DEF-29028)
  - Decreased max ELF file size for scanner to 1M (DEF-29344)
  - Fixed regular expression for matching nested URLs, reworked logic for determining blacklisted URLs (DEF-29209)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.15-1
changelog:
  - Improved URL check against blacklist in MDS (DEF-29000)
  - Added more details to MDS error messages (DEF-28941)
  - Fixed wildcard handling in MDS scan path (DEF-29352)
  - Limited core dump file filtering to big ELF files (DEF-29454)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.1.14-1
changelog:
  - Improved Sentry errors logging (DEF-28661, DEF-29052)
  - Improved the normalization process for covering mixed encodings case (DEF-29028)
  - Decreased max ELF file size for scanner to 10M (DEF-29344)
  - Fixed regular expression for matching nested URLs, reworked logic for determining blacklisted URLs (DEF-29209)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.16-1
changelog:
  - Added filtering of core dump files during scan (DEF-29484)
  - Changed max ELF file size for scanner to 100M (DEF-29750)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.18-1
changelog:
  - Make the process for obtaining data for scanning from database more memory efficient (DEF-28660)
  - Fix database scanner to handle large number of databases (DEF-30015)


author: Vitalii Rudnykh <vrudnykh@cloudlinux.com> - 32.1.19-1
changelog:
  - Added support hash-based ignore list (DEF-30171)
  - Fixed fatal error with writing the report to CSV (DEF-30396)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.1.21-1
changelog:
  - api.cas.imunify360.com endpoint is now used for all CAS requests. (DEF-30798)
  - Enhanced detection logic to identify obfuscated PHP code stored in a database. (e.g., SMW-INJ-27029-php.spam.redi-0). (DEF-30771)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.1.21-1
changelog:
  - api.cas.imunify360.com endpoint is now used for all CAS requests. (DEF-30798)
  - Enhanced detection logic to identify obfuscated PHP code stored in a database. (e.g., SMW-INJ-27029-php.spam.redi-0). (DEF-30771)
  - Increased size limits in real-time. (DEF-29770)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.2.1-1
changelog:
  - Removed hardcoded signatures; uses --avdb for external database. (DEF-8270)
  - Updated copyright year to 2025. (DEF-31174)
  - Added support for Magento 1 and 2 databases for vulnerable tables and fields. (DEF-31333)
  - Added extended-suspicious scanning for specific file extensions and detection of zipped PHP files < 10MB (DEF-31412)
  - Added scanning for wp_hfcm_scripts and wp_snippet tables in WordPress. (DEF-31527)
  - Fixed division by zero error in database restore for single-line cleanup files. (DEF-31523)
  - Fixed bug with infinite loop in deobfuscator (DEF-31754)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.2.2-1
changelog:
  - Optimized WHITE_EXTENDED verdict handling to avoid unnecessary scans. (DEF-31891)
  - Improved MDS scanner to detect non-standard Magento configs. (DEF-32011)
  - Fixed skipping of CMS configs files under 2K. (DEF-32011)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.3.1-1
changelog:
  - Improved malware cleanup reporting with precise hashes and timestamps. (DEF-19851)
  - Extended procu2 report with mtime and hash fields before/after cleanup. (DEF-19852)
  - Handled suspicious detections separately for upload consumers (modsec, ossec). (DEF-29483)
  - Added support for new patch verdicts from Cloud-Assisted Scan API. (DEF-31902)
  - Fixed %preun scriptlet failure in Elevate initramfs during CL8 to CL9 upgrade. (DEF-32217)
  - Implemented patching logic in procu2 using CAS API. (DEF-32652)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.4.1-1
changelog:
  - Convert UTF-16 encoded files to UTF-8 before cleaning to avoid issues (DEF-29075)
  - Fix iconf func support detection (DEF-31028)
  - Disable collecting statistic for case where it is not needed (DEF-33854)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.5.2-1
changelog:
  - Fixed group of admin tools detections. Added admin tools signatures sanitizing to all reports (DEF-34676)
  - Added handling of ambiguity silently by fall-back categor (DEF-34687)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.6.1-1
changelog:
  - New MDS Reporting added (DEF-33704)
  - Removed chattr -i for ai-bolit Files (DEF-34156)
  - Hyperscan crash AiBolitError due to JSONDecodeError fixed (DEF-34584)
  - Added reading of /var/imunify360/.sentry_tags to report errors (DEF-34710)
  - Added the use the same config settings for different scan types (DEF-34875)
  - Improved regex signature optimizer to support Octal escape sequences (DEF-34910)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.7.1-1
changelog:
  - Added scan_id tag to the Sentry event (DEF-35144)
  - Fixed the "--restore" action to correctly revert not all historical cleanups (DEF-35256)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.7.2-1
changelog:
  - Procu2 cleanup: fix normalization regression that modified legitimate files. (DEF-35239)
  - Return correct error code on failure (shared-memory). (DEF-35347)
  - Resident mode: allow admin tools upload when detection is disabled (adminer.php). (DEF-35394)
  - Fix --restore-sig-id restoration by creating proper workdir for detached scans. (DEF-35550)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.7.3-1
changelog:
  - Resident mode: replace SIGTERM with SIGUSR2 for suspicious files. (DEF-35921)
  - Optimize DB restore to use the most recent backup. (DEF-36136)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 4.1.0-1
changelog:
  - Add sha256 of scanned files in report (DEF-8047)
  - Add an option and ability to scan first N bytes in AI-BOLIT rather than skipping the file (DEF-8124)
  - Enable support for \n and \r (and other allowed chars) in the filename (DEF-8129)
  - Run procu2.php with custom (specified) signature for instant cleanup (before it's being released in malware db) (DEF-8231)
  - Add cloud assisted scan (DEF-8408)
  - Add RapidAccountScan mode (DEF-8620)
  - Add support for suspicious signatures (DEF-8708)
  - Detect ELF (binary) Executables in user's home folders (DEF-8992)
  - Deobfuscator improvements
  - Minor bugfixes and other improvements


author: Frediano Ziglio <freddy77@angelfire.com>
changelog:
  - remove dependency from freetds-unixodbc
  - fix field name (Copyright instead of License)
  - updated URL


author: Kamil Dudka <kdudka@redhat.com> 7.33.0-1
changelog:
  - new upstream release
  - fix missing initialization in NTLM code causing test 906 to fail
  - fix missing initialization in SSH code causing test 619 to fail


author: Alex71 <nyrk71@gmail.com> 2.1.0-2
changelog:
  - put libhpdf.so in the devel package and libhpdf-2.1.0.so in the main one
  - removed duplicated README and CHANGES from devel package
  - fixed "E: empty-debuginfo-package" with --enable-debug flag in configure
  - removed INSTALL file
  - added demo/ directory in doc (devel only) as doc


author: Brian Aker <brian@tangent.org> - 1.0.8
changelog:
  * Fri Jan  8 2010 Brian Aker <brian@tangent.org> - 0.37
  - Modified to be explicit in install include files.


author: Remi Collet <remi@remirepo.net> - 1.3.2-1
changelog:
  - update to 1.3.2
  - drop multilib header hack
  - change URL to https://libzip.org/
  - test suite now ok on all arch


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1598103)
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1-27
changelog:
  - ALTPHP-484: Fix SCL prefixes for alt-php
  - ALTPHP-486: Don't create SCL prefix if alt-php is not installed


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-29
changelog:
  - Added trigger for cl-Percona56-client and cl-Percona56-shared packages
  - ALTPHP-504: Fixed "Couldn't remove prefix /etc/scl/prefixes" error


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-45
changelog:
  - fix version compare in multiphp_reconfigure script
  - exec /multiphp_reconfigure after installation for cPanel > 100.0


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-46
changelog:
  - rewrite code for versions comparing in multiphp_reconfigure.py script
  - rewrite alt-php-mysql-reconfigure.py for ubuntu support


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.4.8-2
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - ALTPHP-961: Update litespeed to 7.7 version


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 7.4.16-2
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - ALTPHP-1082: Add alt-php-pdo requires for alt-php-mysqlnd and alt-php-firebird


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 7.4.21-3
changelog:
  - ALTPHP-1154: Fix libxml requires
  - ALTPHP-1156: Get rid of manipulations with enabling extensions (mysqli.so) in default.ini


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-3
changelog:
  - ALTPHP-1355: fix linksafe for all sub-packages
  - fix rpath for zip extension
  - add alt-php74-imunify-leveldb provides


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.4.33-4
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:1.10.3-1
changelog:
  - update PEAR to 1.10.3
  - update ArchiveTar to 1.4.2
  - update Structures Graph to 1.1.1
  - update XML_Util to 1.4.2
  - update Console_Getopt to 1.4.1


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.17-2
changelog:
  - ALTPHP-498: Fixed ability to override parameters with ini_set() that
    were defined via php_value
  - ALTPHP-499: Fixed patch for LiteSpeed SIGTERM cleanup


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.28-3
changelog:
  - revert:
    - add /etc/cl.selector/symlinks.rules for CL
    - recreate handlers for Plesk/
  - Fix problem with /etc/cl.selector/symlinks.rules


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.1.28-4
changelog:
  - add all extensions in default.ini and disable by default except mysqli.so
  - update plesk php hadlers if add new extensions in default.ini
  - set "serialize_precision = -1" in php.ini


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.33-5
changelog:
  - Fix bug #77569: Write Access Violation in DomImplementation
  - Fix bug #79078: Hypothetical use-after-free in curl_multi_add_handle
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-9
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #75673: SplStack::unserialize() behavior
  - Fix bug #79199: curl_copy_handle() memory leak
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79393: Null coalescing operator failing with SplFixedArray
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79413: session_create_id() fails for active sessions
  - Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)
  - Fix bug #79468: SIGSEGV when closing stream handle with a stream filter appended


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-11
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79497: stream_socket_client() throws an unknown error sometimes with <1s timeout
  - Fix bug #79503: Memory leak on duplicate metadata
  - Fix bug #79514: Memory leaks while including unexistent file
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-6.1
changelog:
  - added install trigger for cl-MySQL50-client, cl-MySQL51-client,
    cl-MySQL55-client, cl-MySQL56-client


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-6.2
changelog:
  - added install trigger for cl-MySQL50-shared, cl-MySQL51-shared,
    cl-MySQL55-shared, cl-MySQL56-shared


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-6.4
changelog:
  - ALTPHP-189: call alt-php-mysql-reconfigure.py instead of deprecated
    alt-php-mysql-reconfigure in posttrans section
  - add alt-php70-mysql5.7 and alt-php70-mariadb101 requirements


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-26
changelog:
  - fix logrotate permissions
  - fix install newrelic for php > 7.0
  - disable debuginfo and strip binaries


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-35
changelog:
  - ALTPHP-609: Updated apcu extension to 5.1.12 version
  - Updated timezonedb extension to 2018.7 version


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 1-37
changelog:
  - ALTPHP-627: Updated apcu extensions to 5.1.14 version
  - Updated redis extensions to 4.2.0 version
  - Updated swoole extensions to 4.2.9 version
  - Updated yaml extensions to 2.0.3 version
  - Updated libsodium extensions to 2.0.15 version


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 1-45
changelog:
  - Update timezinedb to 2019.1 version
  - Update mongodb to 1.5.5 version
  - Update imagick to 3.4.4 version
  - Update dbase to 7.0.0 version
  - Update swoole to 4.3.5 version


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 1-47
changelog:
  - Update timezinedb to 2019.3 version
  - Update xdebug to 2.8.0 version
  - Update swoole to 4.4.12 version


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 1-25.2
changelog:
  - Improved checking during build process
  - Improved build process
  - Removed pdo_sqlsrv and sqlsrv from i686 builds


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.9.1-1
changelog:
  - Update to upstream 1.9.1 because of security issues with the bundled
    python-pip in older releases.  This is just a quick fix until a
    python-virtualenv maintainer can unbundle the python-pip package
    see: https://bugzilla.redhat.com/show_bug.cgi?id=749378


author: Tomas Orsava <torsava@redhat.com> - 1.10.1-3
changelog:
  - Added a patch that shows a custom error message when a FILE passed to
    virtualenv to be used as 'home dir' already exists and is NOT a directory.
  Resolves: rhbz#1306513


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
  - Rebase to version 15.1.0
  - Disable automatic downloads from pypi on new venv creation
  Resolves: rhbz#1461154


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 3.5.3-1
changelog:
  - update Python to 3.5.3
  - disable system expat
  - refresh patches 55
  - remove patches 180, 184, 203, 242


author: Orion Poplawski - 0.23.5-1
changelog:
  - Update to 0.23.5
  - Macro usage cleanup
  - Fix license tag
  - Fix line endings
  - Remove unneeded shbangs


author: Miro Hrončok <mhroncok@redhat.com> - 2.2.1-1
changelog:
  - Updated to 2.2.1
  - Introduced Python 3 subpackage (upstream has merged the codebase)
  - Removed BuildRoot and python_sitelib definition
  - Use python2 macros instead of just python


author: Adam Williamson <awilliam@redhat.com> - 2.0.0-0.7.rc2
changelog:
  - Update to 2.0.0rc2
  - Fix more big-endian integer issues
  - Apply the 'aarch64' test tolerance patch on ppc64 also (it's affected by same issues)
  - Tweak the 'i686' test tolerance patch a bit (some errors are gone, some new ones)
  - Re-enable test suite for all arches
  - Note a remaining quasi-random test issue that causes build to fail sometimes


author: Bohuslav Kabrda <bkabrda@redhat.com> - 1.3.2-2
changelog:
  - Add patch for issue https://github.com/nose-devs/nose/pull/811,
  which makes tests of python-billiard and python-falcon fail with Python 3.4


author: Matej Stuchlik <mstuchli@redhat.com> - 1.5.6-3
changelog:
  - Added patch for local dos with predictable temp dictionary names
    (http://seclists.org/oss-sec/2014/q4/655)


author: Kamil Dudka <kdudka@redhat.com> - 7.21.5-3
changelog:
  - remove explicit dependency on keyutils-libs (reported by rpmlint)
  - update FSF address in COPYING-LGPL (detected by rpmlint)


author: Eduard Chiganov <echiganov@cloudlinux.com> - 0.14.11-10
changelog:
  - ALTPYTH-467: Get rid of alt-python dependencies errors.
  - New linksafe post, triggerin and triggerun scripts.


author: Lumír Balhar <lbalhar@redhat.com> - 1.15.6-3
changelog:
  - Add subpackage for platform-python
  - Disable tests so platform-python stack can be bootstrapped
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Tomas Orsava <torsava@redhat.com> - 1.15.6-4
changelog:
  - Re-enable tests to finish bootstrapping the platform-python stack
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-5
changelog:
  - testModuleData is failing on arm platform even for python 2.7
  - exclude this test for build of arm


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-6
changelog:
  - additionally testEntrypoint testIn testIntegerFunctions failing on s390/ppc64
  - exclude those tests for build of s390/ppc64


author: Sergey Fokin <sfokin@cloudlinux.com> 3.8.12-2
changelog:
  - ALTPYTH-413: move -fno-semantic-interposition to CFLAGS_NODIST
  - remove changing gcc to devtoolset-gcc
  - change BuildRequire from gcc-toolset to system gcc for CL8


author: Rahul Sundaram <sundaram@fedoraproject.org> - 0.11.6-1
changelog:
  - upstream release 0.11.6
  - add python3 subpackage. resolves rhbz#949240
  - spec file patch from Haïkel Guémar <hguemar@fedoraproject.org>


author: Adam Williamson <awilliam@redhat.com> - 1.0.0-4
changelog:
  - python3 build only for Fedora (no python3 in RHEL6 or 7)
  - provide python2-cached_property
  - guard against #license not being available
  - only run tests on F>=22 (tox is too old on everything else)


author: Adam Williamson <awilliam@redhat.com> - 1.2.0-1
changelog:
  - new upstream release 1.2.0 (refactoring, bug fixes)
  - patch out non-ASCII characters in HISTORY.rst (breaks py3 build in koji)


author: Adam Williamson <awilliam@redhat.com> - 1.3.0-1
changelog:
  - new release 1.3.0, drop patch (merged upstream)
  - switch to python2-foo / python3-foo package naming


author: Adam Williamson <awilliam@redhat.com> - 1.3.0-2
changelog:
  - try to repair the mess I made of package naming:
  - # both subpackages now use module name not project name
  - # try to ensure all previous names are provided/obsoleted


author: Zbigniew Jędrzejewski-Szmek <zbyszek@bupkis> - 1:2.5.0-1
changelog:
  - Update to latest upstream version
  - The patch to make dateutil.zoneinfo.gettz() use the system database is dropped.
    Upstream recommends using dateutil.tz.gettz() instead.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.2.0-3
changelog:
  - ALTPYTH-474: Change specs for alt-python for new linksafe add method.
  - Created patch for unit tests.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
  - Reverted flawed patch for #1051427 (this reintroduces #1052102).
  - Spec cleanup (removed rhel < 7 specific stuff).
  - Update to 2.7.2.
  Resolves: rhbz#1052777


author: Sergio Pascual <sergiopr@fedoraproject.org> - 0.9.3-2
changelog:
  - New upstream release (0.9.3)
  - Using new python macros
  - Disable failling tests (https://github.com/joblib/joblib/issues/278)


author: Thomas Moschny <thomas.moschny@gmx.de> - 1.4.28-1
changelog:
  - Update to 1.4.28.
  - Modernize spec file.
  - Apply updates Python packaging guidelines.
  - Mark LICENSE with %license.


author: Thomas Moschny <thomas.moschny@gmx.de> - 1.4.31-1
changelog:
  - Update to 1.4.31.
  - Follow updated Python packaging guidelines.
  - Add Provides tag for bundled apipkg.


author: John Morris <john@zultron.com> - 6.2.4-7.280svn20130805
changelog:
  - Update to SVN r280 for python3 compatibility
  - Update python-pycxx-6.2.4-setup.py.patch to apply correctly
  - Fix %setup for SVN zipball
  - Add diff extensions to %patch macros
  - Enable python3 pkg by default except for EPEL; see BZ 991342


author: Ralph Bean <rbean@redhat.com> - 1.5.6-4
changelog:
  - Change our conflicts on python-SocksiPy to an obsoletes/provides.
    https://bugzilla.redhat.com/show_bug.cgi?id=1334407


author: Ralph Bean <rbean@redhat.com> - 2.7.0-7
changelog:
  - Tell setuptools about what version of urllib3 we're unbundling
    for https://github.com/kennethreitz/requests/issues/2816


author: Jamie Lennox <jamielennox@gmail.com> - 0.7.0-1
changelog:
  - Update package to new version.
  - Add python2 subpackage for new python packaging guidelines.
  - Redo patch1 to still apply.


author: Julian Sikorski <belegdol@fedoraproject.org> - 11.1.0-1
changelog:
  - Updated to 11.1.0
  - Obsoleted zsh subpackage (upstream ticket #3078)
  - mktap is gone (upstream ticket #5293)
  - Dropped obsolete Group, Buildroot, %clean and %defattr


author: Ralph Bean <rbean@redhat.com> - 1.15.1-2
changelog:
  - Remove broken symlinks to unbundled python3-six files
    https://bugzilla.redhat.com/show_bug.cgi?id=1295015


author: Jan Stanek <jstanek@redhat.com> - 3.7.16.2-1
changelog:
  - update to 3.7.16.2 (http://www.sqlite.org/releaselog/3_7_16_2.html)
  - add support for aarch64 (rerunning autoconf) (#926568)


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.15-1
changelog:
  - update to 3.7.15 (http://www.sqlite.org/releaselog/3_7_15.html)
  - fix an old incorrect date in spec changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.1.2-6
changelog:
  - Resolves: #556398
  - Directly included relevant patches, scripts and man pages from Debian
  - Removed rpath
  - rpmlint is silent now


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.1.2-6.1
changelog:
  - Fixed CVE-2010-2642, CVE-2011-0433, CVE-2011-0764, CVE-2011-1552, CVE-2011-1553, CVE-2011-1554
    Resolves: rhbz#772900


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.1102-1
changelog:
  - Fixed normalization for versions (DEF-14069)
  - Changed behavior for non-existent directories (DEF-14117)
  - Fixed bug in read directories by function file_get_contents (DEF-14047)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.1117-1
changelog:
  - Fixed output on empty input (DEF-14770)
  - Added real_path field for slite report (DEF-14365)
  - Added uid field for slite report (DEF-13657)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.1117-1
changelog:
  - Fixed output on empty input (DEF-14770)
  - Added real_path field for sqlite report (DEF-14365)
  - Added uid field for slite report (DEF-13657)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 21.0908-1
changelog:
  - Fixed script for update AppVersionDetector package (DEF-17661)
  - Fixed return code (DEF-17662)
  - Added detection for phpmyadmin (DEF-10502)
  - Added detection for Modx, IPB, PHPBB3, OsCommerce and Bitrix (DEF-10501)
  - Added PHP 8.0 support (DEF-17446)
  - Changed EULA (DEF-17426)


author:
  Alexander Tishin <atishin@cloudlinux.com>, Alexander Zveruk <azveruk@cloudlinux.com>, Maxim Kanushin <mkanushin@cloudlinux.com> 3.0-1

changelog:
  - DEF-4659 Do not suppress error output of `mysql` command
  - DEF-4712 Fix endpoint decorators
  - DEF-4625 RestoreInfected should support centos-plus kernels
  - DEF-4637 `kernel-devel is not installed` during Acronis installation
  - DEF-4507 Implement DirectAdmin backup backend
  - DEF-4546 Agent should install Acronis client if it's not installed yet
  - DEF-4494 Acronis backup - `show` before `init` leads to "Could not read token" error
  - DEF-4528 Refresh timestamp stored for R1Soft on token refresh
  - DEF-4475 Don't fail on broken backups
  - DEF-4474 Make a cron job for R1Soft to keep token valid


author: Alexander Zveruk <azveruk@cloudlinux.com>, Alexander Tishin <atishin@cloudlinux.com> - 3.0.3-1
changelog:
  - DEF-3830 Status update for user when activating Cloudlinux Backup
  - DEF-4908 Register server in Acronis during init if agent already installed


author: Alexander Tishin <atishin@cloudlinux.com>, Maxim Kanushin <mkanushin@cloudlinux.com> - 3.1.0-1
changelog:
  - DEF-4956 Rotate MySQL freeze/unfreeze log
  - DEF-4921 User-friendly error when using wrong acronis credentials
  - DEF-4938 Change default options of "CloudLinux Backup" plan


author: Maxim Kanushin <mkanushin@cloudlinux.com> - 3.1.1-1
changelog:
  - DEF-5125 'hide' the log about "skipping" in result of cron task cloudlinux-backup-utils-cron-daily.sh


author: Alexander Tishin <atishin@cloudlinux.com> - 3.1.2-1
changelog:
  - DEF-5092 TypeError in Ftp.__init__
  - DEF-5270 Fix Acronis agent existence check
  - DEF-5289 Fix Acronis registration
  - DEF-4938 Change default options of "CloudLinux Backup" plan
  - DEF-5273 No backup listed after successful manual backup
  - DEF-5293 Backup is not scheduled after init


author: Maxim Kanushin <mkanushin@cloudlinux.com> - 3.2.0-1
changelog:
  - DEF-5359 Implement ClusterLogics backup backend
  - DEF-5739 Make possible to restore from backup in multiple threads
  - DEF-5906 Verbositiy setting in cloudlinux-backup-utils CLI
  - DEF-5166 Make BackupException human-readable


author: Alexander Tishin <atishin@cloudlinux.com> - 3.3.3-1
changelog:
  - DEF-10693 Unable to access backups using Imunify360 panel
  - DEF-10848 module 'restore_infected.cli' has no attribute 'main'


author: Alexander Tishin <atishin@cloudlinux.com> - 3.4.0-1
changelog:
  - DEF-6026 Fix the file descriptor leakage when using Cpanel Backup
  - DEF-9279 Remove Acronis agent if it was installed by us. Do not ask in i360deploy.sh
  - DEF-8545 Fix error when Plesk uses plain passwords for FTP
  - DEF-11629 TypeError: join() argument must be str or bytes, not 'NoneType'
  - DEF-12005 ValueError: list.remove(x): x not in list
  - DEF-12116 Restore from backup leaves temporary directory on Directadmin and Plesk


author: Alexander Tishin <atishin@cloudlinux.com> - 3.4.1-1
changelog:
  - Fix Plesk FTP backup Attribute error
  - DEF-12727 Fix Acronis 'usage'
  - DEF-12683 Make Acronis' backup listing an error-tolerant


author: Alexander Tishin <atishin@cloudlinux.com> - 3.5.0-1
changelog:
  - DEF-7346 Add flag/config to disable FTP backups processing
  - DEF-12736 Check if we have enough space before any FTP download
  - DEF-12737 Delete FTP backups archive on close
  - DEF-12738 Add ability to specify a custom directory for FTP downloads
  - DEF-12893 Add User Agent for Acronis backend requests


author: Egor Zvorykin <ezvorykin@cloudlinux.com> - 3.6.0-1
changelog:
  - DEF-13839 Acronis backup should be able to restore more than 100 files
  - DEF-14070 Fix ValueError: commonpath() arg is an empty sequence
  - DEF-13970 cloudlinux-backup-utils: async_check blocks the loop
  - DEF-13602 Support restoring files with the same name in a single batch
  - DEF-13475 Restore multiple files: Acronis
  - DEF-13953 Wrong login redirect URL
  - DEF-13687 Fix permissions for logrotate / cloudlinux-backup-utils
  - DEF-13472 Cache request results in AcronisRestoreSet._get_path_item
  - DEF-13116 Purge cron and logrotate configs after removing on Ubuntu


author: Maksim Kanushin <mkanushin@cloudlinux.com> - 3.7.0-1
changelog:
  - DEF-12242 Update to support Python 3.8
  - DEF-14845 Fix Acronis backup/plans API response processing


author: Alexander Tishin <atishin@cloudlinux.com> - 3.7.1-1
changelog:
  - DEF-14562 improve test coverage up to 75 percents
  - DEF-15076 cloudlinux-backup-utils: raise a special exception on unauthorized error for Acronis


author: Alexander Tishin <atishin@cloudlinux.com> - 3.9.0-1
changelog:
  - DEF-18719 Add zstd compressed tar support
  - DEF-19309 Include non-client domains to backup list on Plesk when user filter is applied


author: Igor Savenko <bliss@cloudlinux.com> 0.2-5
changelog:
  - Bugfix: Make cloudlinux-file-change-collector PID file non-world writeable
  - Bugfix: fixed log write sentence


author: Igor Savenko <bliss@cloudlinux.com> 0.3-3
changelog:
  - DEF-17485: Adjust default config values
  - DEF-17484: Inner reader should flush all events it read from the buffer


