Changelog from Quinteros-1 to Quinteros-2

ManageIQ/manageiq

Bug (Security)

• Encrypt verify_credentials params before MiqQueue [CVE-2023-46175]
• Extend wrapped_logger formatter if one is present [CVE-2023-46175]
• Filter out Basic Authorization tokens [CVE-2023-46175]
• Fix YAML imports to only accept specific types. [CVE-2024-43191]

Enhancement

• Add workflow_dispatch to allow manually triggering monolithic builds [#22997]

Other

• [QUINTEROS] Update Gemfile.lock.release for various security issues [#23223]
• Remove CVE-2024-26143 as rails 6.1 is not vulnerable [#22913]
• Force rails 6.1.7.7 minimum version [#22910]
• Temporarily ignore non-critical CVE as we upgrade to rails 7 [#22909]

ManageIQ/manageiq-api

Bug

• [QUINTEROS] Fix Host verify_credentials_task password expectation [#1272]
• Fix Host verify_credentials_task password expectation [#1271]
• Fix CloudNetworks spec with empty including() [#1267]

ManageIQ/manageiq-appliance-build

Bug

• [quinteros] Lock down to ruby 3.0.4 from Appstream [#579]
• [quinteros] Update CentOS Stream 8 repos [#575]

ManageIQ/manageiq-documentation

Bug

• QA Updated KubeVirt references [#1797]
• QA Updated images. [#1785]

Enhancement

• LVM guidelines for ISCSI/FC SmartState Analysis [#1782]

Other

• QA Removed SCVMM provider [#1816]

ManageIQ/manageiq-gems-pending

Bug

• Fix MiqXml handling of BOM + handle CVE-2024-39908 [#581]

Other

• [QUINTEROS] Fix rspec version used to match core’s version [#594]
• Bump rexml to 3.3.6 for CVE-2024-43398 [#589]
• Upgrade rexml to 3.3.3+ for CVE-2024-41123 and CVE-2024-41946 [#582]

ManageIQ/manageiq-pods

Bug

• [quinteros] Lock down to ruby 3.0.4 from Appstream [#1186]

ManageIQ/manageiq-providers-ansible_tower

Bug (Security)

• Use ProviderSdkLogger as the class for ansible_tower_log [CVE-2023-46175]

ManageIQ/manageiq-providers-autosde

Bug (Security)

• Don’t log the token during re-auth [CVE-2023-46175]

ManageIQ/manageiq-providers-awx

Bug (Security)

• Use ProviderSdkLogger as the class for awx_log [CVE-2023-46175]

ManageIQ/manageiq-providers-kubernetes

Bug

• [QUINTEROS] JSON parse prometheus_alert client responses [#541]

ManageIQ/manageiq-providers-lenovo

Bug (Security)

• Use ProviderSdkLogger as the class for xclarity_log [CVE-2023-46175]

ManageIQ/manageiq-rpm_build

Bug

• [quinteros] Allow timestamped release builds [#482]
• [quinteros] Lock down to ruby 3.0.4 from Appstream [#521]

ManageIQ/manageiq-ui-classic

Bug

• Fix automate specs [#9226]
• Fix the VM Infra button checking EmsCloud providers [#9249]