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-1.11.1
changelog:
  - Added hook for fixing Plesk work with enabled linksafe protection
  - Fixed work of linksafe configuration for 2.6.18 kernel
  - Fixed creation of fs.protected_*links_create parameters in /etc/sysctl.conf
  - Fixed fs.protected_* parameters cleanup during package uninstallation


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-1.20
changelog:
  - AL-2064: Add psaadm user to linksafe group on Plesk Onyx
  - AL-2069: Fix alt-* packages files permissions correction


author: Stepan Oksanichenko <soksanichenko@cloudlinux.com> - 1-1.22
changelog:
  - CAG-714: cloudlinux-linksafe package should turn off symlink traversal protection by default. Part II


author:
  Stas Django <ssergiienko@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> - 1-1.23

changelog:
  - CAG-833: /scripts/postupcp issue (cloudlinux-linksafe?)
  - LU-482 Added root permission check to cl-linksafe-reconfigure


author: Jason Taylor <jtfas90@gmail.com> - 0.13.0.5-1
changelog:
  - Upstream bugfix release
  - Correction to spec license add MIT license
  - Added asciidoc BuildRequires and docdir files


author: Orion Poplawski <orion@cora.nwra.com> 1.8.12-5
changelog:
  - Use parallel make
  - Limit number of processors to 4 in parallel tests to avoid mpich issue with
    oversubscription


author: Orion Poplawski <orion@cora.nwra.com> - 1.8.12-6
changelog:
  - Add patch to add ppc64le to config.guess (bug #1080122)
  - Add patch to fix long double conversions on ppc64le (bug #1078173)
  - Run autoreconf for patches and to remove rpaths


author: Alexander Tishin <atishin@cloudlinux.com> 3.8.5-11
changelog:
  - DEF-6755 Fix ignore for malware_hashes in on-demand scan
  - DEF-6550 Fix error with previous scans
  - DEF-6616 Fix issue with creating a temporary file in /var/imunify360/tmp/ during a malware scan
  - DEF-6230 Fix "too many SQL variables" error when deleting malicious records
  - DEF-6092 Fix FileNotFoundError in scan.py/_need_to_scan
  - DEF-6541 Disable ClamAV false-positives in ImunifyAV
  - DEF-6607 Invalidate i18n files cache with every new release
  - DEF-6262 Disable logging of whitelisted files by hash filter
  - DEF-6539 On-demand malware scan start should wait until scan is started
  - DEF-6132 Use alt-python35 linked with alt-sqlite
  - ICPD-82 Make job for starting all stages of test process for php_i360
  - DEF-6550 Fix on_demand.symlinks RPM-test
  - DEF-6627 Fixture "malware_sample" called directly.
  - DEF-6242 Fix features error
  - DEF-6355 RPM-tests for on-demand queue and user list


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.10.1-1
changelog:
  - DEF-13218 RuntimeError: Symlink loop from '/home/imadco1'
  - DEF-13122 [AI-BOLIT] deobfuscator can't deobfuscate the sample 16af7e9809a2f631f9a1e3b3d7c4a849926bef8e5a4536907f433f9979e0b250
  - DEF-13211 [AI-BOLIT] Cleaning breaks the Bitrix site
  - DEF-13321 Exclude index.php only for Standalone malware execution (10001 4.9.6 and 11001 4.10.1+)
  - DEF-13176 [AI-BOLIT] Imunify 360 - php killed by SIGABRT ()
  - DEF-13204 [AI-BOLIT] php killed by SIGABRT
  - DEF-13249 Migration 145_move_quarantine failed with FileNotFoundError
  - DEF-13266 Can't get attribute 'State' error


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.10.2-1
changelog:
  - DEF-13404 Allow installing HardenedPHP on Oracle Linux
  - Bump specs to imunify360-php-i360-4.10.0-1.14, imunify360-php-i360-rules-4.10.0-7
  - DEF-13281 reproduce the "concurrent reset" issue
  - DEF-13281 guard against a concurrent cache reset
  - DEF-13357 test_malware.test_user_list.test_scan_status rpm test failed
  - DEF-13224 test_files_downloaded_file_by_file_corrupted_file may hang indefinitely
  - DEF-13207 test_ondemand_scan rpm test fails on multiple configurations
  - DEF-13361 malware user list shows the first scan date instead of the last
  - DEF-13190 Fix test_remoteip on configurations with cPanel


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.2.3-3
changelog:
  - DEF-8768 Fix lsof pat
  - DEF-8838: bump aibolit to 4.0.2-1
  - DEF-8420 Use koji repository in e2e tests to prevent issues related to gradual rollout


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.7-1
changelog:
  - DEF-9022 Allow 'week' and 'day' for MALWARE_SCAN_SCHEDULE.interval in AV+
  - DEF-9352 Implement --intensity which is joint of --intensity-cpu and --intensity-io


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.2-1
changelog:
  - Bump AI-BOLIT version to 4.1.2-3
  - DEF-9587 TypeError: <bound method MalwareAction.quarantine_hits_detect of <class 'im360.malwarelib.subsys.malware.MalwareAction'>> is not JSON serializable
  - DEF-9619: Enabled rapid scan in RPM tests
  - DEF-9554 Migration failed: 128_move_cleanup_storage_files (fix 2)


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.3-2
changelog:
  - DEF-9640 important fix
  - DEF-9593 `malware on-demand status` - `progress` is broken
  - DEF-9616 Fix modsec scan triggers on suspicious


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.3.4-2
changelog:
  - DEF-9575: process suspended support request
  - DEF-9611: Add imunify-antivirus activity to daily cron task


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.6-1
changelog:
  - DEF-5818 Fetching incidents is slow when using LIST filter
  - DEF-9770 Upgrading to 4.3 seems to be kind of “intrusive” when upgrading
  - DEF-9762 Add a config parameter that specifies the upper limit for the scanning file by Malware Scanner
  - DEF-9763 [AI-BOLIT] Add separate CLI parameter for AI-BOLIT for cloud-assisted scan
  - DEF-9792 Uncaught exceptions should be logged
  - DEF-9794 init_actions should not be used for non-critical tasks
  - DEF-9824 Restrict DB table malware_scans in size/ update 125 migration


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.4.1-1
changelog:
  - [DEF-9787] - IntegrityError: UNIQUE constraint failed: iplist.network_address, iplist.netmask, iplist.version
  - [DEF-10311] - error: bad character range 9-0 at position 84
  - [DEF-10328] - Suspicious files are not uploaded to IRMA (no uploaded events in mrs_events table)
  - [DEF-10429] - Do not set umask during agent start on CentOS6
  - [DEF-10431] - cPanel service manager restarts agent during migration
  - [DEF-10467] - Wrong symlink to malware_found.list on fresh install Centos6 cpanel
  - [DEF-10279] - imunify360: Add hard timeout for whole modsec script execution
  - [DEF-10466] - Add a link to low resource mode docs
  - [DEF-10472] - Update text description in the UI


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.2-2
changelog:
  - DEF-10328 - Suspicious files are not uploaded to IRMA (no uploaded events in mrs_events table)
  - DEF-10447 - Add encoding to im360 scripts


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.3-2
changelog:
  - DEF-10596 Handle expired AV+ license in UI
  - DEF-10469 AI-BOLIT supports new hash API format with verdicts


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.4.4-2
changelog:
  - DEF-10643 limit number of workers for default executor
  - DEF-10672 TypeError: sequence item 1: expected str instance, int found
  - DEF-10645 test_cloud_assisted_scan fails
  - DEF-10616 ImunifyAV memory consumption increased


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.5.1-2
changelog:
  - DEF-10835 Fix /var/imunify360/aibolit/run/*/pid: No such file or directory
  - DEF-10956 Security fix


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.6.1-1
changelog:
  - DEF-11306 master.test_malware.test_detached_scan_messages.test_malware_scan_messages_order[ordinary]


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.7.0-3
changelog:
  - DEF-11443 Do not enable/disable agent in systemd during registration
  - DEF-11542 Handle php parameters in ai-bolit go-wrapper
  - DEF-11543 ai-bolit wrapper: data collector paths mismatch
  - DEF-11611 Cleanup fails due to permissions of /var/imunify360/files/sigs/v1/aibolit/procu2.db
  - DEF-10853 Improve ionice management for the schedulers deadline and noop while running AI-BOLIT
  - DEF-10997 Update defaults for malware scanner settings for new installation
  - DEF-10438 [AI-BOLIT] PHP data collection script
  - DEF-10854 UI - add warnings if none of the limitation mechanics are supported
  - DEF-10891 Agent - return warnings if none of the limitation mechanics are supported
  - DEF-11010 Update defaults for malware scanner settings
  - DEF-11134 Provide ability to set limitations via LVE
  - DEF-11240 Update config file atomically
  - DEF-11319 Remove “Experimental” under Rapid Scan and update text
  - DEF-11448 Implement RPM test for scan intensity
  - DEF-11452 Install lve-wrappers automatically
  - DEF-11529 Use go-wrapper for AI-BOLIT
  - DEF-11530 Add executable bit to wrapper binary
  - DEF-11670 Integrate ai-bolit 20.0325


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.7.1-4
changelog:
  - DEF-11774 Use intensity settings from config as default to scan
  - Bump ai-bolit version
  - DEF-11632 Standalone ImAV has only 3 tabs in UI ( Files, History, Ignore list)


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.8.0-5
changelog:
  - DEF-11436 Plesk backups say "some minor issues occurred" due to permissions errors on file: .rapid-scan-db
  - DEF-11808 Security Message on Plesk due to /httpdocs/wp-content/.rapid-scan-db owned by "root"
  - DEF-10126 Failed to parse cleanup report: b'Loaded External DB
  - DEF-10432 OperationalError: user-defined function raised exception
  - DEF-10625 master.test_malware.test_cleanup.test_cleanup_not_blocking
  - DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
  - DEF-11275 Change progress tracking from finder to ai-bolit wrapper
  - DEF-11577 KeyError: 'MALWARE_SCANNING'
  - DEF-11604 SocketError: Socket for root not found.
  - DEF-11616 Error during registration when agent is not started
  - DEF-11662 test_malware_scan_task fails on Ubuntu + Plesk
  - DEF-11743 Detect crashed detached scan
  - DEF-11753 LicenseError: ImunifyAV+ license required
  - DEF-11794 FileExistsError: [Errno 17] File exists: '/var/imunify360/aibolit/run/177357b34f11468b97c9a03a1683a927'
  - DEF-11847 malware tests failed on AV (rpm-tests)
  - DEF-11879 test_detached_scan_messages.test_malware_scan_messages_order failed
  - DEF-11923 total_files always 0 from malware on-demand list output
  - DEF-11924 ValueError: invalid literal for int() with base 10: '12.5'
  - DEF-11938 test_hooks failed (RPM-tests)
  - DEF-11990 'user list' shows that user has no malware when malware exists, after interrupted scan
  - DEF-12138 UnicodeDecodeError: 'utf-8' codec can't decode byte 0x89 in position 0: invalid start byte
  - DEF-10639 [AI-BOLIT] Scan List Preparation inside ai-bolit
  - DEF-11233 Make clean-up results visible and clear for customers
  - DEF-10875 Need to make in Agent the switcher for using the internal scan list of files and externa(ai-bolit)
  - DEF-11357 Parametrize existing tests of on-demand scan to use internal/external finder
  - DEF-11358 Write test to cover external finder
  - DEF-11415 Hide "Upgrade" button in ImunifyAV via some option or parameter
  - DEF-11460 Update user's infected count only on user scan
  - DEF-11544 Probable race condition while cleaning up files
  - DEF-11719 Remove 'filelist' fixture from RPM-tests
  - DEF-11921 Add AI-BOLIT stderr/stdout to MalwareScan report for debug purposes
  - DEF-11985 Change MRS size limit exceeded error to warning
  - DEF-12040 test_ondemand_queue.TestQueueRemove.test_remove_any fails


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.9.0
changelog:
  - DEF-11677 Increase startup waiting timeout
  - DEF-12669 Remove clamav from /etc/cagefs/cagefs.mp
  - Bump ai-bolit version to 20.0601
  - DEF-12661 TypeError: unorderable types: NoneType() > int()
  - DEF-12635 Enable imunify360 service on every update
  - DEF-12500 Enable webshield-related rpm tests for generic panel
  - DEF-12627 Split cleanup file list by chunks
  - DEF-12274: Put realtime av scanner configs to files server
  - DEF-12455 add pytest-rerunfailures pytest-plugin
  - DEF-12609 Do not add koji repo for CL8
  - DEF-12387 Issues with Imunify uninstall
  - DEF-12575 Wait users to be removed from packages
  - DEF-12578: Fix validation error on RULE_DISABLED msg
  - DEF-9832 Exclude lightspeed cache folder from the list of scan folders
  - DEF-12514 several test_socket_activation rpm tests failed on multiple configurations
  - DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
  - DEF-9502 Add unit test for deploy.sh
  - DEF-12437: Add body size to correlation middleware metric
  - DEF-12323 increase count of attempts in test ossec_pam integration
  - DEF-12238: Prepare MRS for increased load
  - DEF-12524 Implement a rotation for CAPTCHA keys
  - DEF-12140 WebShield: add save new CAPTHA keys in agent's config. New UI fields
  - DEF-12288: persistent messages that are sent via Correlation UI are not delivered sometimes DEF-12288: Temporarely disable connection from limiting traffic
  - DEF-12339 Updated eula
  - DEF-11797 switcher for json/csv format of ai-bolit reports
  - DEF-12323 add rpm test to check ossec/pam integration (sshd)
  - DEF-12548 Remove some experimental badges in UI
  - DEF-12575 Remove account before package
  - DEFA-2606 Greylisting if AR and PAM are disabled. ossec 3.1.0-74
  - DEF-11931: Fix adding field to the wrong table
  - DEF-12486 Fixed test_dos_detector
  - DEF-12001 fix fields order in migration 143
  - DEF-12497 Update of Imunify360-firewall resets backup settings
  - DEF-12449 add timeout to SendMessageAPI
  - DEF-11291 Fix 'cmd' appears instead of 'args' for cleanup
  - DEF-9502 Update panel detection in deploy.sh
  - DEF-9612 [Sentry] `get-news` throws an error: "ParseError no element found: line 1, column 0"
  - DEF-12494 Fix ui e2e tests
  - DEF-12493 Make create_build.py work with new release pointers
  - DEF-12495: Add `system_id` field to the `/api/app-version-save` endpoint
  - DEF-12484: Update and enable dashboard recommendations
  - DEF-12454 New Caledonia Icon Flag Broken in IM360 UI
  - DEF-12265: Create /api/ip endpoint
  - DEF-12261 Added ossec-remoted to csf.pignore
  - DEF-11290 Fix 'default_action' and 'try_restore' appears in wrong place
  - DEF-11289 Fix 'cmd' appears instead of 'args'
  - DEF-12303 Change core version for Centos8 to support by kernelcare
  - DEF-12023 use machine readable format in extra_repos
  - DEF-12383 Warning in UI / Settings
  - DEF-11822 Do not acquire CSF lock for rules check
  - DEF-12416 LogReader should not write to console.log
  - DEF-12434: Add src_ip to xray requests and tables
  - DEF-12429 Update ignored regexps
  - DEF-12360 config.py defaults of rapid_scan and schedule interval should match imunify360.yaml
  - DEF-12271: Add verdicts on MRS to monitoring
  - DEF-12342 Do not fail installation if install-vendors fails
  - DEF-11904 Create rpc methods for enduser scan - cover with agent unit tests
  - DEF-12366 Imunify360 UI wont save changes to "Max Connections" & "Check delay" under Settings > General > DoS Protection
  - DEF-12250: Add license field in correlation API send-message endpoint
  - DEF-12414: Add jwt token check for xray
  - DEF-12208 add logging and finally_happened to first check in test_sa_hacker_trap_included
  - DEF-12456 Skip test_atomic_reload_custom_iplist for antivirus mode
  - DEF-12310 add basic integration test
  - DEF-12352 ValueError: invalid literal for int() with base 10: ''
  - DEF-11839 on-demand scan removes previously detected malware hits
  - DEF-12319 AttributeError: 'NoneType' object has no attribute 'process_message'
  - DEF-11937 Use swap to reset ipsets atomic
  - DEF-12324 Show a warning and disable "SMTP Traffic Management" in UI if a similar feature is provided by hosting panel
  - DEF-11195: src/smart-block reformat
  - DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
  - DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
  - DEF-12389 CentOS 8/CLOS 8/RHEL 8 support - create plesk image for ui e2e tests
  - DEF-12391 Purge ClamAV
  - DEF-12364: Fix modsec rules deploy on correlation-ui
  - DEF-12001 Add plugin MrProper and cleaners
  - DEF-12050: Notify agent that new autorules.yaml is ready
  - DEF-12373: PHP-daemon: error #503
  - DEF-12327: Fix bug in connection DEF-12327: Fix invalid fingerprinting
  - DEF-11195: Add black formatting for all subprojects
  - DEF-11195: src/mrs-services reformat
  - DEF-11195: src/integration-tests reformat
  - DEF-11195: src/git-doc reformat
  - DEF-11195: src/files reformat
  - DEF-11195: src/events reformat
  - DEF-12152 fix some texts
  - DEF-12152 restore-from-backup request should not block UI - UI part
  - DEF-11112 Update provision for Centos/CL8 generic panel
  - DEF-12210 Ensure fail2ban is running if enabled
  - DEF-12283 CentOS 8/CLOS 8/RHEL 8 support - create centos8-directadmin image for ui e2e tests
  - DEF-11397: Add files.imunify360.com to monitoring
  - DEF-12299 Rework "Wordpress Account Compromise Alert" page
  - DEF-11718 Bypass scan by trailing space in file name
  - DEF-11882 test_socket_activation.test_socket_activation_long_action failed
  - DEF-11111 Update provision for Centos/CL 8
  - DEF-11556: Check system_id query parameter in auth
  - DEF-9279 Remove Acronis agent if it was installed by us. Do not ask in i360deploy.sh
  - DEF-12327: Fix bug in connection
  - DEF-11556: system_id sync
  - DEF-12345: Write errors in parsing msg to warning
  - DEF-12124: Document deploy process for xray.js file
  - DEF-12011 client wants to use language that is different from the Plesk default language
  - DEF-12345: Write errors in parsing msg to warning
  - DEF-12129: add RPM tests to cover new imunify-realtime-av spec
  - DEF-7042 Hash in the DB does not match real file hash
  - DEF-12251: Send MongoDB collections sizes to monitoring
  - DEF-11556: Create temporary mock
  - DEF-11897: Deploy and check correlation-ui
  - DEF-12302 Fix retries in tests - zone.js do not seem to work in node
  - DEF-11731: Remove file from malware_standalone.list
  - DEF-12021: Impelement new end-point and new tables for saving of statistics about clients rpm packages
  - DEF-12151 restore-from-backup request should not block UI - agent part
  - DEF-12043 Set scan-depth=2 for app version detector
  - DEF-12034 fix switching ossec config on pam settings change
  - DEF-12276 Fix realtime scanner RPM tests
  - DEF-11840 Use new cloud for test images
  - DEF-11923 total_files always 0 from malware on-demand list output
  - DEF-11755 Bulk actions to blacklist/whitelist IPs - implement
  - DEF-11701: Setup monitoring to jenkins worker nodes
  - DEF-11329: Run correlation API with 4 workers
  - DEF-12239: Fix haproxy 502 errors
  - DEF-11110 CentOS 8/CLOS 8/RHEL 8 support - create image for ui e2e tests
  - DEF-12236 Link to settings from restore-from-quarantine modal do not remove modal backdrop in plesk
  - DEF-11840 Use nebula credentials from jenkins
  - DEF-11878 Allow to run e2e tests on dev-server
  - Revert "DEF-11510 Disable test_web_scanner in container"
  - DEF-11650 Typo in the UI PLESK in Imunify360 extension
  - DEF-12240: Return user scan endpoints
  - DEF-12138 Handle non-unicode symbols in ai-bolit output
  - DEF-12132 Typo in "WordPress Account Compomise"
  - DEF-12153: Cache the results of restore-from-backup
  - DEF-11812: Replace "--skip-root-owner" with "--skip-system-owner" ai-bolit paramter in the agent
  - DEF-11108 Add ability to build imunify package on Centos/CL 8
  - DEF-11290 Add default_action to MalwareScan report
  - DEF-11289 Add AI-BOLIT args to MalwareScan report
  - DEF-11291 Add procu2 args to MalwareCleanup report
  - DEF-11106 CentOS 8/CLOS 8/RHEL 8 support - deployscripts


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.9.2-2
changelog:
  - Bump ai-bolit version to 20.0619-1
  - DEF-12636 [AI-BOLIT] deobfuscator can't deobfuscate the sample 1848f147c179962d9626b8934f7d7503c74722adcaac4543eee952a406285390
  - DEF-12663 [AI-BOLIT] deobfuscator can't deobfuscate the sample 9575b0ddf36a146bec7d1e910f4aad05c61493df82eb0c3ef0bc17740516dfde
  - DEF-12716 [AI-BOLIT] deobfuscator can't deobfuscate the sample f4d3270906909dcf30c0f2394c8500bb654eca56918dbe8140d2a3223287f8de
  - DEF-12718 [AI-BOLIT] deobfuscator can't deobfuscate the sample 8ba86b71b3f3a66530fa8f99e9f27b872eb6377e27600bc4e183a03e2f9e6376
  - DEF-12749 [AI-BOLIT] Signature is hanging the cleanup
  - DEF-12767 IntegrityError: FOREIGN KEY constraint failed
  - DEF-12772 [AI-BOLIT] Change Priority Of Cloud Assisted scan for whitelist to have higher priority over blacklist
  - DEF-12822 [Suggestion] Ignoring maildir path


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.0-2
changelog:
  - DEF-13811 Restored from backup files still marked as infected
  - DEF-13725 Preview files from quarantine leads FileNotFoundError
  - DEF-13689 Malware ignore list is not escaped when compiled into the common exclude list


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.2.1-1
changelog:
  - DEF-13922 malware-scanning/started hook missing intensity data
  - DEF-13908 Strange ImunifyAV scan behavior


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.6-1
changelog:
  - DEF-13704 Error: Incorrect padding
  - DEF-14594 ScanFailed.command should be a list of strings
  - DEF-14690 pytest is killed repeatedly by OOM killer on Ubuntu 1GB
  - DEF-14777 test_ondemand_queue tests fail
  - DEF-14853 Creating /var/log/.log after the installation


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.6.0-2
changelog:
  - DEF-15778 (fix) don't use os.sync without a good reason
  - DEF-12933_change_accessibility_to_alt-php74-imunify_interpreter-5.6
  - DEF-15797 Move 'malware rebuild patterns' CLI schema to ImunifyAV
  - DEF-15774 Added AlmaLinux support
  - DEF-15671 `malware user scan` hangs if there are a lot of queued scans
  - DEF-14271 Use --username key for procu2 instead of privileges dropping


author: Alexander Tishyn <atishin@cloudlinux.com> 7.6.4-1
changelog:
  - DEF-24401 Fix scan queue stuck on avd/mds has been oom-killed
  - DEF-25301 Manual cleanup should bypass cleanup attempts limit/Error reporting improvements
  - DEF-27076 fix: Return the previous behaviour to save realtime scan hits


author: Dmitry Baynak <dbaynak@cloudlinux.com> - 2.1.0-1
changelog:
  - DEF-20444 RocksDB: fix write buffer size
  - DEF-20328 perform path.Clean on absolute paths in auditd messages


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.2.0-1
changelog:
  - DEF-20330: extend auditd stats with the scanner type upon malware detection
  - DEF-21781: Do not keep i360db open while idle
  - DEF-22298 constantly watch for auditd service state and rule presence


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.3.0-1
changelog:
  - DEF-23356 ignore write events to error_log
  - DEF-23377 reduce allocations by limiting paths count and removing strings.Trim


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.3.1-1
changelog:
  - DEF-23606 correctly check if key starts at the end of line
  - DEF-23607 do not remove rules when the file is deleted (it is done by auditd automatically)


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.4.0-1
changelog:
  - DEF-23637 report exact reason why log reader is not running
  - DEF-23866 add more sanity checks and additional stats on message parsing
  - DEF-23673 collect and send statistics on top noisy files that caused auditd events


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.5.0-1
changelog:
  - DEF-24295 Implement `filters` section so it is possible to filter events on path before storing them
  - DEF-24297 Support I360 agent configuration reload
  - DEF-24298 Develop a first set of filters for auditd-log-reader
  - DEF-24304 Move trace logging of auditd-log-reader out of syslog to file


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.6.0-1
changelog:
  - DEF-25106 send limited amount of events per hour (default for 500)
  - DEF-21829 remove obsolete stats fields
  - DEF-25120 improve config file  structure, auditd statistics collection and exclude more files


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.2-1
changelog:
  - DEF-25263 make send limit configurable
  - DEF-25280 support enriched auditd log format
  - DEF-25299 drop wordpress temp write test files


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.0-1
changelog:
  - DEF-26401 Store cron events for 1 day
  - DEF-26592 Report statistics when there are no auditd events for detected malware


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.1-1
changelog:
  - DEF-26869 Do not search for audit events when no malware found
  - DEF-26867 Keep up to 6 paths for audit events
  - DEF-26868: report failed to parse lines to Sentry. Limit error count in /var/log/messages


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.2-1
changelog:
  - DEF-27695 Fix crond events detection during filtering
  - DEF-27707 Track noisy files only when gathering top paths statistics


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.8.1-1
changelog:
  - DEF-27924: Correctly track statistics on sent messages and db rows
  - DEF-26875: Do not drop wp-cache events
  - DEF-28023: auditd-log-reader unit is now managed by i360-agent


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 2.8.3-1
changelog:
  - DEF-30200: add ability to set auditdctl custom fields to ignore mariadb/mysql generated events
  - DEF-30201: add public_html/wp-content/debug.log to auditd_exclude


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 2.9.0-1
changelog:
  - DEF-29441: add monitoring rules, add filters to send /etc/valiases/, /etc/vfilters, /etc/vdomainaliases paths to corrAPI
  - DEF-28525: add imunify-auditd-log-reader support for Debian and Ubuntu OSes
  - DEF-28084: store and send all events associated with /usr/local/cpanel/uapi


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 2.9.4-1
changelog:
  - DEF-32609: bump go version to 1.24
  - DEF-33474: read complete log lines before parsing (and drop CL6 support)
  - DEF-34634: validate incoming events against basedirs instead of key
  - DEF-34711: use general Imunify approach to set sentry tags


author: Arsenii Pastushenko <apasutshenko@cloudlinux.com> - 2.9.5-1
changelog:
  - DEF-35454: Throttle events processing to avoid extremely high performance overhead
  - DEF-36047: Do not log validate errors
  - DEF-36046: correctly manage auditd configuration file
  - DEF-36062: fix out of range panic in formEvent
  - DEF-36036: correctly handle stale PID file on startup


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 1.2.0-1
changelog:
  - Forbidden run without --key arg
  - Switch to the new imunify360 config path
  - Use commit hash in gerrit builds
  - Update license
  - Add README.md


author: Amit Levy <alevy@cloudlinux.com> - 1.3.7-2
changelog:
  - DEF-35549: Remove GetIgnoredPaths RPC
  - DEF-35523: use grpc stream for ignore list
  - DEF-35345 Add cli interface for grpc-client
  - DEF-35345 Add generic grpc client
  - DEF-35257 Add gRPC client for proactive ignore lists
  - DEF-35109 Read proactive whitelist data from redis datastorage on update


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 1.3.8-1
changelog:
  - DEF-35203: Make naming consistent and get rid of wrong repeated field
  - DEF-35281: Pick users from running Kubernetes pods and use application_id as username
  - DEF-35203: Edit proactive proto


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 1.3.2-2
changelog:
  - DEF-32946: Use dedicated functions for io operations; use delimiters for detecting garbage data
  - DEF-32946: rework fgw tests
  - DEF-32924 Fix incorrect file management by FGW cli


author: Danil Khabibullin <dkhabibullin@cloudlinux.com> - 1.3.4-8
changelog:
  - DEF-34419 Make rotatable JWT secret for proxy API
  - Fix uninstall process
  - DEF-31596 Add proxy server for rpc commands


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.0.2-1
changelog:
  - do not fail in the absence of a config file
  - fix first trigger period
  - implement pd_blocked_script integration test
  - Deliver event_id to custom script target
  - Update localization behaviour: search closest locale
  - Enable reporting based on agent config
  - Remove Jenkinsfile due to moving to unified unit tests job
  - Implement email delivery integration test.
  - Fix reading notify_from_email; update sendMailConsole
  - create integration tests for time triggerable events
  - create integration tests for manually triggered events
  - Update packaging: remove last_trigger.yaml file
  - Fix sendmail email sending
  - Verbose logging and update sentry error reporting


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.2.0-4
changelog:
  - Add unit test for template overriding
  - Add serverName to email subject
  - Collect imunify-notifier logs as artifacts
  - Update cron job generating
  - Add unit test for updateCronJob
  - Remove redundant Event interface
  - Add unit test for ConfigRulesUpdater
  - Increase unit test coverage for extractors
  - Add unit test for agent rpc calls
  - Automate integration tests with jenkins


author: Timur Irmatov <tirmatov@cloudlinux.com> - 2.0.0-1
changelog:
  - Update Go version to 1.16.3
  - Switch to the new imunify360 config path
  - Malware scan info is not filled at times
  - Proactive events extractor can skip events
  - Drop old tests, minor cleanups
  - Implement realtime scan event
  - Implement proactive defense events
  - Add new test flow, implement for malware
  - Add helper functions
  - Proactive events extractor fails to fetch user name
  - Fix "scan is already running"
  - Adjust extraction to new unified extractor
  - Add unified extractor
  - Copy extractors' database logic to agent package
  - Remove Rule interface


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 2.1.0-1
changelog:
  - Fix CentOS 6 detection
  - Fix SIGPIPE handling
  - Change sentry DSN
  - Silence empty body events
  - Use commit hash in gerrit builds


author: Mikhail Faraponov <mfaraponov@cloudlinux.com> - 2.1.6-1
changelog:
  - DEF-23058: Reduce number of sqlite accesses to database on empty payload
  - DEF-23050: Added graceful extractor sqlite3 connection shutdown


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 2.1.8-1
changelog:
  - Add reading of RealtimeAV config file
  - Integrate matching with with GlobTree
  - Switch to inotify if fchange api fails
  - Extract run-with-intensity


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 2.2.0-1
changelog:
  - Add deletion of old notify jobs through CLI
  - Add flock to service startup
  - Add cleanup statistics
  - Add stats sending to Correlation API
  - Add dependencies for /usr/bin/getconf
  - Add auxiliary packages
  - Extract error handling from watchers
  - Extract file change API logic to filechange package
  - Extract systemctl calls to service package
  - Fix assignment to entry in nil map
  - Upgrade dependencies


author: Timur Irmatov <tirmatov@cloudlinux.com> - 2.2.2-1
changelog:
  - Update cln-pub.key location
  - fix chainNode.patterns bug
  - do not fail if at least one unix.FanotifyMark ended with success


author: Timur Irmatov <tirmatov@cloudlinux.com> - 4.1.0-1
changelog:
  - Decrease number of events
  - Missing av-admin-paths.txt as empty
  - Update watcher API fallback policy


author: Timur Irmatov <tirmatov@cloudlinux.com> - 6.0.0-1
changelog:
  - Switch to the new imunify360 config path
  - Fix silent unit tests failures
  - remove cloudlinux-fchange package if 'optimize realtime scan' option becomes disabled
  - Fix integration tests and start them during package build
  - rewrite selectTargetAPI


author: Timur Irmatov <tirmatov@cloudlinux.com> - 7.0.0-12
changelog:
  - fix SIGPIPE handling
  - Add flushing and compacting storage on SIGUSR1
  - Remove supported marker on uninstall
  - Fix agent.UpdateConfig redundant JSON escaping
  - Fix audit support checking routine
  - Change auditd binary/service names
  - Add performance tests
  - Use our fork of go-libaudit
  - Adjust auditd-log-reader init.d script
  - Add init.d script for auditd-log-reader
  - Enable building rocksdb statically with auditd-log-reader
  - Add ability to provide config via cli arguments
  - Fix shutdown-related bug
  - Move default correlation API base URL to api package
  - Implement main processing routines
  - Add proc package
  - Remove appFs from realtimeav.ReadConfig arguments
  - Add AUDITD_FILES API method
  - Add merge operations buffer
  - Add event compaction filter
  - Add event merge operator
  - Add building RocksDB before unit tests
  - Add basic event storage logic
  - Extract Event structure from main package
  - Extract realtime config to realtimeav package
  - Add extracting malware files from Imunify360 DB
  - Fix warnings shown by go-staticcheck
  - Add extracting data from parsed audit event
  - Add log parser
  - Add tailing auditd log file
  - Add main log reader flow
  - Add functionality to check service status
  - Add functionality for Imunify360 config updates
  - Add LOGGER section to agent config
  - implement deciding whether feature is supported
  - fix reading plugin files
  - implement reading auditsp plugin config
  - implement reading audispd config
  - implement reading auditd config


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 7.1.0-1
changelog:
  - Change sentry DSN
  - Update license
  - Fix reading absent values in auditd config
  - Add sending logs to syslog
  - Add fallback parsing of /etc/system-release
  - Add creating PID file
  - Wait for filechange API to start after installation
  - Add README.md
  - Fix forming audit event without proctitle


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 7.1.4-1
changelog:
  - DEF-17530 adjust log reader goroutine flow
  - DEF-17483 close stdout when there's no need to read from it anymore
  - DEF-17523 Added synchronization for RocksDB wrapper and merge buffer


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 7.1.5-1
changelog:
  - DEF-17669: adjust merge operator and compaction filter logic to 'survive' through broken data
  - DEF-17525: extend Sentry tags
  - DEF-17528: silence config load failure when audit package is not installed
  - DEF-17528: silence 'key not found' error
  - DEF-17492: added cron job with daily cloudlinux-fchange package update
  - DEF-17524: introduce an upper limit LOG* files for RocksDB


author: Kondratev Pavel <pkondratyev@cloudlinux.com> - 7.1.7-1
changelog:
  - DEF-18431: Add rate limit for sentry (No space left on device)
  - DEF-18432: Add rate limit for sentry (auparse key not found)


author: Dmitry Baynak <dbaynak@cloudlinux.com> - 7.2.0-1
changelog:
  - DEF-20205: Real-time scanner watchers improvements
  - DEF-19802: imunify-realtime-av: implement FC API watcher that directly reads kernel interface


author: Alexander Tishin <atishin@cloudlinux.com> - 7.2.2-1
changelog:
  - DEF-22397 Use a separate inotify watcher for /var/spool/cron real-time scanning
  - DEF-22871 Fix panic on centos 6 when optimize_realtime_scan set to true
  - DEF-23079 Fix 'open /dev/.lxd-mounts: permission denied'


author: Timur Irmatov <tirmatov@cloudlinux.com> 4.0.0-2
changelog:
  - DEF-6224 Memory and CPU usage / footprints while scanning malware in Imunify A/V
  - DEF-7317 Raise nodejs version in rpm/deb specs (build dependencies)
  - DEF-7519 Handle certificates per IP correctly (give away certificate that belongs to this IP)
  - DEF-7533 Create screenshots for 100 server_ids (real) for dashboard
  - DEF-6059 Make webshield/wsshdict load tests
  - DEF-6696 Fix randomly failing nightly e2e tests on master
  - DEF-3287 Make sure /etc/sysconfig/kcare/systemid is correct
  - DEF-5514 New Dashboard - UI - Chart
  - DEF-6160 Expander with hideOnLoad=false should stay open for the same items
  - DEF-6428 Use i360deploy.sh to (un)install Imunify360 when (un)installation is done via the Plesk extension
  - DEF-6478 Refresh separate lines in tables instead of pages
  - DEF-6572 Don't quaranteen files owned by system users
  - DEF-6706 Upgrade Angular Material to >=6.4.2 to fix accessibility issues with form components
  - DEF-6710 Settings fields and other inputs should all have a label
  - DEF-6756 Do not ignore incidents from whitelisted IPs
  - DEF-6774 Fix/improve English version of i18n file and update others
  - DEF-6858 Blamer v0.1
  - DEF-6876 Add ability to enable and disable blamer on UID level
  - DEF-6877 Create whitelist testing for blamer
  - DEF-6882 Add ability to enable and disable blamer on UID level - UI
  - DEF-6883 Add ability to enable and disable blamer on UID level - Agent
  - DEF-6884 Add a button to enable / disable blamer in proactive defense - UI
  - DEF-6885 Add ability to enable/disable blamer in proactive defense on global level
  - DEF-6886 End-user configuration should be sent in SERVER_CONFIG message
  - DEF-6890 Improve messages related to Imunify360 products family on CL OS
  - DEF-6904 Outdated webshield self-signed SSL certificate
  - DEF-6909 Make load/functional tests for Webshield SSL functionality
  - DEF-6927 Use angular material overlay for news component in navigation
  - DEF-6964 Move blamer option to the imunify.config
  - DEF-7043 Fix labels in Proactive Defense mode radio group
  - DEF-7074 Update to angular 7
  - DEF-7082 Push WebShield version in sentry reports
  - DEF-7093 Do not quarantine mail
  - DEF-7157 Features management - hide switchers for users with packages
  - DEF-7160 Add ability to re-run behave tests without re-creating cPanel user each time
  - DEF-7193 Run unit tests at a RPM/DEB package build time
  - DEF-7200 Update agent to work correctly with ossec 3.1.0-3
  - DEF-7206 Make sure that same messages from different servers from sentry would be recorded in the same place
  - DEF-7271 Create cPanel extension for Feature management
  - DEF-7273 Add ability to check if cPanel version is correct/supported, don't support for version prior to 68
  - DEF-7274 Add CLI to disable native feature management
  - DEF-7276 initiate native feature management on user request
  - DEF-7277 Run disable feature management to uninstall package extension on package uninstall
  - DEF-7278 Automatically add IM360 extension to all new cPanel packages
  - DEF-7279 PERL: Implement cPanel hook to send imunify360 settings from package/account to IM360
  - DEF-7280 Add event processing for events from cPanel hooks
  - DEF-7281 Support to multiple values for antivirus in features management
  - DEF-7282 modify end user UI for malware scanning
  - DEF-7283 if native feature management supported -- don't show default settings in proactive defence for admin
  - DEF-7284 Modify Settings->Feature Management page when native feature management is supported
  - DEF-7320 Cover imunify360-firewall and imunify-antivirus packages conflicts with tests
  - DEF-7327 Split shared memory daemon to master and worker
  - DEF-7330 New Dashboard - UI - Map
  - DEF-7331 Sentry - move to a separate project
  - DEF-7332 Make separate sentry project for webshield
  - DEF-7337 Research angular unit tests
  - DEF-7342 Features management - rename cleanup to antivirus and add 3-states switcher for it
  - DEF-7343 New Dashboard - UI - add date range and data source filter
  - DEF-7344 New Dashboard - UI - connect to backend
  - DEF-7349 disable IM360 UI for end user if all the feature management options are disabled
  - DEF-7436 Create schema for new commands
  - DEF-7437 Disable internal feature-management when native one is enabled
  - DEF-7469 HackerTrap access to malware found lists
  - DEF-7487 New Dashboard - UI - Changes according to new design
  - DEF-7489 Remove submit of FP/FN via email
  - DEF-7515 New Dashboard - UI - change tooltip styles according to design
  - DEF-7525 Webshield: exclude ports for missing services
  - DEF-7534 Reserved space for changes for New feature management UI
  - DEF-7535 New Dashboard - UI - connect to backend - fix panel-related issues
  - DEF-7560 On cPanel account removal, remove user from imunify360 database
  - DEF-7563 add rpm tests for handling cPanel events
  - DEF-7604 Send first PING message right away after connection to server is made
  - DEF-7184 Make unit tests work on MacOS X
  - DEF-7319 Enable end-user UI for "webmaster" role in Plesk
  - DEF-5523 Malware Scanner newline character bypass
  - DEF-6952 Remove ossec service handling from imunify-antivirus init script
  - DEF-7035 Fix language detection (detect dialects correctly)
  - DEF-6908 MALWARE_CLEANUP section not present in config show, so ui is broken for av/av+
  - DEF-6961 Imunify360 plugin in DirectAdmin is stuck (100% CPU)
  - DEF-6963 CloudLinux is incorrectly detected when selecting HardenedPHP implementation
  - DEF-6996 Fix issue with IP input in Safari
  - DEF-7153 Fix "can not find translation key" errors
  - DEF-7167 Investigate why upgrade of imunify360-firewall-cpanel doesn't always work correctly
  - DEF-7314 Fix failing tests due to news component
  - DEF-7315 Fix slack reporter for tests
  - DEF-7409 Investigate and fix route guards
  - DEF-7433 non-root "config show" should return root's value if user hasn't changed it yet
  - DEF-6117 GeoIP data is incorrectly imported sometimes
  - DEF-6358 Fix minor styles issue on the Scan page
  - DEF-6691 Fix datepicker css in some languages
  - DEF-6504 test_remoteip failure
  - DEF-6936 Create script for jenkins that would measure resource usage and report it in jenkins
  - DEF-6967 User creation can fail on Plesk
  - DEF-7191 PanelError: Certificate is not ready for panel.site:52223
  - DEF-7257 Fix rpm-tests for ImAV (ansible)
  - DEF-7311 Stop iptables on CentOS6 task fails
  - DEF-7682 Apply default FM config to existing FM users
  - DEF-7698 KeyError: 'malicious' in test_malware.test_user_list.test_infected_count
  - DEF-7697 remove TestNativeFeatureManagement tests
  - DEF-7669 Fixed feature management hook
  - DEF-7661 Removed test_cpanel_hooks - not needed


author: Timur Irmatov <tirmatov@cloudlinux.com> 4.0.1-1
changelog:
  - DEF-7711 113_move_quarantined_files migration fails with UnicodeDecodeError
  - DEF-7230 Do not display 'N still infected'
  - DEF-7737 Fix itertools import in utils
  - DEF-7711 Fix UnicodeDecodeError during cleanup
  - DEF-7741 Migration to fix config
  - DEF-7749 Run 113_move_quarantined_files migration only once


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.0.2-4
changelog:
  - DEF-7867: leave alt-php71-mbstring package when removing hardenedd-php
  - DEF-7791: Use DNAT instead of REDIRECT
  - DEF-7762 Fix the use of i360deploy.sh in plesk extension
  - DEF-7439 Cover Plesk Marketplace installation/upgrade/removal with rpm tests
  - DEF-7790: yum remove imunify360-firewall does not remove ossec-hids fix requires for imunify360-ossec-server and psmisc
  - DEF-7714: use alt-sqlite instead of system sqlite
  - DEF-7106 Use IPvXNetwork instead of str
  - [DEF-7703] Add system folders/files of ImunifyAV for Plesk into ignore list of Imunify360
  - [DEF-7595] Failed test: test_malware_scanner.test_pure_ftp_scanner
  - DEF-7826 AI-BOLIT should use mbstring PHP module
  - DEF-7739 Files still ignored on reinfection and supported issues
  - DEF-7660 fix KeyError: '_PACKAGE_EXTENSIONS' in rpm test


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.0.5-1
changelog:
  - DEF-7968: fixed cache for CSF allow/ignore lists
  - DEF-7973: Fixed edit with zero expiration
  - DEF-7978: Fixed TypeError in WhitelistClientUnblock
  - DEF-7981 fix "unable to modify TTL and comment"


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.0.6-2
changelog:
  - DEF-8007 remove check_users from imav_deploy.sh
  - DEF-7948 Imunify360 Cleanup File - Arbitrary File Overwrite
  - DEF-7980 Imunify360 Restore Original File - Arbitrary File Overwrite


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.0.7-1
changelog:
  - DEF-8011 Webshield experiences memory leakage (problem with certificates)
  - DEF-7953 [AI-Bolit] Do not load i360.so while running AI-BOLIT


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.0.8-2
changelog:
  - DEF-7777 Bug report, around 1k emails are marked as infected.
  - DEF-8033 Broken dashboard interface on Firefox 56
  - DEF-8041 Old links in UI
  - DEF-8058 [Errno 24] Too many open files
  - DEF-8086 Imunify360 not visible in DA in template Evolutiuon
  - DEF-8101 V/v malware ignore delete in Malware scanner
  - DEF-8080 ssl-caching daemon crashes when cannot open a certificate
  - DEF-8096 Make sure files over 2MB are uploadable via Webshield
  - DEF-8110 sentrylogs can use up to 6000 threads and more.
  - DEF-8045 Fix upload to MRS


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.1.0-5
changelog:
  - DEF-8118 test_service_start_on_ossec_fail.test_ossec_good_stop_start_im360 fails
  - DEF-7895 Failed test_modsec_rules_disabling (RPM-tests)
  - DEF-8073 test teardown failure for test_migrations.test_noop_migration
  - DEF-8158 test_watchdog.test_health_bad fails
  - DEF-8165 Increase priorities for CaptchaDosAlert & SynclistResponse messages
  - DEF-8159 test_rules_restored.test_existing_chain_on_startup failed
  - DEF-7230 The removed threats still are listed
  - DEF-7732 i360 already loaded error
  - DEF-7777 Bug report, around 1k emails are marked as infected.
  - DEF-7781 [IM360] - Cleaning the files in the interface does not work
  - DEF-7871 Hide "quarantine" option in "status" filter in Malicious files list in ImunifyAV
  - DEF-7991 Imunify errors and fails to start after update
  - DEF-8033 Broken dashboard interface on Firefox 56
  - DEF-8041 Old links in UI
  - DEF-8058 [Errno 24] Too many open files
  - DEF-8086 Imunify360 not visible in DA in template Evolutiuon
  - DEF-8101 V/v malware ignore delete in Malware scanner
  - DEF-5836 ['/usr/sbin/cagefsctl', '--update-etc', 'towthatc'] failed with rc [1]
  - DEF-5955 IntegrityError: columns network_address, netmask, version are not unique
  - DEF-5990 ValueError: Broken message in ossec json log: {"rule":{"level":3,"group":"dovecot,authentication_success,","c...
  - DEF-6166 eula update error: aiohttp error for url https://files.imunify360.com/static/eula/v1/description....
  - DEF-6765 Remove _check_modsec from conflicts plugin
  - DEF-6957 Reproduce & fix "Installing Imunify360 breaks OWASP configuration"
  - DEF-6970 Do not try to add modsec vendor if it already exists in cPanel
  - DEF-7085 CheckRunError: Command ipset add i360.ipv4.graylist 78.140.7.239/32 timeout 43199 -exist returned non-zero code 1,
  - DEF-7246 Convert e2e tests to the new format: fix "Infected exploits are detected successfully"
  - DEF-7363 CheckRunError: Command /usr/sbin/httpd -M returned non-zero code 1,
  - DEF-7440 Sometimes agent doesn't stopped properly.
  - DEF-7496 Multiple RPM test failures caused by MySQL service down (and WHMAPI failures)
  - DEF-7612 JSONDecodeError: Expecting value: line 1 column 1 (char 0)
  - DEF-7665 Command `csf --restartall` performs long and sometimes fails
  - DEF-7680 Plesk: Imunify360 extension installation issues
  - DEF-7681 Message sometimes printed incorrectly in logs
  - DEF-7743 Fix instantiate-vm.ts script - it hangs sometimes
  - DEF-7753 many pytest tests fail if run after behave tests due to vhost_ready() failure
  - DEF-7758 Fix country translation in group delete confirmation dialog in blacklist
  - DEF-7773 Fix send-to-slack.sh reporter
  - DEF-7778 We shouldn't send an event in Sentry for 401 responses
  - DEF-7802 Imunify360 can hang during startup due to csf integration
  - DEF-7847 Check and fix/disable failing e2e tests on master
  - DEF-7861 WHMAPIException: whmapi getpkginfo command failed: Failed to load package “Cloud I”: No such file or directory
  - DEF-7865 Imunify360 can break apache config on Plesk during uninstall
  - DEF-7879 IP addresses in ipset and webshield are not in sync
  - DEF-7881 Failed test_malware.test_user_list.test_infected (from pytest)
  - DEF-7980 Imunify360 Restore Original File - Arbitrary File Overwrite
  - DEF-8059 Migration 120_scheduled_scan fails during RPM tests
  - DEF-8068 Fix styles for input in dashboard
  - DEF-8095 Failed test_noop_migration (RPM-test)
  - DEF-8096 Make sure files over 2MB are uploadable via Webshield
  - DEF-8142 Quarantine file is partially overwritten on reinfection
  - DEF-6567 IM360 Agent Watchdog
  - DEF-6896 Create 'light' version of RPM tests to run on every commit
  - DEF-7080 Compare implementations for storing IPs, subnets & extra data
  - DEF-7431 Do not disable ClamAV scan when hiding its results
  - DEF-7526 WCAG - improve tests coverage for A level & add tests for AA
  - DEF-7573 Make webshield use new LPC tries functionality
  - DEF-7623 Remove remaining CLI calls from tests
  - DEF-7633 Open source ImunifyAV UI - EULA should only be a part of AV+?
  - DEF-7634 Open source ImunifyAV UI - handle a case when AV+ is registered, but cleanup code is not installed yet
  - DEF-7635 Open source ImunifyAV UI - check sources for any information that we might not want to open source
  - DEF-7637 Refactor news component for new feature
  - DEF-7659 test_malware.test_cleanup.test_keep_in_quarntine[quarantine-quarantined] (from pytest) failed
  - DEF-7668 Requesting admin contacts
  - DEF-7676 Add explicit dependency on clamav-data
  - DEF-7685 Webshield: upstream sent too big header while reading response header from upstream
  - DEF-7708 Cleanup after removing malicious field from malware on-demand list
  - DEF-7736 Show only latest scan threats in user list
  - DEF-7776 Speed up imunify360 installation: optimize getdb import
  - DEF-7793 Multi-server dashboard - UI
  - DEF-7856 Clean proactive table in DataBase periodically with same rules as incidents
  - DEF-7863 Improve license page
  - DEF-7880 Add debug info about problems with "Already running instance of agent"
  - DEF-7892 Multi-server dashboard - server
  - DEF-7893 [Malware Scanner] Background/Scheduled Scanning
  - DEF-7897 [Malware Scanner] Background/Scheduled Scanning - UI
  - DEF-7909 Obtain admin contact from panel
  - DEF-7943 Requesting admin contact - config
  - DEF-7948 Imunify360 Cleanup File - Arbitrary File Overwrite
  - DEF-7953 [AI-Bolit] Do not load i360.so while running AI-BOLIT
  - DEF-8002 Send IP addresses to webshield shared memory as addresses
  - DEF-8024 Align dashboard data with the start of the day in client's timezone - UI
  - DEF-8032 EULA update
  - DEF-8045 Fix upload to MRS


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 1.0.3-1
changelog:
  - DEF-421 Add CSF exception for agent
  - DEF-417 Fix registration key prefix
  - DEF-404 CLN regkey prefix issues


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.10.1-1
changelog:
  - DEF-13218 RuntimeError: Symlink loop from '/home/imadco1'
  - DEF-13236 When PD try to figure out what is php version, and other php parameters need extra check if php return correct strings
  - DEF-13247 Add new line to src/asyncclient/other/imunify360.cron.d
  - DEF-13248 FileNotFoundError: [Errno 2] No such file or directory: '/var/imunify360/files/php-immunity/v1/description.json'
  - DEF-13265 Path should be removed from HackerTrap after successful cleanup
  - DEF-13271 Reset HackerTrap on agent restart
  - DEF-13328 "app_version_info" table is empty
  - DEF-13122 [AI-BOLIT] deobfuscator can't deobfuscate the sample 16af7e9809a2f631f9a1e3b3d7c4a849926bef8e5a4536907f433f9979e0b250
  - DEF-13198 Make separate rule for blocking standalone malware
  - DEF-13211 [AI-BOLIT] Cleaning breaks the Bitrix site
  - DEF-13321 Exclude index.php only for Standalone malware execution (10001 4.9.6 and 11001 4.10.1+)
  - DEF-13176 [AI-BOLIT] Imunify 360 - php killed by SIGABRT ()
  - DEF-13204 [AI-BOLIT] php killed by SIGABRT
  - DEF-13249 Migration 145_move_quarantine failed with FileNotFoundError
  - DEF-13266 Can't get attribute 'State' error


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.0-2
changelog:
  - DEF-8145 Fix test_hooks.test_malware_scanning_finished
  - DEF-8145 An error is not logged if the agent is misconfigured
  - DEF-8398 Make ClamAV binary configurable
  - DEF-8317: Fixed test_csf_integration
  - DEF-8605 test_malware.test_user_list.test_scan_status fails
  - DEF-8608: skip test on Ubuntu 16.04 1k-users
  - DEF-8526 test_malware.test_malware_scanner.test_pure_ftp_scanner fails in RPM tests
  - DEF-8604 test_malware.test_quarantine.test_reinfection fails
  - DEF-8600 test_malware.test_malware_scanner.test_web_scanner fails
  - DEF-8595 "malware malicious restore-from-backup" does not work
  - DEF-8607 skip 'agent' event in ImunifyAV
  - DEF-7732 i360 already loaded error
  - DEF-7872 Hide ImunifyAV item in reseller menu in WHM
  - DEF-7876 Proactive defense working? (Failed IPTABLES commands list issue)
  - DEF-8156 [Feature Request] Allow admin to disable ignore list at end user level
  - DEF-8169 Issue with Imunify360 installation on Ubuntu18 (PLESK)
  - DEF-8272 [Feature Request] Disable Contact Support in the config
  - DEF-8279 The problem is with the email field validator
  - DEF-8281 SSL is not working, issue with Cloudflare FULL Strict cert
  - DEF-5736 Feature's status (installing/uninstalling) tracking mechanism is unreliable
  - DEF-6605 Deploy-script with --uninstall flag should remove all ImunifyAV/Imunify360 requirements
  - DEF-7105 TypeError: a bytes-like object is required, not 'str'
  - DEF-7126 WebshieldDictException: send error: [Errno 111] Connection refused
  - DEF-7461 New Dashboard - UI - Map - fix truncated pins (near sides of the map)
  - DEF-7735 rpm test failure: "database is locked" in on_demand.malware_hashes.Malware hashes applied during on demand scan.Malware hash list command shows added hashes
  - DEF-7756 handle response from FeaturesManagementAPI.editUserFeatures
  - DEF-7802 Imunify360 can hang during startup due to csf integration
  - DEF-7838 Fix regular crashes of Visual Review server on Jenkins node
  - DEF-7902 Failed test_configuration_management.test_managing_modsec_directives[SecAuditEngine-Off] (from pytest)
  - DEF-7911 Incorrect count in blocked ports?
  - DEF-7946 test_webshield fails on ubuntu configurations
  - DEF-8013 TypeError: modsec_get_directive() takes 1 positional argument but 2 were given
  - DEF-8014 Error: {"reason":"Can not find translation","key":"userside.history.malware.events.submited_for_analysis"}
  - DEF-8017 TypeError: read_file() missing 1 required positional argument: 'path'
  - DEF-8049 Bug from https://sentry.cloudlinux.com/sentry/imunify360-ui/issues/4729709/?referrer=slack
  - DEF-8071 modsec audit log is not parsed properly sometimes
  - DEF-8075 test_malware.test_cleanup.test_keep_in_quarntine[quarantine-quarantined] RPM test fails
  - DEF-8076 When uninstall agent we do not uninstall vendor and brake apache (cPanel)
  - DEF-8092 test_rules_restored.test_existing_chain_on_startup failed
  - DEF-8093 Not all files are detected by black hash filter
  - DEF-8097 cPanel hooks should be executed sequentially for a given target (user) (test_cpanel_events.test_account_is_modified fails)
  - DEF-8099 AttributeError: 'SubprocessError' object has no attribute 'stderr'
  - DEF-8111 geodb is updated but the corresponding country ipset is not
  - DEF-8163 test_malware.test_user_list.test_infected failed
  - DEF-8166 Failed test_modsec_vendor_install.test_correct_vendor_installed_plesk
  - DEF-8168 test_malware failed due to missing 'HOME' in env
  - DEF-8205 license_type is not available from UI
  - DEF-8225 OperationalError: too many SQL variables
  - DEF-8228 Quarantined file can't be uploaded to MRS
  - DEF-8257 Do not include unit tests into imunify package
  - DEF-8296 test_malware_user_list unit tests fail sometimes: "jsonschema.exceptions.ValidationError: 'scan_type' is a required property"
  - DEF-8313 When upgrading webshield from 1.6 to 1.7 version on Ubuntu it failed to start
  - DEF-8327 CL + cPanel + 1k users: test_cagefs_split_configs: AssertionError
  - DEF-8352 KeyError: 'url'
  - DEF-8361 RuntimeError: coroutine raised StopIteration
  - DEF-8362 cron file should contain PATH or we should use absolute paths (imunify360-watchdog)
  - DEF-8392 test_malware failed (rpm-test)
  - DEF-8393 Failed whitelisted_ip_after_login.Whitelisting ip after login.ensure that user access to panel is whitelisting ip -- @1.1
  - DEF-8419 Fix link in restore from quarantine modal window
  - DEF-8427 Fix looped cpanel hooks
  - DEF-8428 AttributeError: 'set' object has no attribute 'extend'
  - DEF-8462 AttributeError: 'cPanel' object has no attribute 'pure_ftp_conf_cls'
  - DEF-8463 Failed test_malware.test_cleanup (RPM tests) (Directadmin)
  - DEF-8483 Fix Rpc caller service exec should work even if response is divided into several packets
  - DEF-8499 inotify.new_account.Newly created account is automatically added to inotify.Inotify automatically starts watching newly created account
  - DEF-8526 test_malware.test_malware_scanner.test_pure_ftp_scanner fails in RPM tests
  - DEF-8544 Webshield is not picking up panel certificate for cPanel & LiteSpeed
  - DEF-8577 NameError: name 'itertools' is not defined
  - DEF-8584 Endpoint not found for RPC method "backup-systems init"
  - DEF-8595 "malware malicious restore-from-backup" does not work
  - DEF-8600 test_malware.test_malware_scanner.test_web_scanner fails
  - DEF-8601 Failure during provisioning on disabling Sentry reporting
  - DEF-8602 Failure during provisioning on rebooting server
  - DEF-8605 test_malware.test_user_list.test_scan_status fails
  - DEF-8607 test_hooks failed on AV
  - DEF-8610 inotify.new_account, malware_read rpm-tests failed
  - DEF-4905 Improve news component - use RSS to extract news
  - DEF-6370 Plesk mod_security settings
  - DEF-7301 No running process for ImunifyAV when it is not in use - EL7/systemd
  - DEF-7347 Re-work e2e tests as functional/unit & api tests
  - DEF-7377 No running process for ImunifyAV when it is not in use - EL6/separate binary
  - DEF-7578 Optimize SSL processing
  - DEF-7635 Open source ImunifyAV UI - check sources for any information that we might not want to open source
  - DEF-7652 Re-work e2e tests as functional/unit & api tests - add validation to agent's responses
  - DEF-7667 Re-use a11y tests code for VR tests
  - DEF-7702 create a test for ossec
  - DEF-7825 Re-work e2e tests as functional/unit & api tests - fix small issues (marked with FIXME)
  - DEF-7908 prevent regression in memory consumption for imunify-antivirus
  - DEF-7933 Add webshield instance to integration tests
  - DEF-7936 Silence warnings about inconsistent firewall rules
  - DEF-7963 Set typical values with flags, not string values
  - DEF-7964 Add our Jenkins jobs with tests to build.cloudlinux.com to make sure our tests run on every release build
  - DEF-8001 user configs stored in /etc/imunify360/user_configs lead to quadratic increase in disk usage with increase in user count
  - DEF-8023 Purge Heuristic scan
  - DEF-8074 pytest complains about yaml.load() without Loader=...; possible security issue
  - DEF-8098 Create multiconfiguration job to test ImunifyAV
  - DEF-8102 Add `scan_id` to `malicious list` output
  - DEF-8139 ossec active response UI / enable / disable -- backend part
  - DEF-8144 Add hook management functionality
  - DEF-8145 Plugin to execute hooks
  - DEF-8146 Native hooks
  - DEF-8179 Dashboard - add recommendations
  - DEF-8181 Dashboard - numbers above charts
  - DEF-8182 Reputation management - update UI
  - DEF-8200 Record the time of last 'full' scan per user
  - DEF-8204 update icons and descriptions in Plesk extension
  - DEF-8207 Recursive symlink does not break the scanner case fails
  - DEF-8209 Split HostingPanel code
  - DEF-8210 Remove client360 plugin dependency to (almost) all kind of messages
  - DEF-8211 Move CSF integration to corresponding plugins
  - DEF-8212 Create separate package for imunify360-only code
  - DEF-8213 Move 360 plugins to separate package
  - DEF-8214 Move 360 endpoints to separate package
  - DEF-8219 Remove ip whitelist middleware
  - DEF-8220 Remove KernelCare/HardenedPHP handling from CLN class
  - DEF-8230 Dashboard - add malware chart - server
  - DEF-8239 Update behave rpm-tests which use unoptimized steps
  - DEF-8260 Review and apply new translations
  - DEF-8261 Remove client360 plugin dependency on received messages
  - DEF-8316 Replace "Lists" in the global menu with "Firewall" item
  - DEF-8317 Disable integration with CSF via settings
  - DEF-8323 Reputation management - update agent
  - DEF-8372 ossec active response UI / enable / disable
  - DEF-8395 Fix warning at the end of unit test run
  - DEF-8417 Move firewall code into im360 package
  - DEF-8422 Fix description for "Alerts total"
  - DEF-8424 Adjust intensity level and resource consumption while scanning with AI-BOLIT (nice / ionice)
  - DEF-8435 Move defence360/api/ips.py into im360 package
  - DEF-8436 Move defence360agent/model/cache_sources.py into im360 package
  - DEF-8443 Cancel background scanning when settings are changed
  - DEF-8446 Move defence360agent.subsys.features into im360
  - DEF-8471 Add a triangle to autocomplete in dashboard
  - DEF-8489 Remove messages class dependencies from the_sink.py
  - DEF-8516 Make RPC handlers registration explicit
  - DEF-8531 Add to release of agent 4.2.0 new package of proactive defence 4.2.0
  - DEF-8536 Disable integration with CSF via settings - UI


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.0-3
changelog:
  - DEF-7792: Plesk - display installation progress in UI
  - DEF-8480 extend UI tests for intensity level sliders
  - DEF-8480 Adjust intensity level and resource consumption while scanning with AI-BOLIT (nice / ionice) - UI
  - DEF-8358 Screen resolution and other browser's parameters reporting to CH


author: Timur Irmatov <tirmatov@cloudlinux.com> 4.2.2-1
changelog:
  - DEF-8629 Waiting captcha instead of reading the log in captcha behave test
  - DEF-8731 Fixed chkserv config
  - DEF-8757 Fix missing Sentry tags
  - DEF-8687 imunify360 is scanning php session files too
  - DEF-8758 Failed to find '('Duplicate submission to Revisium',)' in 300 seconds


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.2.3-3
changelog:
  - DEF-8761 Sometimes Apache-Error line dosn't have ModSecurity part so we've added condition to handle it
  - DEF-8768 Fix lsof pat
  - Bump ossec version to 3.1.0-29
  - DEF-8838: bump aibolit to 4.0.2-1
  - DEF-8845: bump webshield version to 1.7-12
  - DEF-8836: bump i360-php to 4.2.0-1.20
  - DEF-8420 Use koji repository in e2e tests to prevent issues related to gradual rollout
  - DEF-7932 alert's processing is stopped for manually added ips
  - DEF-8716: Adapted for new Ubuntu 18 image


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.2.4-1
changelog:
  - DEF-8922: bump php-i360 version to 4.2.2-1.2
  - DEF-8919: bump ossec version to 3.1.0-30
  - DEF-7450 minor fixes in Plesk extension
  - DEF-7450 update Plesk extension changelog and screenshots
  - DEF-8904 fix upgrade_url for ImunifyAV
  - DEF-8777 fix duplicated admin contacts modals after EULA


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.2.5-3
changelog:
  - DEF-7102: [RPM test failed] feature_hardened-php.Hardened-PHP feature.Install/remove hardened-php
  - DEF-8976 Fix test_multipackages.test_stable_develop
  - DEF-8928: KeyError 'license_type' add license_type = None if there is no valid token
  - DEF-8996 bump php-i360 version to 4.2.2-1.4
  - DEF-6849: Add updating directadmin license in provision
  - ICPD-437 Remove alt-php opcache from OS image (workaround)


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.2.6-4
changelog:
  - DEF-9121 update proactive (php-i360) to 4.2.5-1.1
  - DEF-8639 Investigate and fix agent response validation errors
  - DEF-8968 Check schema validation
  - DEF-8786 Additional properties are not allowed
  - DEF-9105 update proactive (php-i360) to 4.2.2-1.8
  - ICPD-489 Blamer file get filtered by CSF
  - ICPD-496 Improve hash calculation for event ID in the reducer algorithm
  - DEF-9098 update webshield to 1.7-13
  - DEF-9078 update ai-bolit to 4.0.3-1
  - DEF-9084 Disable native feature management in ImunifyAV/AV+
  - DEF-9089 remove news from av-client side


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.7-1
changelog:
  - DEF-9022 Allow 'week' and 'day' for MALWARE_SCAN_SCHEDULE.interval in AV+
  - DEF-9318 Support new format of modsec_audit.log in concurrent mode.
  - DEF-9352 Implement --intensity which is joint of --intensity-cpu and --intensity-io


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.0-2
changelog:
  - ICPD-543 Bump php-i360 version to 4.2.5-1.3
  - DEF-9353 test_web_scanner fails on multiple configurations


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.2-1
changelog:
  - Bump AI-BOLIT version to 4.1.2-3
  - DEF-9587 TypeError: <bound method MalwareAction.quarantine_hits_detect of <class 'im360.malwarelib.subsys.malware.MalwareAction'>> is not JSON serializable
  - Fixed ossec version in Requires
  - DEF-9619: Enabled rapid scan in RPM tests
  - DEF-9420: Fixed captcha_dos plugin
  - DEF-9554 Migration failed: 128_move_cleanup_storage_files (fix 2)
  - DEF-9564: wrong method for SensorAlert


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.3.4-2
changelog:
  - DEF-9704 treat expiration that is close to the current time as expired
  - DEF-9421: set max limit for ipset timeout value
  - DEF-9575: process suspended support request
  - DEF-9616 Modsec scan still broken
  - DEF-9597: fixed record captchados_alert


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.3.5-1
changelog:
  - DEF-9561 Support many volumes in acronis backup
  - DEF-9700 Cleanup 2 users at once - results disappear


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.2-2
changelog:
  - DEF-10328 - Suspicious files are not uploaded to IRMA (no uploaded events in mrs_events table)
  - DEF-10404 - Duplicated record added to malicious table after restore-original with enable_scan_inotify=true
  - DEF-10447 - Add encoding to im360 scripts
  - DEF-10522 - Updated pam and proactive defence deps


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.3-2
changelog:
  - DEF-10414 [AI-BOLIT] aibolit socket: Connection refused
  - DEF-10592 Do not drop packets on ports which not used by webshield
  - DEF-10418 [AI-BOLIT] Add logging to aibolit resident mode
  - DEF-10469 AI-BOLIT supports new hash API format with verdicts
  - DEF-10606 Revert modsec upload script to python version


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.4.4-2
changelog:
  - DEF-10643 limit number of workers for default executor
  - DEF-10702 fix error message for IPSetNotFoundError on ipset restore
  - Bump webshield version to 1.8-18
  - DEF-10672 TypeError: sequence item 1: expected str instance, int found
  - DEF-10453 fix test_pam
  - DEF-10645 test_cloud_assisted_scan fails


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.5.1-2
changelog:
  - DEF-10928 apache couldn't start due to selinux permissions of imunify files
  - DEF-10835 Fix /var/imunify360/aibolit/run/*/pid: No such file or directory
  - DEF-10956 Security fix
  - DEF-10931 Skip the sections in the integration.conf that are not mandatory


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.6.1-9
changelog:
  - DEF-11363 Getting invalid PROACTIVE_QUEUE_LIST messages on correlation server
  - DEF-11376 Proactive defense DB migration - incorrect order of fields
  - DEF-11328 After installing 360 dovecot logins getting failed on update
  - DEF-11398 Improve message for SMTP traffic conflict


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.7.0-3
changelog:
  - DEF-11317 master.test_smtp_blocking.test_rules_created_on_start[filter]
  - DEF-11443 Do not enable/disable agent in systemd during registration
  - DEF-11539 Rules update may overwrite edits in `123_Disable_WP_Redirect`
  - DEF-11542 Handle php parameters in ai-bolit go-wrapper
  - DEF-11543 ai-bolit wrapper: data collector paths mismatch
  - DEF-11597 test_modsec_redirect_with_compromised_wp_account failed in multiple configurations
  - DEF-11611 Cleanup fails due to permissions of /var/imunify360/files/sigs/v1/aibolit/procu2.db
  - DEF-11626 Clickhouse proactive_queue agent_rpm_version and agent_proto_ver are empty for all im360 v4.6.x events
  - DEF-11667 simple pass redirect does not work correctly on installations with reverse proxy
  - DEF-10362 WordPress Simple Password brute prevention
  - DEF-10853 Improve ionice management for the schedulers deadline and noop while running AI-BOLIT
  - DEF-10997 Update defaults for malware scanner settings for new installation
  - DEF-10438 [AI-BOLIT] PHP data collection script
  - DEF-10793 Send additional information to Clickhouse from modsec_audit.log
  - DEF-10854 UI - add warnings if none of the limitation mechanics are supported
  - DEF-10891 Agent - return warnings if none of the limitation mechanics are supported
  - DEF-11010 Update defaults for malware scanner settings
  - DEF-11021 Manage modsec rule depending on UI setting (activate/deactivate)
  - DEF-11133 Detect applicable limit mode on Agent startup (LVE / CGroups / ionice)
  - DEF-11134 Provide ability to set limitations via LVE
  - DEF-11240 Update config file atomically
  - DEF-11253 Change test_modsec_rules.test_modsec_rule_sensor_incident_creation to do not belong on log records
  - DEF-11295 Make brute-prevention page compatible with the new modsec rule
  - DEF-11297 Resolve exploitability in the https://security.imunify.com/ page
  - DEF-11319 Remove “Experimental” under Rapid Scan and update text
  - DEF-11382 modsec scan script leaves temporary files in upload-jobs
  - DEF-11448 Implement RPM test for scan intensity
  - DEF-11452 Install lve-wrappers automatically
  - DEF-11529 Use go-wrapper for AI-BOLIT
  - DEF-11530 Add executable bit to wrapper binary
  - DEF-11538 Move proactive socket to /opt - PHP daemon
  - DEF-11633 Add "experimental" label to wordpress account compromise prevention option in settings
  - DEF-11666 minidaemon: allow new socket location for proactive defence
  - DEF-11670 Integrate ai-bolit 20.0325
  - DEF-11673 Implement new redirect strategy for brute prevention.
  - DEF-11675 Remove "EXPERIMENTAL" from the clean-up elements


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.7.1-4
changelog:
  - DEF-11774 Use intensity settings from config as default to scan
  - Bump ai-bolit and imunify360-php-i360 versions
  - DEF-11632 Standalone ImAV has only 3 tabs in UI ( Files, History, Ignore list)


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.7.2-2
changelog:
  - DEF-11853 update proactive defence package
  - Bump imunify-realtime-av to 1.0.4-1
  - DEF-11820 Return warning about csf in smtp blocking config section
  - Update deploy scripts


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.7.3-3
changelog:
  - DEF-12012 Limit notify queue size for aibolit
  - DEF-11994 Do not remove php repos on update
  - Bump webshield to 1.11-1
  - DEF-11941 Don't try to use LVE on non-CL systems
  - DEF-11968 bump php-i360 version to 4.7.0-1.17
  - Bump ai-bolit to 20.0414-1
  - Bump imunify-realtime-av to 1.0.6-1
  - DEF-11945 Disable "Optimize realtime scan" setting on CL systems


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.7.4-2
changelog:
  - Revert "DEF-11510 Set timeout for modsec upload in bash wrapper"
  - DEF-11506 do not restart csf if not need from import_wblist plugin
  - DEF-12134 Rebuild webshield with updated OpenSSL
  - DEF-12008 phpMyAdmin unintentionally drops other users dbs


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.8.0-5
changelog:
  - DEF-11436 Plesk backups say "some minor issues occurred" due to permissions errors on file: .rapid-scan-db
  - DEF-11808 Security Message on Plesk due to /httpdocs/wp-content/.rapid-scan-db owned by "root"
  - DEF-12067 Webshield Captcha system bug (Deliver captchas are being for any request, not to just Mime Type text/html)
  - DEF-10126 Failed to parse cleanup report: b'Loaded External DB
  - DEF-10432 OperationalError: user-defined function raised exception
  - DEF-10625 master.test_malware.test_cleanup.test_cleanup_not_blocking
  - DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
  - DEF-11275 Change progress tracking from finder to ai-bolit wrapper
  - DEF-11506 master.test_csf_allow_ignore.test_csf_ignore[csf.ignore]
  - DEF-11513 KeyError: 'getpwnam(): name not found: admin' in ["login", "get"] rpc command
  - DEF-11567 Bunch of tests fail with "On-demand scan is already running" error
  - DEF-11568 Do not send exceptions from 'malware', 'read' to sentry
  - DEF-11577 KeyError: 'MALWARE_SCANNING'
  - DEF-11616 Error during registration when agent is not started
  - DEF-11662 test_malware_scan_task fails on Ubuntu + Plesk
  - DEF-11729 "Blocked ports.Add/delete port" behave test fails on CL7 CSF conf
  - DEF-11743 Detect crashed detached scan
  - DEF-11794 FileExistsError: [Errno 17] File exists: '/var/imunify360/aibolit/run/177357b34f11468b97c9a03a1683a927'
  - DEF-11842 test_malware.test_quarantine.test_reinfection failed
  - DEF-11847 malware tests failed on AV (rpm-tests)
  - DEF-11879 test_detached_scan_messages.test_malware_scan_messages_order failed
  - DEF-11907 test_proactive failed (RPM-tests)
  - DEF-11922 "blacklist ip add" may produce misleading error message & docs are unclear
  - DEF-11923 total_files always 0 from malware on-demand list output
  - DEF-11924 ValueError: invalid literal for int() with base 10: '12.5'
  - DEF-11938 test_hooks failed (RPM-tests)
  - DEF-11972 Pass correct arguments to scan the file from backup
  - DEF-11989 Fix external finder for malware scan task
  - DEF-11990 'user list' shows that user has no malware when malware exists, after interrupted scan
  - DEF-11997 Fix nav badge
  - DEF-12034 PAM switches abnormal behavior with OSSEC
  - DEF-12043 [AppVersionDetector] It took almost 1 hour for app version detector to scan 1000 domains
  - DEF-12138 UnicodeDecodeError: 'utf-8' codec can't decode byte 0x89 in position 0: invalid start byte
  - DEF-12163 server loses an UNacknowledged persistent message if agent is restarted
  - DEF-12218 Failed test test_sa_hacker_trap_included related to exclude list in proactive defence
  - DEF-12244 enabling 'known_proxy_support' can raise number of pending connections (in TIME_WAIT state)
  - DEF-9331 Imunify360 rules management based on detected apps per folder/per user basis
  - DEF-10639 [AI-BOLIT] Scan List Preparation inside ai-bolit
  - DEF-11139 extending dir list for inotify/fanotify
  - DEF-11191 Persistent messages flow implementation
  - DEF-11229 LiteSpeed support for noCP version of Imunify360
  - DEF-11233 Make clean-up results visible and clear for customers
  - DEF-11652 Enable scan for end-users in IM360/AV
  - DEF-9823 [WAF Ruleset Configurator] - changes in settings tab
  - DEF-10651 Check current iNotify directory list and extend to meet performance requirements on CPU/IO/memory
  - DEF-10676 [AI-BOLIT] scan list preparation in ai-bolit
  - DEF-10800 Test account in OpenLitespeed rpm tests is not created in feature management tests
  - DEF-10801 Adjust python code to no longer watch for updated files to scan
  - DEF-10875 Need to make in Agent the switcher for using the internal scan list of files and externa(ai-bolit)
  - DEF-11022 Add MOD_SEC.app_specific_ruleset config option
  - DEF-11023 Add call to obtain DocumentRoot for all domains
  - DEF-11027 Refresh app-versions and app-specific ruleset once a day
  - DEF-11028 Map AppVersionDetector data to modsecurity tags
  - DEF-11030 Add call to refresh app-specific modes configuration file
  - DEF-11033 [AppVersionDetector] AppDetector's report schema refactoring
  - DEF-11035 Add update-app-specific-rules RPC call
  - DEF-11036 Refresh app-specific ruleset on modsec rules update
  - DEF-11050 Implement web server graceful restart procedure
  - DEF-11052 Create RPM tests for app-specific ruleset feature
  - DEF-11201 Add a config option to enable/disable Low Volume (D)DoS protection
  - DEF-11208 [SQLite AI-BOLIT output Collect required changes on Agent side
  - DEF-11228 Convert "Tests for fields -> SMTP_BLOCKING" e2e tests to unit/app tests
  - DEF-11318 Research and decompose OpenLiteSpeed support for Standalone Imunify360
  - DEF-11344 Stand-Alone (noCP) config automatic migration for monitoring directories
  - DEF-11357 Parametrize existing tests of on-demand scan to use internal/external finder
  - DEF-11358 Write test to cover external finder
  - DEF-11460 Update user's infected count only on user scan
  - DEF-11544 Probable race condition while cleaning up files
  - DEF-11566 Implement persistent message flow on agent side
  - DEF-11592 Update "Clean" status in malware scanner's user list
  - DEF-11596 Update found malware chart in dashboard
  - DEF-11617 Integrate Imunify with AppVersionDetector
  - DEF-11621 [AppVersionDetector] Need to write build script and set up build project
  - DEF-11719 Remove 'filelist' fixture from RPM-tests
  - DEF-11731 Remove file from malware_standalone.list on marking file as false positive
  - DEF-11742 Implement generation of configs by imunify360-agent
  - DEF-11750 Do not restart webserver if rbl whitelist was not changed.
  - DEF-11799 Add Plesk support license to the Imunify360
  - DEF-11825 Increase MAXELEM in ipset configuration
  - DEF-11921 Add AI-BOLIT stderr/stdout to MalwareScan report for debug purposes
  - DEF-11952 I360.so is absent for php7.4 on Ubuntu ( plesk)
  - DEF-11956 Try to check how pam_imunify can break dovecot on cPanel after imunify deinstallation
  - DEF-11985 Change MRS size limit exceeded error to warning
  - DEF-12031 Fix translations from DEF-12011
  - DEF-12040 test_ondemand_queue.TestQueueRemove.test_remove_any fails
  - DEF-12045 E-mail archiving conflicting with Imunify360
  - DEF-12123 AppVersionDetector should be executed using nice/ionice (or LVE is available) to limit consumed resources
  - DEF-12168 Add validation for paths read from malware path filters
  - DEF-12276 Multiple RPM tests failures related to realtime scan
  - DEF-12299 Rework "Wordpress Account Compromise Alert" page
  - DEF-12305 Define $captcha_key as wscheck module C variable


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.8.1-2
changelog:
  - DEF-12394 SMF got 503 error (blamer issue)
  - DEF-12360 config.py defaults of rapid_scan and schedule interval should match imunify360.yaml
  - DEF-12429 Update ignored regexps


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.9.0
changelog:
  - Revert "DEF-12635 Enable imunify360 service on every update"
  - DEF-12500 Improve webshield-related rpm-tests
  - Bump webshield version to 1.12-2
  - DEF-11677 Increase startup waiting timeout
  - DEF-12669 Remove clamav from /etc/cagefs/cagefs.mp
  - Bump imunify-realtime-av to 2.1.2-1
  - Add rpm-test to check unexpected rules recreation
  - DEF-12638 workaround for check iptables on CentOS8
  - Bump webshield version to 1.12-1
  - Skip test_webshield for antivirus mode
  - Bump ai-bolit version to 20.0601
  - DEF-12661 TypeError: unorderable types: NoneType() > int()
  - Fix args for assign_cert Panel method in rpm-tests
  - DEF-12635 Enable imunify360 service on every update
  - DEF-12609 Added webshield-modsecurity 3.0.4-2 to extra_repos
  - DEF-12609 Replaced CentOS8-generic with CL8-generic
  - DEF-12500 Enable webshield-related rpm tests for generic panel
  - Bump proactive version to 4.9.0-1.3
  - DEF-12627 Split cleanup file list by chunks
  - DEF-12274: Put realtime av scanner configs to files server
  - DEF-12455 add pytest-rerunfailures pytest-plugin
  - DEF-12609 Do not add koji repo for CL8
  - DEF-12387 Issues with Imunify uninstall
  - DEF-12575 Wait users to be removed from packages
  - DEF-12578: Fix validation error on RULE_DISABLED msg
  - DEF-9832 Exclude lightspeed cache folder from the list of scan folders
  - DEF-12514 several test_socket_activation rpm tests failed on multiple configurations
  - DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
  - DEF-9502 Add unit test for deploy.sh
  - DEF-12437: Add body size to correlation middleware metric
  - DEF-12323 increase count of attempts in test ossec_pam integration
  - DEF-12238: Prepare MRS for increased load
  - DEF-12524 Implement a rotation for CAPTCHA keys
  - DEF-12140 WebShield: add save new CAPTHA keys in agent's config. New UI fields
  - DEF-12288: persistent messages that are sent via Correlation UI are not delivered sometimes DEF-12288: Temporarely disable connection from limiting traffic
  - DEF-12339 Updated eula
  - DEF-11797 switcher for json/csv format of ai-bolit reports
  - DEF-12323 add rpm test to check ossec/pam integration (sshd)
  - DEF-12548 Remove some experimental badges in UI
  - DEF-12575 Remove account before package
  - DEFA-2606 Greylisting if AR and PAM are disabled. ossec 3.1.0-74
  - DEF-11931: Fix adding field to the wrong table
  - DEF-12486 Fixed test_dos_detector
  - DEF-12001 fix fields order in migration 143
  - DEF-12497 Update of Imunify360-firewall resets backup settings
  - DEF-12449 add timeout to SendMessageAPI
  - DEF-11291 Fix 'cmd' appears instead of 'args' for cleanup
  - DEF-9502 Update panel detection in deploy.sh
  - DEF-9612 [Sentry] `get-news` throws an error: "ParseError no element found: line 1, column 0"
  - DEF-12494 Fix ui e2e tests
  - DEF-12493 Make create_build.py work with new release pointers
  - DEF-12495: Add `system_id` field to the `/api/app-version-save` endpoint
  - DEF-12484: Update and enable dashboard recommendations
  - DEF-12454 New Caledonia Icon Flag Broken in IM360 UI
  - DEF-12265: Create /api/ip endpoint
  - DEF-12261 Added ossec-remoted to csf.pignore
  - DEF-11290 Fix 'default_action' and 'try_restore' appears in wrong place
  - DEF-11289 Fix 'cmd' appears instead of 'args'
  - DEF-12303 Change core version for Centos8 to support by kernelcare
  - DEF-12023 use machine readable format in extra_repos
  - DEF-12383 Warning in UI / Settings
  - DEF-11822 Do not acquire CSF lock for rules check
  - DEF-12416 LogReader should not write to console.log
  - DEF-12434: Add src_ip to xray requests and tables
  - DEF-12429 Update ignored regexps
  - DEF-12360 config.py defaults of rapid_scan and schedule interval should match imunify360.yaml
  - DEF-12271: Add verdicts on MRS to monitoring
  - DEF-12342 Do not fail installation if install-vendors fails
  - DEF-11904 Create rpc methods for enduser scan - cover with agent unit tests
  - DEF-12366 Imunify360 UI wont save changes to "Max Connections" & "Check delay" under Settings > General > DoS Protection
  - DEF-12250: Add license field in correlation API send-message endpoint
  - DEF-12414: Add jwt token check for xray
  - DEF-12208 add logging and finally_happened to first check in test_sa_hacker_trap_included
  - DEF-12456 Skip test_atomic_reload_custom_iplist for antivirus mode
  - DEF-12310 add basic integration test
  - DEF-12352 ValueError: invalid literal for int() with base 10: ''
  - DEF-11839 on-demand scan removes previously detected malware hits
  - DEF-12319 AttributeError: 'NoneType' object has no attribute 'process_message'
  - DEF-11937 Use swap to reset ipsets atomic
  - DEF-12324 Show a warning and disable "SMTP Traffic Management" in UI if a similar feature is provided by hosting panel
  - DEF-11195: src/smart-block reformat
  - DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
  - DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
  - DEF-12389 CentOS 8/CLOS 8/RHEL 8 support - create plesk image for ui e2e tests
  - DEF-12391 Purge ClamAV
  - DEF-12364: Fix modsec rules deploy on correlation-ui
  - DEF-12001 Add plugin MrProper and cleaners
  - DEF-12050: Notify agent that new autorules.yaml is ready
  - DEF-12373: PHP-daemon: error #503
  - DEF-12327: Fix bug in connection DEF-12327: Fix invalid fingerprinting
  - DEF-11195: Add black formatting for all subprojects
  - DEF-11195: src/mrs-services reformat
  - DEF-11195: src/integration-tests reformat
  - DEF-11195: src/git-doc reformat
  - DEF-11195: src/files reformat
  - DEF-11195: src/events reformat
  - DEF-12152 fix some texts
  - DEF-12152 restore-from-backup request should not block UI - UI part
  - DEF-11112 Update provision for Centos/CL8 generic panel
  - DEF-12210 Ensure fail2ban is running if enabled
  - DEF-12283 CentOS 8/CLOS 8/RHEL 8 support - create centos8-directadmin image for ui e2e tests
  - DEF-11397: Add files.imunify360.com to monitoring
  - DEF-12299 Rework "Wordpress Account Compromise Alert" page
  - DEF-11718 Bypass scan by trailing space in file name
  - DEF-11882 test_socket_activation.test_socket_activation_long_action failed
  - DEF-11111 Update provision for Centos/CL 8
  - DEF-11556: Check system_id query parameter in auth
  - DEF-9279 Remove Acronis agent if it was installed by us. Do not ask in i360deploy.sh
  - DEF-12327: Fix bug in connection
  - DEF-11556: system_id sync
  - DEF-12345: Write errors in parsing msg to warning
  - DEF-12124: Document deploy process for xray.js file
  - DEF-12011 client wants to use language that is different from the Plesk default language
  - DEF-12345: Write errors in parsing msg to warning
  - DEF-12129: add RPM tests to cover new imunify-realtime-av spec
  - DEF-7042 Hash in the DB does not match real file hash
  - DEF-12251: Send MongoDB collections sizes to monitoring
  - DEF-11556: Create temporary mock
  - DEF-11897: Deploy and check correlation-ui
  - DEF-12302 Fix retries in tests - zone.js do not seem to work in node
  - DEF-11731: Remove file from malware_standalone.list
  - DEF-12021: Impelement new end-point and new tables for saving of statistics about clients rpm packages
  - DEF-12151 restore-from-backup request should not block UI - agent part
  - DEF-12043 Set scan-depth=2 for app version detector
  - DEF-12034 fix switching ossec config on pam settings change
  - DEF-12276 Fix realtime scanner RPM tests
  - DEF-11840 Use new cloud for test images
  - DEF-11923 total_files always 0 from malware on-demand list output
  - DEF-11755 Bulk actions to blacklist/whitelist IPs - implement
  - DEF-11701: Setup monitoring to jenkins worker nodes
  - DEF-11329: Run correlation API with 4 workers
  - DEF-12239: Fix haproxy 502 errors
  - DEF-11110 CentOS 8/CLOS 8/RHEL 8 support - create image for ui e2e tests
  - DEF-12236 Link to settings from restore-from-quarantine modal do not remove modal backdrop in plesk
  - DEF-11840 Use nebula credentials from jenkins
  - DEF-11878 Allow to run e2e tests on dev-server
  - Revert "DEF-11510 Disable test_web_scanner in container"
  - DEF-11650 Typo in the UI PLESK in Imunify360 extension
  - DEF-12240: Return user scan endpoints
  - DEF-12138 Handle non-unicode symbols in ai-bolit output
  - DEF-12132 Typo in "WordPress Account Compomise"
  - DEF-12153: Cache the results of restore-from-backup
  - DEF-11812: Replace "--skip-root-owner" with "--skip-system-owner" ai-bolit paramter in the agent
  - DEF-11108 Add ability to build imunify package on Centos/CL 8
  - DEF-11290 Add default_action to MalwareScan report
  - DEF-11289 Add AI-BOLIT args to MalwareScan report
  - DEF-11291 Add procu2 args to MalwareCleanup report
  - DEF-11106 CentOS 8/CLOS 8/RHEL 8 support - deployscripts


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.9.2-2
changelog:
  - Bump ai-bolit version to 20.0619-1
  - Bump webshield version to 1.12-5
  - DEF-12636 - [AI-BOLIT] deobfuscator can't deobfuscate the sample 1848f147c179962d9626b8934f7d7503c74722adcaac4543eee952a406285390
  - DEF-12651 - Customers download the wrong ModSec ruleset
  - DEF-12663 - [AI-BOLIT] deobfuscator can't deobfuscate the sample 9575b0ddf36a146bec7d1e910f4aad05c61493df82eb0c3ef0bc17740516dfde
  - DEF-12689 - Webshield does not process IPv6 /64 networks
  - DEF-12716 - [AI-BOLIT] deobfuscator can't deobfuscate the sample f4d3270906909dcf30c0f2394c8500bb654eca56918dbe8140d2a3223287f8de
  - DEF-12718 - [AI-BOLIT] deobfuscator can't deobfuscate the sample 8ba86b71b3f3a66530fa8f99e9f27b872eb6377e27600bc4e183a03e2f9e6376
  - DEF-12721 - Find out how 'upstream' block can be added to webshield configuration
  - DEF-12749 - [AI-BOLIT] Signature is hanging the cleanup
  - DEF-12767 - IntegrityError: FOREIGN KEY constraint failed
  - DEF-12772 - [AI-BOLIT] Change Priority Of Cloud Assisted scan for whitelist to have higher priority over blacklist
  - DEF-12783 - Something went wrong during updating captcha keys: CheckRunError(1, ['service', 'imunify360-websh...
  - DEF-12799 - imunify360-php-daemon: sync: WaitGroup is reused before previous Wait has returned
  - DEF-12822 - [Suggestion] Ignoring maildir path
  - DEF-12823 - imunify360-php-daemon: handling of "too many open files error"
  - DEF-12854 - Update proactive defence rules for 4.9.2. Make log rules as block rules


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.9.3-2
changelog:
  - DEF-12953 Imunify360 doesn’t starts after update
  - DEF-12850 Cleanup creates multiple rows in 'malware malicious list' output after restore from quarantine
  - DEF-12928 Add iptables package to dependencies on Centos/CL 8


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.9.4-2
changelog:
  - DEF-12955 imunify-realtime-av: After being continuously restarted, service enters failed state
  - DEF-13002 Update rules for proactive defense 4.х. Add LOG rules for DEFA-2865


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.9.5-3
changelog:
  - DEF-13001 Imunify UI is not available in Directadmin
  - DEF-13005 No access to spam folder when exim bruteforce protection is enabled


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 5.1.1-2
changelog:
  - DEF-13615 Set cannot be destroyed: it is in use by a kernel component
  - DEF-13704 Error: Incorrect padding
  - DEF-13749 Whitelisted ips with full_access are incorrectly restored after service restart
  - DEF-13724 disable LOG rules for whitelist


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.0-2
changelog:
  - DEF-13811 Restored from backup files still marked as infected
  - DEF-13725 Preview files from quarantine leads FileNotFoundError
  - DEF-13689 Malware ignore list is not escaped when compiled into the common exclude list
  - DEF-13805 Do not use make_config_active
  - DEF-13741 Save current locale during saving notifications config if no locale chosen


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.2.1-1
changelog:
  - DEF-13922 malware-scanning/started hook missing intensity data
  - DEF-13955 imunify-realtime-av: assignment to entry in nil map
  - DEF-13908 Strange ImunifyAV scan behavior


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.2-1
changelog:
  - DEF-13961 retry on openssl Timeout error
  - Bump imunify-notifier version to 1.0.6-1
  - Bump specs to imunify360-php-i360-5.2.0-1.6, imunify360-php-i360-rules-5.2.0-5


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.3-1
changelog:
  - DEF-14147 Prevent apache from failure during update
  - DEF-14135 Do not check license in AV cron job


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 5.3.1-2
changelog:
  - DEF-14267 [MDS] MDS statistics doesn't send by default
  - DEF-14319 duplicate real_ip_header directive can break nginx
  - DEF-11526 Use appropriate locks when working with CSF


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.3.2-3
changelog:
  - DEF-14421 unified-access-logger is not started together with imunify360 as required
  - DEF-14406 Disable "im360-whitelist" rule in unified-access-logger


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.1-1
changelog:
  - DEF-12767 IntegrityError: FOREIGN KEY constraint failed
  - DEF-14370 Ossec services fails with changed SELinux context var_t -> var_log_t
  - DEF-14624 Error 500 when IPv6: invalid port while connecting to upstream


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.2-2
changelog:
  - DEF-14652 Research the Cloudflare's "Automatic platform optimization for WordPress"
  - DEF-14672 Use tmpreaper to cleanup tmp directories
  - DEF-14346 Add detection of internal data in EG(current_execute_data)->opline for ioncubeloader


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.6-1
changelog:
  - DEF-13704 Error: Incorrect padding
  - DEF-14504 update_components_versions command fails in test_app_specific_ruleset rpm tests
  - DEF-14594 ScanFailed.command should be a list of strings
  - DEF-14690 pytest is killed repeatedly by OOM killer on Ubuntu 1GB
  - DEF-14777 test_ondemand_queue tests fail
  - DEF-14853 Creating /var/log/.log after the installation
  - DEF-15118 app-specific ruleset erroneously enabled with nginx_apache web server on DA


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.8-2
changelog:
  - DEF-15251 Fixed typo in lock implementation causing temporal deadlocks
  - DEF-15167 Return OK with error message on memory allocation error


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.6.0-2
changelog:
  - DEF-15872 Allow whitelisting subnets of blacklisted supernet
  - DEF-15796 don't mention ossec package in the update command
  - DEF-15778 (fix) don't use os.sync without a good reason
  - DEF-12933_change_accessibility_to_alt-php74-imunify_interpreter-5.6
  - DEF-15797 Move 'malware rebuild patterns' CLI schema to ImunifyAV
  - DEF-15774 Added AlmaLinux support
  - DEF-15671 `malware user scan` hangs if there are a lot of queued scans
  - DEF-14271 Use --username key for procu2 instead of privileges dropping


author: Pavel Kondratyev <pkondratyev@cloudlinux.com> 6.0.0-4
changelog:
  - DEF-17961:
    Checks for socket errors,reload daemon if detected
    Scan splitter function accepts only one message to eliminate possible delay in closing the socket
    Increase service max fd's


author: Svyatoslav Gormash <sgormash@cloudlinux.com> 3.1.0-108
changelog:
  - WPT-60 Add support for PostgreSQL log monitoring
  - added service restart after upgrade. Version bump.


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.1.0-45
changelog:
  - add /etc/rules_pam.d/320_pam_switch.xml
  - add /var/ossec/etc/ossec-pam.conf
  - remove /var/ossec/rules/exclusion_rules.xml


author: Svyatoslav Gormash <sgormash@cloudlinux.com> - 3.1.0-69
changelog:
  - Removed greylisting with disabled ActiveResponse
  - Suppress verbose output in post-install scripts


author: Svyatoslav Gormash <sgormash@cloudlinux.com> - 3.1.0-71
changelog:
  - Merged ossec-pam.conf and ossec-no-pam.conf to ossec.conf
  - Active Response scripts won't check imunify360.conf


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> - 3.1.0-77
changelog:
  - apply ownership/permissions info from the ossec spec on /var/ossec
  - don't use *.uid/.gid files -> corresponding ids may have been
    reused by unrelated users/groups by now
  - append .rpmsave suffix to files & subdirs from known %files %dir
    dirs if they are not owned by root or ossec\* users


author: Svyatoslav Gormash <sgormash@cloudlinux.com> - 3.7.0-12
changelog:
  - WPT-1623 Remove lsof call from Active Response scripts for better performance 
  - DEF-35839 Remove leftover cronjob on uninstall


author: Alexey Berezhok <aberezhok@cloudlinux.com> 0.3-15
changelog:
  - DEF-12045: E-mail archiving conflicting with Imunify360
  - DEF-11958: investigate the ability to decrease a number of appeals to RBL


author:
  Pavel Artsishevsky <partsishevsky@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 0.4-14

changelog:
  - DEF-12707: Add database open failover step
  - ICPD-740: Removed "Not found in block list" from secure logs
  - ICPD-782: Generating of NEW_UUID can by heavy for CPU, we need to avoid such behavior
  - DEF-11959: Add support pam to the PureFTPD for cPanel
  - DEF-11960: Check when fix for ProftPD will be available in latest release
  - DEF-12365: rpm-tests: test_pam.test_ip_blocked irreproducible bug
  - DEF-12471: Add --dry-run command for imunify360-pam eanble/disable
  - DEF-12753: Security flaw in world writable directory
  - DEF-12317: CheckRunError: Command - fix
  - DEF-13005: No access to spam folder when exim bruteforce protection is enabled


author: Oleksiy Shchukin <oshchukin@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com> 5.3.0-4
changelog:
  - DEF-14014: Add filtering stats fom 127.0.0.1 ip, add service name passing from c module to daemon
  - DEF-13694: Add saving successful tries to the corellation server
  - DEF-13229: Add saving unsuccessful tries to the corellation server
  - DEF-13928: fix for failed to start PAM


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.6.0-3
changelog:
  - DEF-16132: Bump pam_imunify_daemon startup timeout to 120 seconds
  - DEF-15946: pam_imunify_daemon ftp integration watchdog


author: Oleksiy Shchukin <oshchukin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 5.7.0-1
changelog:
  - DEF-15634: ProFTPD support better diagnostic message
  - DEF-15279: Make error as warning
  - DEF-15683: Add command of rebuild local template for dovecot without builddovecotconf and restarting dovecot. it needs for cPanel


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.7.0-9
changelog:
  - DEF-16549: Fix pam_imunify_daemon SIGPIPE handling
  - DEF-16428: Fix pure-ftpd is restarting in an infinite loop


author: Husein Haidarov <hhaidarov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.0-1
changelog:
  - DEF-18649: remove other users access to app data (fix initscript)
  - DEF-18818 DEF-15279 DEF-18577: Misc fixes


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.0-3
changelog:
  - DEF-19112: whitelisted_ips_include in PAM ini lacks of litespeed modsec path
  - DEF-18996: Fix "PAM daemon starts before RPM transaction finishes" error


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com>, 6.4.1-1
changelog:
  - DEF-14950: rate limit "no space left on device" errors
  - DEF-19519: rate limit "operation not permitted" errors


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.5-1
changelog:
  - DEF-23446: use yaml style in cpanel pure-ftpd config, trigger /scripts/setupftpserver on pure-ftpd enable/disable
  - DEF-23541: ignore nano version when linking i360_auth to i360_lib
  - DEF-23503: reduce network timeouts in pam module, pam daemon and native dovecot module


author: Pavel Zaikin <pzaikin@cloudlinux.com> 6.4.5-2
changelog:
  - DEF-24182 use imunify360-venv for python scripts 
  - DEF-24430: Install go-licenses v1.6.0 for current go version


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.6-1
changelog:
  - DEF-25203: add LimitNOFILE value to imunify360-pam.service to raise limit of open file descriptors
  - DEF-25862: fix osv-scanner vulnerabilities by updating go version and versions of go modules
  - DEF-26053: build imunify360-pam for Debian 12
  - DEF-26170: remove /usr/lib64/dovecot/|/lib64/dovecot path on DirectAdmin, version 6.4.6-1 only


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.7-1
changelog:
  - DEF-27057: add pure-ftpd hook to enable imunify360-pam pure-ftpd after /scripts/setupftpserver execution disables it on cPanel
  - DEF-26992: replace python wrapper with FailureWatchdog go code on systemd
  - DEF-27119: add systemd activation sockets, add ConnTracker to track idleness
  - DEF-25512: fix imunify360-pam status command


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.8-1
changelog:
  - DEF-29380: replace None value in get_cp_name return value with 'generic'
  - DEF-28575: use wafd's iplist service for whitelisted ips
  - DEF-28697: use local version identifier instead of hyphen in setup.py
  - DEF-29884: add support for dovecot-2.3.21
  - DEF-29917: validate license against alternative public key when present


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.9-1
changelog:
  - DEF-29976: add support for Ubuntu 24
  - DEF-28659: remove centos6/cl6 support
  - DEF-24286: do not log to syslog syscall.EPIPE errors on closed connections


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.10-1
changelog:
  - DEF-32268: wrap logging init in try except block
  - DEF-30929: use /usr/lib/security location instead of /lib/security only on ubuntu24 and debian12


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.12-1
changelog:
  - DEF-35434: add dovecot-native support for dovecot-2.4
  - DEF-37172: add dovecot-pam support for dovecot-2.4


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.13-1
changelog:
  - DEF-36381: build imunify360-pam for Debian 13
  - DEF-37452: add dovecot-native support for dovecot-2.4.2
  - DEF-37502: fix domainowner regex in dovecot-pam mode for dovecot versions higher than 2.4


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 1.1.5-3
changelog:
  - Reset stats after each send
  - DEF-13075 send stats to Correlation server
  - Move agent config to separate package
  - DEF-12858 Change some messages' levels to debug
  - Change stats interval to 1 hour


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.1.6-1
changelog:
  - Update cln-pub.key location
  - Review and improve test coverage
  - Add generating coverage report in Cobertura format
  - Silence useless sentry message


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 2.0.2-2
changelog:
  - DEF-16651: implement retries when sending data to correlation
  - DEF-16812 update license
  - DEF-16787 use commit hash in gerrit builds
  - DEF-16747: Change sentry DSN
  - DEF-16574: fix SIGPIPE handling
  - Fix CentOS 6 detection


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 2.0.3-1
changelog:
  - DEF-19446: Blamer: make function of filtering of store events from PD to disk-based storage
  - DEF-19447: Blamer: send events that correspond to malware in agent SQLite DB
  - DEF-19445: Blamer: implement disk-based storage for `phpfp_d`-aggregated events
  - DEF-19448: Blamer: clean-up events that are unlikely to get detected by the malware scanner
  - DEF-19450: Blamer: extend statistics reporting
  - DEF-19618: Blamer: extend statistics reporting related to disk-based storage
  - DEF-19619: [PHP Daemon] Fix reporting of the Proactive Defense package version


author: Dmitry Baynak <dbaynak@cloudlinux.com> 2.0.4-1
changelog:
  - DEF-19879: Blamer: check feature performance impact and consider event limits
  - DEF-19841: Add field in the message for CH which points the source of blamer messages (new mechanism or old)


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 2.0.5-1
changelog:
  - DEF-20217: purge PHP minidaemon db on [re]install to avoid excessive sentry errors
  - DEF-20254: fixup imunify360-php-daemon.service fails to start bug


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 2.0.5-2
changelog:
  - DEF-20217: Purge PHP minidaemon db on [re]install to avoid excessive sentry errors
  - DEF-20254: Fixup imunify360-php-daemon.service fails to start bug
  - DEF-20391: The fix for excessive blamer message parsing errors


author: Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.2-1
changelog:
  - DEF-19294: Merge imunify360-php-i360-rules back to imunify360-php-i360
  - DEF-19173: Move from using libffi, or try to use some other arch for avoid segfaults on AMD
  - DEF-19302: Add reporting to clickhouse Proactive Defense package version


author: Oleksiy Shchukin <oshchukin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.3.0-1
changelog:
  - DEF-19613: [PD] Fix reporting of the Proactive Defense package version
  - DEF-19690: Add i360.so module for ea-php80, ea-php81


author:
  Alexey Berezhok <aberezhok@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.1-1

changelog:
  - DEF-19678: Implement performance fixing i360_rdtsc -> clock_gettime invocation
  - DEF-19891: PD PHP queue optimization
  - DEF-20040: Fix PHP 8.x segfault on DirectAdmin
  - DEF-19977: Add i360.so module for alt-php81 (& plesk-php81) for Debian/Ubuntu


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.3-1
changelog:
  - DEF-15106: multiPHP configuration for DA native support
  - DEF-20481: handle /proc/self/environ is absent/unaccessible


changelog: - DEF-17621: Optimize work of proactive defence. Stage 2
author:
  Alexey Berezhok <aberezhok@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.0.0-1


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.1.0-1
changelog:
  - DEF-21147: Fix version of the rules in i360_report_only events
  - DEF-20926: Bugfix for "buf is too small" sporadic db error


author: Eugene Vodilov <evodilov@cloudlinux.com> 7.5.0-1
changelog:
  - DEF-22684: Cross-server Auto-Immunity (Stage II)
  - DEF-23380: Disable HMAC verification for i360 messages


author: Eugene Vodilov <evodilov@cloudlinux.com> 7.6.0-2
changelog:
  - DEF-23621: Do not hook into zend_execute_ex() when JIT is enabled
  - DEF-23709: Collect statistics on communication between PHP daemon and i360.so
  - DEF-19739: Migrate from "queue" to "queue_sig" in PD reporting to the Correlation


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.6.1-1
changelog:
  - DEF-24118: provide correct proto* files for i360.so where packet statistics is marked as required
  - DEF-24243: enable statistics when there were rejected messages during the last request


author: Alexey Berezhok <aberezhok@cloudlinux.com> 7.7.0-1
changelog:
  - DEF-23971: Remove PCRE_ANCHORED flag for pcre_exec in Proactive Defense
  - DEF-23919: remove queue from i360.so
  - DEF-24418 calculate message drop on php-daemon side
  - DEF-24381 Revert DEF-23971 and send queue_sig as part of proactive defense messages


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.7.1-1
changelog:
  - DEF-24716 send timings and counters only when they fully enabled
  - DEF-24716 always send stats data to php-daemon (except when i360 is deactivated)


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.7.3-1
changelog:
  - DEF-25148: read config entries in MINIT before checking them
  - DEF-25200: increase api limits for perf stats


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 7.8.0-1
changelog:
  - DEF-24048: Implement segfault handling in i360.so
  - DEF-24284: add backtrace reporting on segfault
  - DEF-24605: Remove EF0_HASH from environment list
  - DEF-24781: optimize hot functions (i360_free_func_params_new, map_hash, brp_map_hash)
  - DEF-24949: initialize RINIT counters only once


author: Vladimir Pavlyuk <vpavlyuk@cloudlinux.com> 7.10.0-1
changelog:
  - DEF-25770 Clean up configs related to PHP 5.4 and PHP 5.5
  - DEF-25572 Collect monitoring data from i360 on mshutdown when conditions are met
  - DEF-25427 Track connection statistics on PHP daemon side
  - DEF-25427 Remove old communication statistics
  - DEF-25559: Replace I360_PD_DATABASE_BLOCK_BIT | I360_PD_DATABASE_BLOCK_EXCLUDE_BIT with I360_PD_DATABASE_BLOCK | I360_PD_DATABASE_BLOCK_EXCLUDE in I360_PD_CONDITION_INCLUDES, restore more optimized way of moving bits from conditions to matching bitmap
  - DEF-25431: replace I360_PD_DATABASE_WRITE_LOG with I360_PD_DATABASE_WRITE_LOG_BIT in i360_pd_database_func_foreach
  - DEF-25273: Implement Greylisted EF0 hashes support
  - DEF-25212: copy URL to absolute path field if no absolute path present
  - DEF-25277: fix script filename if it is a URL, include URL schema to environment variables in case it is present


author: Vladimir Pavlyuk <vpavlyuk@cloudlinux.com> 7.10.0-1
changelog:
  - DEF-25572 Collect monitoring data from i360 on mshutdown when conditions are met
  - DEF-25427 Track connection statistics on PHP daemon side
  - DEF-25427 Remove old communication statistics
  - DEF-25559: Replace I360_PD_DATABASE_BLOCK_BIT | I360_PD_DATABASE_BLOCK_EXCLUDE_BIT with I360_PD_DATABASE_BLOCK | I360_PD_DATABASE_BLOCK_EXCLUDE in I360_PD_CONDITION_INCLUDES, restore more optimized way of moving bits from conditions to matching bitmap
  - DEF-25431: replace I360_PD_DATABASE_WRITE_LOG with I360_PD_DATABASE_WRITE_LOG_BIT in i360_pd_database_func_foreach
  - DEF-25273: Implement Greylisted EF0 hashes support
  - DEF-25212: copy URL to absolute path field if no absolute path present
  - DEF-25277: fix script filename if it is a URL, include URL schema to environment variables in case it is present


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.11.0-1
changelog:
  - DEF-25578 Keep jit_compatible_mode parameter during upgrades (debian)
  - DEF-25851 Resolve security vulnerabilities in go projects
  - DEF-25196: Optimize string functions in i360.so
  - DEF-25195: Delete unused/obsolete functions
  - DEF-25601: Move jit_compatibility_mode to a separate config option to immunify360.conf; move reading yaml configs to MINIT
  - DEF-25866: Support event filtering in HDB / i360.so. Add SKIPLOG hash flag, bit 16 - 0x10000 hex, 1 dec


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.11.3-1
changelog:
  - DEF-26503: Fix: i360_free_global_copy is not called before reopening db with i360_make_global_copy thus leaking resources
  - DEF-26385: i360.so running by PHP-FPM can't read user config


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.12.0-1
changelog:
  - DEF-25494: Increase RAW_POST_DATA to 1024 for blocked events
  - DEF-25573: Watch for alt-php8[12] package changes on CL systems
  - DEF-25865: Send suspicious data for malware scanner during PHP script execution
  - DEF-26017: Release PD configuration sripts as part of i360-php package
  - DEF-26039: i360-storage-new should use imunify360-venv python
  - DEF-26121: Fitler temporary wp event logging on the stream hook stage instead of logging stage
  - DEF-26268: Cache configuration files for 1 minute
  - DEF-26363: Trigger cagefs remount only after configuration files are installed when enabled
  - DEF-26397: Reset dbgcounters on a new request
  - DEF-26497: Develop a script for module.ini gradual rollout for PD


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.12.0-2
changelog:
  - DEF-26902: add release rendering in spec files
  - DEF-26676 Use Correlation UI for i360-php-logger configuration file management
  - DEF-26496: Fix: not closing malware directory FD before reopening
  - DEF-25494: Increase RAW_POST_DATA to 1024 for blocked events
  - DEF-25573: Watch for alt-php8[12] package changes on CL systems
  - DEF-25865: Send suspicious data for malware scanner during PHP script execution
  - DEF-26017: Release PD configuration sripts as part of i360-php package
  - DEF-26039: i360-storage-new should use imunify360-venv python
  - DEF-26121: Fitler temporary wp event logging on the stream hook stage instead of logging stage
  - DEF-26268: Cache configuration files for 1 minute
  - DEF-26363: Trigger cagefs remount only after configuration files are installed when enabled
  - DEF-26397: Reset dbgcounters on a new request
  - DEF-26497: Develop a script for module.ini gradual rollout for PD


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.12.1-1
changelog:
  - DEF-27174: mark scan hashes log_only when malware is not found
  - DEF-27027: watch php82 package changes
  - DEF-26886: add php8.3 support


author: Egor Zyryanov <ezyryanov@cloudlinux.com> 7.1.0-2
changelog:
  - DEF-20112: Fix gcc -Werror for i360-storage build
  - DEF-21478: Fix gcc warnings for utility dict_util_string


author: Evgenii Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.2.0-1
changelog:
  - DEF-19730: Block malware drops based on the execution flow hashing
  - DEF-21741: Bump LimitNOFILE to 65536 for php-daemon service


author: Alexey Berezhok <aberezhok@cloudlinux.com> 7.2.1-0
changelog:
  - Add build debug package for CL/Centos
  - DEF-21125: Make sure that OOP code (including magic methods) are properly handled and added to the execution flow


author: Egor Zyryanov <ezyryanov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.2.0-3
changelog:
  - DEF-21604: Fix gcc warnings during php_i360 unit tests
  - DEF-21792: php-daemon: add optional /var/log/imunify360/php-daemon_db.log


author: Mikhail Faraponov <mfaraponov@cloudlinux.com> 7.2.0-4
changelog:
  - DEF-19455: move php-logger to cgroups slice
  - DEF-21925: Calculate EF hash on Blamer's file open for write operation
  - DEF-21862: Extend performance stats for PD 7.x
  - DEF-22439: missing: debuginfo since PD 7.1.1-1.1


author: Egor Zyryanov <ezyryanov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.3.1-2
changelog:
  - DEF-19679: HMAC procedure introduced
  - DEF-22733: Fix JIT conflict bug
  - DEF-22788: Auto-immunity autorules segfault fix


author: Egor Zyryanov <ezyryanov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.4.0-1
changelog:
  - DEF-22791: Generating pre-built key for hmac
  - DEF-22928: Fix "/usr/local/php80 i360.so is stuck provokes segfault"


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.9.0-1
changelog:
  - DEF-24556: send queue data only once
  - DEF-24884: refactor code in counters
  - DEF-24881: reformat the code of i360.so
  - DEF-24945: Add human-readable macros for constants and bit operations
  - DEF-25032: add script filename and current script filename to segfault reporting, compile segfault handling for php versions higher than 8
  - DEF-25431: replace I360_PD_DATABASE_WRITE_LOG with I360_PD_DATABASE_WRITE_LOG_BIT in i360_pd_database_func_foreach


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.12.1-1
changelog:
  - DEF-27174: mark scan hashes log_only when malware is not found
  - DEF-27027: watch php82 package changes


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.1.1-1
changelog:
  - DEF-27665: install i360.so ad hoc when a new version of php is installed on cloudways, remove .cpanel.multiphp dir


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.1.2-1
changelog:
  - DEF-27197: set jit_compatible_mode to null when not specified explicitly 
  - DEF-28212: do not fail when i360-merged config is absent
  - DEF-28237: validate license against alternative pubkey
  - DEF-28279: do not block recognized malware when DISABLED


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.1.5-1
changelog:
  - DEF-28711: properly initialize connection tracker changes
  - DEF-28286: add functionality to block exit/die
  - DEF-28558: fix incorrect pd_duration in mode: DISABLED


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.2.0-1
changelog:
  - DEF-29395: Don't block function if mode is DISABLED
  - DEF-29391: use apm info to detect cloudways
  - DEF-28063: Add ability to block URL list in header function within autorules


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.2.3-1
changelog:
  - DEF-29953: Identify the chain of includes where the event happened
  - DEF-29449: Unify code working with PD modes
  - DEF-29744: Properly handle PHP opcache optimization when enabled
  - DEF-30198: Do not log events generated by whitelisted scripts
  - DEF-30442: (debian) stop php-daemon on i360 uninstall
  - DEF-30469: Update opcache mask to avoid rare segfaults for php7.2


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.3.0-1
changelog:
  - DEF-30822: enable segfault reporing by default
  - DEF-30987: move 'extension=i360.ini' line from php.ini to php.d/i360.ini
  - DEF-30982: fix i360.ini paths on debian/ubuntu
  - DEF-31181: Add php8.4 support. Enhance php8.3 support on Ubuntu24. Release PD for ea-php8.X for rhel >= 7.


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.3.2-1
changelog:
  - DEF-31786: fix errors in i360-pkg-watcher reported by sentry
  - DEF-31793: use noop mode in i360-pkg-watcher


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.4.0-1
changelog:
  - DEF-29731: use imunify-common module for api operations
  - DEF-31896: add script uri, script filename and servername to segfault messages, refactor failure messaging
  - DEF-32116: report i360 events only, increase backtrace depth
  - DEF-31544: add memory limit checks, log to php-daemon when php memory is exhausted
  - DEF-32250: do not create extra files in dangerlist directory
  - DEF-32181: fix monitoring stats memory leak


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.1-1
changelog:
  - DEF-32609: update go version to 1.24.1
  - DEF-32882: monitor i360.so segfaults only in ossec trigger
  - DEF-32882: use '*' as a dummy if function name is unavailable in backtrace
  - DEF-32882: check e->name before using it in hash_queue_calc to avoid segfault
  - DEF-32959: cover missing PHP versions for certain platforms
  - DEF-33406: do not execute external commands without timeout
  - DEF-33406: use systemd watchdog to track php-daemon health


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.3-1
changelog:
  - DEF-32880: use ef1 hashes when jit_compatible_mode is on
  - DEF-34035: clear outdated events on php-daemon startup


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.4-1
changelog:
  - DEF-34424: add i360.so to php.ini for alt-phps to enable i360 on cagefs
  - DEF-34708: use all imunify360-agent's sentry tags


author: Siarhei Pol <spol@cloudlinux.com> 8.4.5-1
changelog:
  - DEF-35040: reduce rules compilation in i360-storage-new.py on cloudways
  - DEF-34985: replace int with size_t in arguments of i360_add_func_param_value_add_new
  - DEF-34749: rate limit monStats aggregator errors
  - DEF-34748: rate limit perfStats aggregator errors


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.5.0-1
changelog:
  - DEF-35813: Release rules.yaml as part of Proactive Defence package
  - DEF-36251: Do not tamper with OPcache optimization level
  - DEF-35677: Optimize installation/removal of i360 in install-clean.sh
  - DEF-35314: Fix APPLICATION_ID functionality for per-application configuration and whitelist loading


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.5.1-2
changelog:
  - DEF-29731: rely on gw directory instead of custom flag at install time
  - DEF-29731: reenable file gateway Correlation API communication when present
  - DEF-35942: enable i360.so in php.d/i360.ini if 'cagefs_disabled=on' is set in cagefs.ini
  - DEF-36588: Removed some manual rules to replace with php_immunity
  - DEF-35459: Switch EF1 hash processing to Block mode


author: Alexey Berezhok <aberezhok@cloudlinux.com> 0.6-1
changelog:
  - ICPD-18: Hide i360 extension from PHP Selector
  - ICPD-48: i360-storage should work with pattern files with \n and \r\n on .bin file creation
  - ICPD-71: installation issue: /var/softtmp!/usr/share/i360-php-opts/ is NOT a directory or does NOT exist
  - ICPD-63: Blamer v0.1


author: Alexey Berezhok <aberezhok@cloudlinux.com> 0.10-1
changelog:
  - Prepare to global testing
  - ICPD-52: Create mechanism to remove False Positives from proactive defence
  - Added new set of unit tests for i360


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.0.0-1.9
changelog:
  - DEF-7037: Disable proactive defence support for EA3
  - DEF-6876: Add ability to enable and disable blamer on UID level
  - DEF-6964: Move blamer option to the imunify.config
  - ICPD-218: Add behaviour: option: null should be parsed as no option at all in imunify config
  - ICPD-217,ICPD-52: Create mechanism to remove False Positives from proactive defence
  - ICPD-223: Fix non-critical trouble on php_i360 install


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.1.0-1.3
changelog:
  - Added false positive filtering
  - ICPD-112: Add new keys(log only)
  - ICPD-49: Write to web server's error log before killing scripts


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.1.0-1.6
changelog:
  - ICPD-279: Add i360.so for alt-phpXX for Plesk to the file /opt/alt/phpXX/link/conf/default.ini
  - Def-7732: i360 already loaded error


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.1.0-1.16
changelog:
  - ICPD-309: Speed up compiling of regexpressions on startup. Precompile only needed regular expressions


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.5.0-1.11
changelog:
  - ICPD-766: Remove -p /bin/bash -x from the spec file for disabling path execution output
  - ICPD-765: Add stat wrapper for comand chmod & touch for checking that file or directory exists for avoid error output


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.6.0-1.7
changelog:
  - ICPD-668: Add proactive defence configuration per directory
  - ICPD-642: Particular function execution skipping
  - ICPD-692: Rule with specified script_ext: .ico applied to .php file
  - ICPD-688: Add support of list black listed files. Block include(etc) when it try to include file from list
  - ICPD-675: After removing imunify360, *i360* php module remain
  - ICPD-734: Add new rules created by analitics(including ico ignoring, some danger url including ignoring instead of killing)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-1.9
changelog:
  - DEF-10984: Check origins of the symlinks (via fstat) to prevent baypassing of include protection
  - ICPD-775: Extend script_ext logic
  - ICPD-838: Move proactive socket to /opt - proactive plugin


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.8.0-1.7
changelog:
  - ICPD-829: Extend reporting of the configuration from running PD
  - ICPD-837: Add possiblity for rules to refer to separate lists of files
  - ICPD-851: i360.so PHP extension breaking PHP with a RAM issue
  - DEF-11716: Adapt current algorithm of exclude list in PD to the new specifications
  - DEF-11952: I360.so is absent for php7.4 on Ubuntu ( plesk)
  - DEF-11831: Correct multiple IPs reporting


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-1.10
changelog:
  - DEF-12053: Recompile autorules.yaml on proactive/php update
  - DEF-12617: Make separate rule for exclude list events and make it as log rule
  - DEF-11957: Implement FP lists linked to rules only
  - DEF-11951: Add lsphp support for generic panel
  - DEF-12992: Add flock for can be executed only one instance i360-storage-mkcustom at the same time
  - Removed duplicating FP rules
  - DEFA2959 thewordpressclub[.]org infected nulled themes/plugins 10039
  - LOG->BLOCK 131370->10035 131371->10036 131372->10037 131374->10038, removed 131373
  - Fixed 33 rule and moved to 131335 for re-test2
  - Fixed 33 rule and moved to 131335 for re-test
  - Removed 131336 rule as useless
  - Removed 131353 rule as useless
  - Removed 131378, reworked 10024-10029 rules patterns
  - SMW-SA-15253-php.tool.goto-1 simplified 10018 rule, removed 10020,10021
  - Added 10034 SMW-SA-15253-php.tool.goto-1 thms/plgns block install
  - Added 131377 and 131378 log rules - fakeplugin,bckdr
  - wpvcd added 10033 rule and imroved 10010
  - Improved 10025 regex
  - Added LOG test rules 131375, 131376


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-1.12
changelog:
  - DEF-13321: Exclude index.php only for Standalone malware execution (10001 4.9.6 and 11001 4.10.1+)
  - DEF-13198: Make separate rule for blocking standalone malware


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-1.8
changelog:
  - DEF-12053: Recompile autorules.yaml on proactive/php update
  - DEF-12617: Make separate rule for exclude list events and make it as log rule
  - DEF-11957: Implement FP lists linked to rules only
  - DEF-11951: Add lsphp support for generic panel
  - DEF-12992: Add flock for can be executed only one instance i360-storage-mkcustom at the same time


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.0-1.2
changelog:
  - Cleanup ponters for preventing garbage in phpinfo after disabling of i360
  - Added "builded for" for phpinfo


author:
  Andrew Rassokhin <arassokhin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.2.0-1.19

changelog:
  - Fix blamer detection rules and replace \d to [0-9]
  - ICPD-350: Ability to bypass FP check for specific rule
  - ICPD-349: Create buffer filtering mechanism for rules
  - ICPD-348: Blamer data research: Method 7 search malicious scripts by UID and GID
  - ICPD-355: Add link to libcurl library for i360.so
  - ICPD-356: Make connect in the i360.so with timeout. Because if agent is busy i360 can stop PHP until agent accept the connection
  - ICPD-305: webmail sending and login problems with Imunify 4.0.3-1
  - ICPD-368: Remove fopen from writeloggers group of rules.yaml
  - ICPD-369: Filter blamer attempts if write not to files
  - ICPD-363: Make the concept of sending messages from PD to Agent via the separate daemon.
  - ICPD-372: Add extension check key into rules.yaml
  - ICPD-366: Rebuild PD rules from 4.1.0 to 4.2.0
  - ICPD-371: Fix i360.so installation error on Ubuntu for alt-php
  - ICPD-375: Add ability to switch proctive defense modes
  - ICPD-409: Create email sending logging rules for PD
  - ICPD-419: Proactive Defence freezes PHP if Imunify360 config file is broken
  - ICPD-418: Move extension=i360.so from zzzzzzz-pecl.ini back to alt-phpXX php.ini


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.2.1-1.2
changelog:
  - ICPD-357: Add rules groups to the rules.yaml
  - ICPD-374: Imply `cagefsctl --rebuild-alt-php-ini' on update


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.2-1.4
changelog:
  - ICPD-459: Increase in Semaphore usage after recent i360.so update.
  - ICPD-483: Change algorithm of blamers reducer. We shouldn't decrease counter of event if this message not appears during one hour
  - ICPD-486: Reducer is killing PHP-FPM pool processes


author: Eugene Vodilov Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.5-1.1
changelog:
  - ICPD-489: Blamer file get filtered by csf
  - ICPD-496: Improve hash calculation for event ID in reducer algorithm


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.3.0-1.1
changelog:
  - ICPD-590: Add i360.so module for ea-phph73
  - ICPD-396: Copy values of SERVER array on php script RINIT stage for preventing changing during script execution
  - ICPD-562: we have proactive list returns eval() code. Path shouldnt contain eval


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.4.0-1.1
changelog:
  - ICPD-396: Copy values of SERVER array on php script RINIT stage for preventing changing during script execution
  - ICPD-562: we have proactive list returns eval() code. Path shouldnt contain eval


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.4.0-1.5
changelog:
  - ICPD-692: Rule with specified script_ext: .ico applied to .php file
  - ICPD-675: After removing imunify360, *i360* php module remain
  - ICPD-708: Proactive Defense Issues


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-1.13
changelog:
  - DEF-10984: Check origins of the symlinks (via fstat) to prevent baypassing of include protection
  - ICPD-775: Extend script_ext logic
  - ICPD-838: Move proactive socket to /opt - proactive plugin
  - Enable new blamer
  - ICPD-848: proactive defense stops working after alt-php reinstall


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-1.15
changelog:
  - DEF-10984: Check origins of the symlinks (via fstat) to prevent baypassing of include protection
  - ICPD-775: Extend script_ext logic
  - ICPD-838: Move proactive socket to /opt - proactive plugin
  - Enable new blamer
  - ICPD-848: proactive defense stops working after alt-php reinstall
  - ICPD-851: i360.so PHP extension breaking PHP with a RAM issue


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-1.16
changelog:
  - DEF-10984: Check origins of the symlinks (via fstat) to prevent baypassing of include protection
  - ICPD-775: Extend script_ext logic
  - ICPD-838: Move proactive socket to /opt - proactive plugin
  - Enable new blamer
  - ICPD-848: proactive defense stops working after alt-php reinstall
  - ICPD-851: i360.so PHP extension breaking PHP with a RAM issue
  - Update rules


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.7.0-1.18
changelog:
  - Def-11831 Correct multiple IPs reporting
  - Updated rules DEFA-2499
  - DEF-11907: test_proactive failed (RPM-tests)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.1.0-1.1
changelog:
  - DEF-13410: i360 Module is missing for EA_PHP74
  - DEF-13323: Add whitelist support for rule 10001 and 11001 - standalone malware execution. Proactive internal list


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.2.0-1.5
changelog:
  - DEF-13485: i360.so debian10 build is broken
  - DEF-13793: Add qhash to the blamer message, because of php-daemon relates on this field


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.2.0-1.6
changelog:
  - DEF-13485: i360.so debian10 build is broken
  - DEF-13793: Add qhash to the blamer message, because of php-daemon relates on this field
  - DEF-13905: Build new 5.2 PD rules package


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.3.0-1.9
changelog:
  - DEF-13655: Check and add output messages for command i360-storage-mkcustom, its messages will be logged. Check message on segfault
  - DEF-13842: Add support in proactive defence finding of bin file based on version PD
  - DEF-13843: Add support of i360-storage version of PD
  - DEF-13905: Build new 5.2 PD rules package


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.4.0-1.11
changelog:
  - DEF-14158: Add new rules for core file protection
  - DEF-13729: Add WordPress Core files protection with Proactive Defence
  - DEF-13742: Check how php represent relative path in case in descripton
  - DEF-14285: Make autoupdates excludelist on build of package
  - DEF-14123: Hook move_uploaded_files in PD
  - DEF-14468: WP Core protection - decrease rules FP rate


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.4.0-1.15
changelog:
  - DEF-14888: Change in ubuntu's scriptlets grep to awk because grep affect the result of the script, in case of grep false, scriptlet returns 1


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.6.0-1.3
changelog:
  - DEF-14901: Add Server API field to proactive defence reporting, for the gathering of configured PHP mode
  - DEF-14939: Add separation of function names(fopen(r) and file_get_contents) on php_imunify events
  - DEF-14912: Research integration of PD into php8


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.6.0-1.4
changelog:
  - DEF-15335: Add whitelist fp possibility for rule 135000 (kill non-wp core files direct execution)
  - DEF-14914: Restore support in blamer's events exec and system functions


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.7.0-1.2
changelog:
  - DEF-15628: Proactive defence does not work on CL6 + cPanel + Litespeed configuration(persistent fix)
  - DEF-15885: Proactive defence does not work on Centos8 + cPanel + modsec3 configuration
  - DEF-15770: Additional exclude_files_list for WP core files protection
  - DEF-15749: Add Nightly/Beta WP files to WP core protection exclude list


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.8.0-1.1
changelog:
  - DEF-15255: [Proactive] Use PERMISSIONS.user_override_proactive_defense
  - DEF-15844: [C] Switch to the new imunify360 config path (PD)
  - DEF-16102: Skip 0-size files include and some other functions


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.8.0-1.3
changelog:
  - DEF-15255: [Proactive] Use PERMISSIONS.user_override_proactive_defense
  - DEF-15844: [C] Switch to the new imunify360 config path (PD)
  - DEF-16102: Skip 0-size files include and some other functions
  - DEF-16705: Fix DA trouble when native PHP is link to our alt-php our da.hook just remove i360.so


author: Alexey Berezhok <aberezhok@cloudlinux.com> 6.0.0-1.1
changelog:
  - DEF-17237: Optimize execution flow 
  - DEF-17234: Make optimization of check_chain. Use one char instead regexp 
  - DEF-17399: Save data sent by balmer in the internal buffer. Change only dynamic data during request


author: Eugene Vodilov <evodilov@cloudlinux.com> 6.0.0-1.12
changelog:
  - DEF-16413: Fix trouble with libffi 3.0.5 on CL6+cagefs+lsapi
  - DEF-16416: Fix trouble that we not always started earlier than ioncube. Hooking in function_table is not enought for mode ioncube - --obfuscate all


author: Alexey Berezhok <aberezhok@cloudlinux.com> 6.0.0-1.3
changelog:
  - DEF-17825: Add cleaning of static parameters before i360_eval_compile_string_hook for php less than 8
  - Renew signatures


author: Alexey Berezhok <aberezhok@cloudlinux.com> 6.1.0-1.2
changelog:
  - DEF-17103: Collect performance data in PD
  - DEF-18067: Make for reverse_ordered_list addition all substrings should be shortened in one shortest


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.1.0-1.6
changelog:
  - DEF-18300: i360.so map_deinit_ segfault
  - DEF-18156: Number of records in proactive_queue decreased, it is not expected
  - DEF-17838: Make php_stream independent injection of PD blamer functions


author:
  Husein Haidarov <hhaidarov@cloudlinux.com >, Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.2.0-1.1

changelog:
  - DEF-18077: Add functional of file_op_name, file_op_content
  - DEF-18080: Rewrite rules for usage of file_op_name, file_op_content instead of check_buf
  - DEF-18300: i360.so map_deinit_ segfault
  - DEF-18156: Number of records in proactive_queue decreased, it is not expected


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.0-1.3
changelog:
  - DEF-18517: Fix getpwuid(getuid()) returns NULL
  - DEF-17970: More i360 details for agent's tests php_info.php


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.0-1.4
changelog:
  - DEF-17748: Proactive Defense does not work on PHP8/Plesk/Ubuntu
  - DEF-18481: Add support php 8.1 for PD
  - DEF-18607: Fix race condition segfault on rules upgrade


author:
  Husein Haidarov <hhaidarov@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.2.0-1.1

changelog:
  - DEF-18077: Add functional of file_op_name, file_op_content
  - DEF-18080: Rewrite rules for usage of file_op_name, file_op_content instead of check_buf
  - DEF-18300: i360.so map_deinit_ segfault
  - DEF-18156: Number of records in proactive_queue decreased, it is not expected


author: Husein Haidarov <hhaidarov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.0-1.6
changelog:
  - DEF-18653: only send perf stats when rules found
  - DEF-18812: Add i360.so to ea-phpXY for Ubuntu 20


author:
  Alexey Berezhok <aberezhok@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.0-1

changelog:
  - DEF-19678: Implement performance fixing i360_rdtsc -> clock_gettime invocation
  - DEF-19891: PD PHP queue optimization
  - DEF-20040: Fix PHP 8.x segfault on DirectAdmin


author:
[cell repeats an earlier one in this file: 137 characters]

changelog:
  - DEF-19678: Implement performance fixing i360_rdtsc -> clock_gettime invocation
  - DEF-19891: PD PHP queue optimization
  - DEF-20040: Fix PHP 8.x segfault on DirectAdmin
  - DEF-19977: Add i360.so module for alt-php81 (& plesk-php81) for Debian/Ubuntu
  - DEF-20254: Bump imunify360-php-daemon version


author:
  Alexey Berezhok <aberezhok@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.2-1

changelog:
  - DEF-19678: Implement performance fixing i360_rdtsc -> clock_gettime invocation
  - DEF-19891: PD PHP queue optimization
  - DEF-20040: Fix PHP 8.x segfault on DirectAdmin
  - DEF-19977: Add i360.so module for alt-php81 (& plesk-php81) for Debian/Ubuntu
  - DEF-20391: The fix for excessive blamer message parsing errors
  - DEF-20254: Bump imunify360-php-daemon version


author: Eugene Vodilov <evodilov@cloudlinux.com> 4.2.2-3
changelog:
  - ICPD-459: Increase in Semaphore usage after recent i360.so update
  - ICPD-483: Change algorithm of blamers reducer. We shouldn't decrease counter of event if this message not appears during one hour


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.6.0-3
changelog:
  - ICPD-668: Add proactive defence configuration per directory
  - ICPD-642: Particular function execution skipping
  - ICPD-692: Rule with specified script_ext: .ico applied to .php file
  - ICPD-734: Add new rules created by analitics(including ico ignoring, some danger url including ignoring instead of killing)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-7
changelog:
  - DEF-10984 Check origins of the symlinks (via fstat) to prevent baypassing of include protection
  - ICPD-775: Extend script_ext logic


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.8.0-7
changelog:
  - ICPD-829: Extend reporting of the configuration from running PD
  - ICPD-837: Add possiblity for rules to refer to separate lists of files


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.8.0-10
changelog:
  - Added 10016 rule to prevent /tmp/mn drop
  - Added curl log rule 131365
  - Added 131353-64 LOG rules DEFA-2655


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.9.0-4
changelog:
  - DEF-11927: Forbid standalone malware execution
  - DEF-12617: Make separate rule for exclude list events and make it as log rule
  - Update rules


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-5
changelog:
  - DEF-12053: Recompile autorules.yaml on proactive/php update
  - DEF-12617: Make separate rule for exclude list events and make it as log rule


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-6
changelog:
  - DEF-12053: Recompile autorules.yaml on proactive/php update
  - DEF-12617: Make separate rule for exclude list events and make it as log rule
  - Removed duplicating FP rules
  - DEFA2959 thewordpressclub[.]org infected nulled themes/plugins 10039
  - LOG->BLOCK 131370->10035 131371->10036 131372->10037 131374->10038, removed 131373
  - Fixed 33 rule and moved to 131335 for re-test2
  - Fixed 33 rule and moved to 131335 for re-test
  - Removed 131336 rule as useless
  - Removed 131353 rule as useless
  - Removed 131378, reworked 10024-10029 rules patterns
  - SMW-SA-15253-php.tool.goto-1 simplified 10018 rule, removed 10020,10021
  - Added 10034 SMW-SA-15253-php.tool.goto-1 thms/plgns block install
  - Added 131377 and 131378 log rules - fakeplugin,bckdr
  - wpvcd added 10033 rule and imroved 10010
  - Improved 10025 regex
  - Added LOG test rules 131375, 131376


author: Andrew Rassokhin <arassokhin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.0-7
changelog:
  - Fix blamer detection rules and replace \d to [0-9]
  - ICPD-350: Ability to bypass FP check for specific rule
  - ICPD-349: Create buffer filtering mechanism for rules
  - ICPD-348: Blamer data research: Method 7 search malicious scripts by UID and GID
  - ICPD-355: Add link to libcurl library for i360.so
  - ICPD-356: Make connect in the i360.so with timeout. Because if agent is busy i360 can stop PHP until agent accept the connection
  - ICPD-305: webmail sending and login problems with Imunify 4.0.3-1
  - ICPD-368: Remove fopen from writeloggers group of rules.yaml
  - ICPD-369: Filter blamer attempts if write not to files
  - ICPD-363: Make the concept of sending messages from PD to Agent via the separate daemon.
  - ICPD-372: Add extension check key into rules.yaml
  - ICPD-366: Rebuild PD rules from 4.1.0 to 4.2.0


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukini <oshchukin@cloudlinux.com> 5.3.0-6
changelog:
  - DEF-13655: Check and add output messages for command i360-storage-mkcustom, its messages will be logged. Check message on segfault
  - DEF-13842: Add support in proactive defence finding of bin file based on version PD
  - DEF-13843: Add support of i360-storage version of PD


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.4.0-7
changelog:
  - DEF-14158: Add new rules for core file protection
  - DEF-13729: Add WordPress Core files protection with Proactive Defence
  - DEF-13742: Check how php represent relative path in case in descripton
  - DEF-14285: Make autoupdates excludelist on build of package
  - DEF-14468: WP Core protection - decrease rules FP rate


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.6.0-3
changelog:
  - DEF-14901: Add Server API field to proactive defence reporting, for the gathering of configured PHP mode
  - DEF-14939: Add separation of function names(fopen(r) and file_get_contents) on php_imunify events
  - DEF-15335: Add whitelist fp possibility for rule 135000 (kill non-wp core files direct execution)
  - DEF-14914: Restore support in blamer's events exec and system functions
  - DEF-14912: Research integration of PD into php8


author: Husein Haidarov <hhaidarov@cloudlinux.com > 6.2.0-2
changelog:
  - DEF-18077: Add functional of file_op_name, file_op_content
  - DEF-18080: Rewrite rules for usage of file_op_name, file_op_content instead of check_buf


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.1.0-1
changelog:
  - Attempt to refactor stats collecting
  - Fix sending empty payload
  - Extract stats to separate package
  - Move packet parsing to nflog package
  - Add WebShield requests processing
  - Add WebShield prefix to config's rules
  - Add parsing WebShield requests
  - Add WebShield request socket
  - Ignore localhost IPs from being collected
  - Fix empty build version


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.2.0-1
changelog:
  - Add parsing for /proc/net/nf_conntrack
  - Add parsing for /proc/net/tcp(6)
  - Add sending server stats to Correlation server
  - Add parsing for /proc/meminfo
  - Add parsing for /proc/loadavg
  - Do not fail if nfnl_rcvbufsiz call fails
  - Add parsing for /proc/meminfo
  - Add parsing for /proc/loadavg


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 2.1.0-1
changelog:
  - Change incidident's message format
  - Change submitting incidents method to UNIFIED_ACCESS_LOG
  - Update florianl/go-nflog to the latest version
  - Drop cnflog package
  - Extend gonflog to deliver UID/GID of the sender process
  - Fix panic upon receiving nil UID and GID


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 3.1.2-1
changelog:
  - Use commit hash in gerrit builds
  - Update license
  - Add README.md
  - Avoid logging if /proc/net/nf_conntrack does not exist


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 3.2.1-5
changelog:
  - DEF-21421: use /var/log/imunify360/imunify360-unified-access-logger/ as log destination
  - DEF-19461: Added wall time reporting to cgroups accounting wrapper
  - DEF-19469: Added daily cron job for self-update
  - DEF-19458: cgroups accounting wrapper: implement cgroups support
  - DEF-19459: cgroups accounting wrapper: create basic skeleton. Fixed stdout/stderr instability
  - DEF-21298: do not send cgroup deleted error to sentry


author: Pavel Zaikin <pzaikin@cloudlinux.com> - 3.2.8-1
changelog:
  - DEF-25281 move incidentSubmitPeriod to comand line args
  - DEF-24793: Do not error on empty report
  - DEF-24792: Ignore corrupted fields when parsing meminfo


author: Amit Levy <alevy@cloudlinux.com> - 3.4.0-1
changelog:
  - DEF-31058: fix(ci) unit tests UNSTABLE should be FAILED
  - DEF-31058: add support for cgroups v2
  - DEF-31058: run golangci-lint


author: Amit Levy <alevy@cloudlinux.com> - 3.4.2-1
changelog:
  - DEF-32102: ignore cgroup.controller file not found errors
  - DEF-32094: ignore cgroup not exist errors


author: Amit Levy <alevy@cloudlinux.com> - 3.5.0-1
changelog:
  - DEF-29735: add filebased gateway for correlation server
  - DEF-32809: fix memory data is shown in bytes should by megabytes
  - DEF-32871: fix main slices like Imunify.slice are not reported
  - DEF-32241: add logs for easier debugging rpm tests


author: Amit Levy <alevy@cloudlinux.com> - 3.5.1-1
changelog:
  - DEF-32816: fix cpu stats not collected if controllers is off
  - DEF-32479: fix ual not synced with systemd


author: Amit Levy <alevy@cloudlinux.com> - 3.5.4-1
changelog:
  - DEF-33715: fix file not found for v1
  - DEF-33922: fix cleaup nested dirs
  - DEF-33922: fix no space when creating metric files
  - DEF-33881: ignore "unknown" parsing errors


author: Aidyn Torgayev <atorgayev@cloudlinux.com> - 3.6.4-1
changelog:
  - DEF-35241: do not send error if ipv6 is disabled
   * Thu Jul 10 2025 Aidyn Torgayev <atorgayev@cloudlinux.com> - 3.6.3-1
  - DEF-35000: add profiling tools


author: Eugene Vodilov <evodilov@cloudlinux.com> 6.1.1-1
changelog:
  - DEF-18007 Refactor NetLink usage due to problem with recv (from kernel to user-space) buffer
  - DEF-18021 Cover main wafd logic with unit tests


author: Igor Savenko <bliss@cloudlinux.com> 6.2.1-3
changelog:
  - DEF-18965: Changed path for whitelisted domains, made it optional
                 and compatible with old format. Fixed captcha response
                 detection by 'Accept' header


author: Igor Savenko <bliss@cloudlinux.com> 6.2.1-4
changelog:
  - DEF-19188: Added X-Real-IP header when passing through is allowed
  - DEF-19190: Changed splashscreen check endpoint to less predictable string
  - DEF-19189: Made splashscreen disabled by default


author: Ivan Shapovalov <ishapovalov@cloudlinux.com> - 6.2.613-3
changelog:
  - DEF-22522: move wafd for 'old webshield' to cgroup slice
  - DEF-20224: Build imunify360-webshield-bundle for Debian 11


author: Igor Savenko <bliss@cloudlinux.com> 1.8-13
changelog:
  - DEF-10236: The captcha page shows wrong IP address.
  - DEF-10255: Webshield captcha shows English locale only


author: Igor Savenko <bliss@cloudlinux.com> 1.8-15
changelog:
  - webshieldctl: fixed regexp in detector of running processes.
    in detection of running processes greater-or-equal is used


author: Igor Savenko <bliss@cloudlinux.com> 1.11-3
changelog:
  - DEF-12305: Reorganized captcha keys
  - DEF-12067: Make captcha return custom error on non-text/html requests


author: Igor Savenko <bliss@cloudlinux.com> 1.12-3
changelog:
  - DEF-12689: Make webshield apply default IPv6 /64 mask to meet the i360 agent expectations
  - DEF-12721: Added 'upstream' blocks to webshield configuration


author: Igor Savenko <bliss@cloudlinux.com> 1.12-10
changelog:
  - DEF-11140: Make webshield remember sources, which successfully passed captcha
  - DEF-13331: Added default User-Agent to use when User-Agent header is missing


author: Igor Savenko <bliss@cloudlinux.com> 1.12-13
changelog:
  - DEF-13991: Make webshield send destination port with 'Host' header to the upstream
  - DEF-14133: Do not modify 'X-Forwarded-For' header
  - DEF-13949: make the webshield return right port in cookie


author: Igor Savenko <bliss@cloudlinux.com> 1.13-3.4
changelog:
  - DEF-15125: Add 'X-Forwarded-For' header with unwrapped client IP for known proxies requests if missing


author: Igor Savenko <bliss@cloudlinux.com> 1.13-3.7
changelog:
  - DEF-15251: Fixed typo in lock implementation causing temporal deadlocks
  - DEF-15167: Return OK with error message on memory allocation error


author: Igor Savenko <bliss@cloudlinux.com> 1.14-1
changelog:
  - DEF-13467: Added support for ‘splashscreen’ IP type
  - DEF-13468: Added support for keeping more than 1 record per some IP/CIDR
  - DEF-14340: Added support for /etc/imunify360-webshield/splashscreen-antibot.conf


author: Igor Savenko <bliss@cloudlinux.com> 1.14-6
changelog:
  - DEF-13468: Fixed shared memory dumping.
  - Added X-Forwarded-For header. Increased shared memory to 60M


author: Igor Savenko <bliss@cloudlinux.com> 1.14-10
changelog:
  - DEF-15351: Added self-check script to amend webshield issues
  - DEF-12279: Update webshield to use python 3.8


author: Igor Savenko <bliss@cloudlinux.com> 1.14-14
changelog:
  - DEF-15454: Added workaround to remove outdated entries from shared memory
  - DEF-15678: webshield-watchdog should use python 3.8
  - DEF-15384: Change error reporting by wsshdict


author: Igor Savenko <bliss@cloudlinux.com> 1.14-15
changelog:
  - DEF-15704: Changed YAML loader to 'safe_load' to silence warning
  - DEF-15633: disabled stdout/stderr for watchdog script cron invocation


author: Igor Savenko <bliss@cloudlinux.com> 1.14-16
changelog:
  - DEF-15616: Pass request source IP address to application server in a separate header
  - DEF-15904: Replace TLSv1.1 to TLSv1.3 in webshield config
  - DEF-15901: Remove proxying from webshield for watchdog script
  - DEF-15826: Added more debug logging


author: Igor Savenko <bliss@cloudlinux.com> 1.14-17
changelog:
  - DEF-15936: Make webshield watchdog script create flag file to inform agent that webshield is not accessible


author: Igor Savenko <bliss@cloudlinux.com> 1.15-1
changelog:
  - DEF-15124: Added functionality for enabling/disabling splashscreen to webshieldctl script
  - DEF-14189: Removed 'iptables' check from 'all' and 'basic' options of 'self-check' script
  - DEF-15283: Remove functionality for transerring data from old wscheck.conf to new one


author: Igor Savenko <bliss@cloudlinux.com> 1.15-8
changelog:
  - DEF-16223: Removed GAWK-specific varables
  - DEF-16232: make DPKG retain old invisible-captcha.conf file on update


author: Igor Savenko <bliss@cloudlinux.com> 1.16-4
changelog:
  - DEF-16223: Removed GAWK-specific varables
  - DEF-16232: make DPKG retain old invisible-captcha.conf


author: Igor Savenko <bliss@cloudlinux.com> 1.17-4
changelog:
  - DEF-16502: Added fallback in case splashcreen dictionary is full
  - DEF-14293: Remove depencency to imunify360-webshield-modsecurity from the webshield
  - DEF-16733: Removing duplicates from static-whitelisted config file
  - DEF-16791: Changed dump file path for cron job


author: Igor Savenko <bliss@cloudlinux.com> 1.17-5
changelog:
  - DEF-16852: Make 'modsecurity' package obsolete to get rid of it on update
  - DEF-16985: Provide wrapper script for wsshdict cron dump/load activities


author: Igor Savenko <bliss@cloudlinux.com> 1.18-6
changelog:
  - DEF-17433: Added 'modsecurity-devel' to obsoleted packages
  - DEF-16811: Updated license in webshield packages


author: Igor Savenko <bliss@cloudlinux.com> 1.18-7
changelog:
  - DEF-17841: Add imunify360-ipsd systemd/init dependencies to the webshield
  - DEF-17765: Many webshield-watchdog processes running


author: Igor Savenko <bliss@cloudlinux.com> 1.19-10
changelog:
  - DEF-19712: Raised dependency for imunify360-wafd (ipset synclists support). Tests have been added.


author: Igor Savenko <bliss@cloudlinux.com> 1.20.1-4
changelog:
  - DEF-19189: Added splashscreen enabling/disabling (for imunify360-wafd) to webshieldctl
  - Updated submodules to the latest HEAD


author: Igor Savenko <bliss@cloudlinux.com> 1.20.1-5
changelog:
  - DEF-19500: Added removal of wscheckdata.conf before installation
  - Added X-Forwarded-For header passing to upstream


author: Igor Savenko <bliss@cloudlinux.com> 1.20.1-6
changelog:
  - DEF-19237: Set webshield workers to 1. Added the possibility to change the value
  - DEF-19280: something wrong with ssl_cache processing in new webshield


author: Igor Savenko <bliss@cloudlinux.com> 1.20.1-7
changelog:
  - DEF-19520: access_check_verdict variable doesn't get status when captcha request has wrong accept header


author: Igor Savenko <bliss@cloudlinux.com> 1.20.1-11
changelog:
  - DEF-20188: Added iterative removing subdomais from hostname until the cert is found (or name reaches its end)


author: Ivan Shapovalov <ishapovalov@cloudlinux.com> 1.20.120-1
changelog:
  - DEF-22522: move 'old webshield' to cgroup slice
  - DEF-22600: Fixed captcha UI bug
  - DEF-22521: switch to imunify360-venv, hack up nose for tests
  - DEF-20224: build imunify360-webshield-bundle for Debian 11


author: Igor Savenko <bliss@cloudlinux.com> 1.20.121-1
changelog:
  - DEF-23128: Excessive request to endpoint may cause very long captcha processing
  - DEF-22929: Update jQuery in captcha page


author: Igor Savenko <bliss@cloudlinux.com> 1.20.122-1
changelog:
  - DEF-23288: Splashscreen is shown to requests coming to ports 2082/2083 unless a valid cookie is found


author: Igor Savenko <bliss@cloudlinux.com> 1.21.0-1
changelog:
  - DEF-24020: Release unified webshield
  - DEF-24036: The way the splashsreen is shown can go wrong when CDNs are involved


author: Igor Savenko <bliss@cloudlinux.com> 1.22.0-1
changelog:
  - DEF-24256: Loading site assets with HTTP/2 request can fail in chrome-based environment
  - DEF-24228: Fixed the ways a port is added to the splashscreen redirection url


author: Igor Savenko <bliss@cloudlinux.com> 1.22.2-2
changelog:
  - DEF-24916: Added connection upgrade headers
  - DEF-23650: Research the percentage of requests stayed without response due to the webshield timeout
  - DEF-24180: Switch webshield to alt-python311


author: Igor Savenko <bliss@cloudlinux.com> 1.23.1-1
changelog:
  - DEF-25483: Make sure that whitelisted source IP addresses don't trigger splashscreen for cpanel port protecton


author: Igor Savenko <bliss@cloudlinux.com> 1.24.3-1
changelog:
  - DEF-27455: In non-legacy mode for splashscreen IPs when splash is disabled module returns empty splashscreen


author: Igor Savenko <bliss@cloudlinux.com> 1.25.3-2
changelog:
  - DEF-28032: wafd has memory leakage
  - DEF-28060: splashscreen coookie is not checked at the wafd side


author: Igor Savenko <bliss@cloudlinux.com> 1.25.4-1
changelog:
  - DEF-28072: Move XFF processing logic to nginx module side
  - DEF-28056:Add caching for site additional assets for small time (10s) to wafd


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.27.0-2
changelog:
  - DEF-28643: wafd logging refactoring
  - DEF-28642: implement log rotation for wafd
  - DEF-28640: splash fix format string
  - DEF-28725: Remove cache headers duplicates
  - DEF-28806: Make every splashscreen redirect unique to prevent caching
  - DEF-28640: Make wafd log splashscreen shows
  - DEF-28802: Enable Splashscreen for CloudFlare by default
  - DEF-28761: Make sure wafd is working if webshield is stopped/disabled


author: Igor Savenko <bliss@cloudlinux.com> 1.27.0-4
changelog:
  - DEF-28863: make sure wafd runs all the time
  - DEF-29158: Wafd should log cases where splashscreen is expected to be shown, but wasn't shown due to present cookie.


author: Igor Savenko <bliss@cloudlinux.com> 1.28.3-1
changelog:
  - DEF-30303: Fix subdomain cookie issue, which causes splashscreen loop
  - DEF-29913: Do not send notifications to UAL daemon if it's disabled in config
  - DEF-29694: Fix wafd logrotate postrotate script


author: Igor Savenko <bliss@cloudlinux.com> 1.30.0-1
changelog:
  - DEF-29528: Send CAPTCHA messages to correlation server
  - DEF-29527: Implement Captcha DoS detection in wafd


author: Igor Savenko <bliss@cloudlinux.com> 1.30.1-1
changelog:
  - DEF-29913: Do not send notifications to UAL daemon if it's disabled in config
  - DEF-29905: Reduce wafd memory footprint in idle mode
  - DEF-30087 Prevent closing listening sockets on config reload
  - DEF-30085: wafd should read token each time when it changed on the disk


author: Igor Savenko <bliss@cloudlinux.com> 1.30.2-1
changelog:
  - DEF-30303: Fixed old splashscreen cookie TTL discrepancies, enabled cookie domains
  - DEF-29827: Fixed accumulation issue, disabled random query parameter by default
  - DEF-30366: Fix unit-tests for UAL functionality
  - DEF-30435 Check enabled state on package update


author: Igor Savenko <bliss@cloudlinux.com> 1.30.2-2
changelog:
  - DEF-30440: imunify360-wafd binary still active after uninstall
  - DEF-30303: Changed name of cookie


author: Igor Savenko <bliss@cloudlinux.com> 1.30.3-1
changelog:
  - DEF-30553: Make sure 'cf-edge-cache: no-cache' header unconditionally added to the splashscreen page


author: Igor Savenko <bliss@cloudlinux.com> 1.30.4-1
changelog:
  - DEF-30678: Wafd buffer is exceeded when new splash is used with long initial URL
  - Revert "DEF-30087 Prevent closing listening sockets on config reload"


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.31.3-1
changelog:
  - DEF-32093 [BACKPORT] Added throttling for sentry events
  - DEF-32043 [BACKPORT] Improvement in unit test TestExpectedErrorInQuery
  - DEF-32043 [BACKPORT] Do not send netlink-related errors to Sentry
  - DEF-31543: [BACKPORT] notify user about UAL connection loss only once


author: Igor Savenko <bliss@cloudlinux.com> 1.31.4-1
changelog:
  - DEF-32418: [BACKPORT] Splashscreen variant 'B' 'connection.rtt' prevents valid UserAgents from passing splashscreen


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.32.0-1
changelog:
  - DEF-31708 Set-Cookie header fixed in Apache module @BS-NOBUILD
  - DEF-31679 Run switch max webserver command when max webserver environment detected


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.32.2-2
changelog:
  - Merge "DEF-32371: let server header to be passed from downstream"
  - DEF-32371: let server header to be passed from downstream


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.33.0-1
changelog:
  - DEF-33776 Custom logs rotation
  - DEF-33912: update coraza dependency
  - DEF-33572: implement wildcard domain whitelist matching
  - DEF-33695: Update coraza according to upstream
  - DEF-32893: implement appSpecific rules config loading
  - DEF-32895: implement handling of app specific rulsets during request processing
  - DEF-33666: Remove 'none' UAL verdict from wafd


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.34.0-1
changelog:
  - DEF-33694 Whitelisted domains feature fixed for Coraza mode
  - DEF-32911: Version bump
  - DEF-33097 Disabling webshield in Coraza mode implementation


author: Igor Savenko <bliss@cloudlinux.com> 1.34.0-3
changelog:
  - DEF-34313: webshield-watchdog incorrectly reloads wafd every time it runs in CW environment
  - DEF-34341: Wafd reloading after UAL state in config added
  - DEF-34331: Systemd dependency for ossec-hids service has been added


author: Igor Savenko <bliss@cloudlinux.com> 1.34.4-2
changelog:
  - DEF-35148: ipset_worker is not returning into pool
  - DEF-35178: Wafd is constantly reloading (CloudWays)


author: Ruslan Shmelev <rshmelev@cloudlinux.com> 1.35.0-2
changelog:
  - DEF-34816: Whitelist all by using * in domains_whitelist conf file
  - DEF-34743: Fix unbounded memory growth in wafd with coraza
  - DEF-33874: Implementation of coraza persistance storage


author: Igor Savenko <bliss@cloudlinux.com> 1.35.2-1
changelog:
  - DEF-35295: Missing distinction between expiration of collection variable and of collection itself
  - DEF-35398: webshield 421 Misdirected Request issue with SNI enabled in apache


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.36.0-1
changelog:
  - DEF-35453: support version specific rules
  - DEF-34255 make a CorazaRulesChecker initialized flag reloadable
  - DEF-34255 do not fail wafd if coraza failed to load config/rules
  - DEF-33864 SCRIPT_FILENAME & SCRIPT_USERNAME variables implementation


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.36.1-2
changelog:
  - DEF-35591: read state file before ensuring consistent state
  - DEF-35104: investigation - redirect support, coraza module reference update.


author: Igor Savenko <bliss@cloudlinux.com> 1.36.2-1
changelog:
  - DEF-35740: Imunify360-webshield crashes with core dumps
  - DEF-35866: Added syncing with mutexes to ensureConsistentState
  - DEF-35589: Make sure webshieldctl in configure stage respects current WEBSHIELD_ENABLE state


author: Igor Savenko <bliss@cloudlinux.com> 1.37.0-2
changelog:
  - DEF-36343: Webshieldctl has unnecessary '$' symbol in setting defaults
  - DEF-35128: Implement Coraza Logging
  - DEF-35728: Implement disabling rules per domain for coraza
  - DEF-35740: Imunify360-webshield crashes with core dumps
  - DEF-35867: remove skip on test_modsec_rule_disabled_for_domain for coraza
  - DEF-35870: wafd passing wrong format of http version
  - DEF-35898: [sentry] data not convertible to netlink
  - DEF-35961: [sentry] failed to convert request
  - DEF-36145: wildcard whitelisting is not working correctly
  - DEF-36270: In apache 'module' mode webshield port is not mapped back in splashscreen body
  - DEF-35866: Added syncing with mutexes to ensureConsistentState
  - DEF-35589: Make sure webshieldctl in configure stage respects current WEBSHIELD_ENABLE state


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.37.1-1
changelog:
  - DEF-36663 webshieldctl: is-active action fixed
  - DEF-36363: Custom rules has been placed before coraza ruleset in modsecurity.conf


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.37.3-1
changelog:
  - DEF-36837: process status code if received
  - DEF-36298: ids: add headless browser support to the performance framework


author: Igor Savenko <bliss@cloudlinux.com> 1.5-6
changelog:
  - DEF-6614: Fixed processing IPv6 requests for non-SNI certificates
  - DEF-6771: Added deduplication of domains when backend-destination.conf is being saved


author: Pavel Artsishevsky <Pavel Artsishevsky> 1.6-1
changelog:
  - DEF-6893: Disable TLSv1 in WebShield
  - DEF-6904: Outdated webshield self-signed SSL certificate
  - DEF-6863: Make webshield use first SSL certificate when no SNI.


author: Igor Savenko <bliss@cloudlinux.com> 1.6-3
changelog:
  - DEF-7199: Raised 'backlog' parameter to 'listen' syscall to SOMAXCONN to address more parallel connections.


author: Igor Savenko <bliss@cloudlinux.com> 1.6-4
changelog:
  - DEF-7327: wsshdict split to master and worker
  - DEF-7332: Sentrylogs modified to use new imunify360-webshield sentry project
  - DEF-7206: webshield/wsshdict log processing modified to resemble sentry errors/exceptions
  - gen_ports_conf script rewritten in Python (because we need predictable regex engine)
  - DEF-7191: Added webshield port reservation via sysctl


author: Igor Savenko <bliss@cloudlinux.com> 1.6-8
changelog:
  - DEF-7685: Disabled backend proxying
  - DEF-7747: package scriplets/systemd unit files/init files revision


author: Igor Savenko <bliss@cloudlinux.com> 1.6-14
changelog:
  - DEF-8080: ssl-cache reimplementation
  - DEF-7991: ipdetect crashes when all domains are dedicated ones
  - DEF-8110: sentrylogs can use up to 6000 threads and more.
  - DEF-8096: Allow uploads of files of any size


author: Igor Savenko <bliss@cloudlinux.com> 1.7-3
changelog:
  - DEF-7573: Make webshield use new LPC tries functionality
  - DEF-7990: Webshield experiences memory leakage when ssl-caching daemon is down


author: Igor Savenko <bliss@cloudlinux.com> 1.7-7
changelog:
  - DEF-7938: Add webshield CSF PT_USERKILL exclusions
  - DEF-8061: Find no-cache headers to clients like varnish
  - DEF-8294: Prepare build script for jenkins builds
  - DEF-8281: Added domain to SSL cache
  - DEF-8275: changed webshield captcha 'static' endpoint to much less predictable string
  - DEF-8330: Mark all config files as NOT conffiles to avoid questioning on update


author: Igor Savenko <bliss@cloudlinux.com> 1.7-8
changelog:
  - DEF-8510: Remove process ID from sentry message ('cause they are always different)
  - DEF-8281: Get cpanel domain from certificate pem file


author: Igor Savenko <bliss@cloudlinux.com> 1.7-10
changelog:
  - DEF-8482: Process 'X-Forwarded-For' header only after vendor-specific headers
  - DEF-8236: Wsshdict, ssl-cache and sentrylogs: rewrite existing PID file silently on start


author: Igor Savenko <bliss@cloudlinux.com> 1.7-12
changelog:
  - DEF-6741: Immunify Farsi Translation
  - DEF-8641: Added 'expires off' parameter to forbid adding or modifying 'expires' and 'cache-control' headers
  - DEF-8561: Disable sentry client logging to syslog
  - DEF-8614: User google account for Recapcha


author: Igor Savenko <bliss@cloudlinux.com> 1.8-6
changelog:
  - DEF-9354: Added PROXY protocol support for webshield
  - DEF-9551: Update webshield to OpenResty-1.15.8.1


author: Igor Savenko <bliss@cloudlinux.com> 1.8-7
changelog:
  - DEF-9752: Create a script to enable/disable webshield
  - DEF-8614: User google account for Recapcha bugfix


author: Igor Savenko <bliss@cloudlinux.com> 1.8-8
changelog:
  - DEF-9752: Fixed for ubuntu 18.04. Renamed script to 'webshieldctl'. Added separate actions for enable/disable, start/stop, activate/deactivate
  - DEF-9905: Self-signed certificate is no longer removed on uninstallation


author: Igor Savenko <bliss@cloudlinux.com> 1.8-9
changelog:
  - DEF-9752: Added 'is-active', 'is-enabled' actions
  - DEF-9905: Self-signed cert removal is made dependent on scriplet argument


author: Igor Savenko <bliss@cloudlinux.com> 1.7-14
changelog:
  - DEF-7079: Bring back splashscreen to webshield
  - DEF-8121: Country block in webshield
  - DEF-8238: Disable client body buffering
  - DEF-9040: Webshield shared memory daemon segfaults when message size exceeds 2048 bytes
  - DEF-8939: Custom whitelisted/blacklisted IPs support in webshield
  - DEF-9031: Modify imunify360-webshield-compose-whitelist script to use custom black and white lists
  - DEF-5385: Use splashscreen as captcha for Chinese customers


author: Igor Savenko <bliss@cloudlinux.com> 1.8-2
changelog:
  - DEF-8964: Added cron job for restarting wsshdict in EL6 environment
  - DEF-9249: When a host with cPanel has no user accounts, ssl-cache daemon does not start


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.0.0-3
changelog:
  - DEF-12384 SSL cache CLI updates default dests
  - DEF-12330 Add required scripts
  - DEF-12384 Make SSL cache daemon and CLI a single binary
  - DEF-12384 Move ssl_cache_update to cli directory
  - DEF-12384 Refactor CLI tool, add unit tests
  - DEF-12330 Add buildsystem script
  - Edit project structure, extract service files from webshield
  - Fix non-installing binaries on debian
  - Fix integration tests to work with plesk nginx environment
  - Bump go version to 1.14.1
  - DEF-12421: nil dereference in main()
  - DEF-11890 Add integration test body
  - DEF-11890 Add cPanel mock for integration tests
  - DEF-11890 Add DirectAdmin mock for integration tests
  - DEF-11890 Add Plesk mock for integration tests
  - Fixes for domain checker and wsshdict
  - DEF-12301 Unit test for Plesk.GetUserCertsPath
  - DEF-12301 Unit test for Plesk.LastModified
  - DEF-12301 Fix cert path detection on Plesk
  - DEF-12301 Add os detection
  - DEF-11890 Add certificate helper
  - DEF-11890 Add wsshdict client
  - DEF-11890 Add domain checker
  - Remove unnecessary DeleteFile function
  - DEF-12300 Unquote cert paths on plesk
  - DEF-12298 GetCertCommonName return wrong name
  - DEF-11888: fix packaging for RPM


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 1.1.0-1
changelog:
  - DEF-12857 Use log levels, change frequent messages' level to debug
  - DEF-12857 Add levels for logging
  - DEF-12690 Process dedicated ip vhosts dir on Plesk
  - DEF-11160 Add support for OpenLiteSpeed in DirectAdmin


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 1.1.1-1
changelog:
  - DEF-13422 Add ability to parse multiple vhosts in one webserver config
  - Remove force installation from integration tests
  - DEF-12963 Remove service exit if syslog/sentry is not available
  - DEF-12941 Enable reporting based on agent config
  - Remove Jenkinsfile due to moving to unified unit tests job


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 1.3.0-1
changelog:
  - DEF-13547: memorize manually-added certificate for supported panels
  - DEF-13547: add unit tests for ssl_cache package
  - DEF-14498: review and improve test coverage
  - DEF-14804: handle litespeed as apache for directadmin


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 1.4.0-1
changelog:
  - Update Go version to 1.15.6
  - DEF-15164: add logging of domain certs
  - Add unit test for cacheUpdateLoop
  - Add trace flag, remove test mode
  - DEF-15363: fix CLI display of certs, improve tests


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 2.0.1-1
changelog:
  - DEF-16629 Add README.md
  - DEF-16812 update license
  - DEF-16787 use commit hash in gerrit builds
  - DEF-16747: Change sentry DSN
  - DEF-16576: fix SIGPIPE handling


author: Ruslan Shmelev <rshmelev@cloudlinux.com> - 1.0-0
changelog:
  - modify cron to update from the stable repository
  - bump version numbers to 1.0-0
  - bump component versions to the stable ones


author: Rex Dieter <rdieter@fedoraproject.org> 2007e-13
changelog:
  - _with_system_libc_client option (el6+) 
  - tight deps via %?_isa
  - drop extraneous Requires(post,postun): xinetd


author: Remi Collet <remi@remirepo.net> - 1.0.16-1
changelog:
  - update to 1.0.16
  - soname bump to 23 (libsodium13 compat package exists)
  - manage update from libsodium23 (3rd party repository)
  - Add static library subpackage
  - fix license management


author: Miroslav Rezanina <mrezanin@redhat.com> 1.1-2
changelog:
  - lu-Fix-rpmdiff-failure.patch [bz#1229359]
  - lu-Fix-buffer-overflow-reported-by-Coverity.patch [bz#1233114]
  - Resolves: bz#1229359
    (Fix multilib support)
  - Resolves: bz#1233114
    (fix off-by-one in dwarf_to_unw_regnum (CVE-2015-3239))


author: Miroslav Rezanina <mrezanin@redhat.com> 1.1-5
changelog:
  - Version bumped [bz#1238864]
  - Resolves: bz#1238864
    libunwind: bump version to win against existing branches


author: Miroslav Rezanina <mrezanin@redhat.com> 1.1-6.el7
changelog:
  - Fix update from EPEL version [bz#1289950]
  - Resolves: bz#1289950
    (libunwind in RHEL 7.2 has a smaller release than the last libunwind package in EPEL-7)


author: Miroslav Rezanina <mrezanin@redhat.com> 1.2-2.el7
changelog:
  - Rebase to 1.2 [bz#1384435]
  - Resolves: bz#1384435
    (Rebase libunwind package (and add for ppc64le): libunwind)


author: Tim Niemueller <tim@niemueller.de> - 5.1.4-7
changelog:
  - Add patch to from lua.org with smaller bugfixes
  - sed -i -e 's/5\.1\.3/5.1.4/g' on autotoolize patch, bug #641144


author: Benjamin Gilbert <bgilbert@backtick.net> - 3.3.3-1
changelog:
  - New upstream release
     + Minor compatibility improvements for Aperio JP2K and Hamamatsu slides
  - Update Source0 URL


author: Benjamin Gilbert <bgilbert@backtick.net> - 8.5.6-1
changelog:
  - New release
  - Rename Python packages per policy
  - Update project URLs
  - Rename pygobject3-base dependency to python-gobject-base
  - Switch python3-gobject dependency to python3-gobject-base
  - Add missing arch-specific Python provide
  - Drop Group tags


