Fix CVE-2019-19956 (#1793000)
Fix CVE-2019-20388 (#1810057)
Fix CVE-2020-7595 (#1810073)
Fix xsd:any schema validation (#1812145)

Fix CVE-2015-8035 (#1595697)
Fix CVE-2018-14404 (#1602817)
Fix CVE-2017-15412 (#1729857)
Fix CVE-2016-5131 (#1714050)
Fix CVE-2017-18258 (#1579211)
Fix CVE-2018-1456 (#1622715)

Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
Fix inappropriate fetch of entities content (CVE-2016-4449)
Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
Avoid building recursive entities (CVE-2016-3627)
Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
More format string warnings with possible format string vulnerability (CVE-2016-4448)

Fix a series of CVEs (rhbz#1286496)
CVE-2015-7941 Stop parsing on entities boundaries errors
CVE-2015-7941 Cleanup conditional section error handling
CVE-2015-8317 Fail parsing early on if encoding conversion failed
CVE-2015-7942 Another variation of overflow in Conditional sections
CVE-2015-7942 Fix an error in previous Conditional section patch
Fix parsing short unclosed comment uninitialized access
CVE-2015-7498 Avoid processing entities after encoding conversion failures
CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
CVE-2015-5312 Another entity expansion issue
CVE-2015-7499 Add xmlHaltParser() to stop the parser
CVE-2015-7499 Detect incoherency on GROW
CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
CVE-2015-8242 Buffer overead with HTML parser in push mode
CVE-2015-1819 Enforce the reader to run in constant memory

Fix missing entities after CVE-2014-3660 fix
CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
Fix regressions introduced by CVE-2014-0191 patch

CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1149087)

Mass rebuild 2014-01-24

rebuild to activate -O3 on ppc64 rhbz#1051068

Mass rebuild 2013-12-27

Fix a regression in xmlGetDocCompressMode() rhbz#963716

upstream release of 2.9.1
a couple more API entry point
compatibility with python3
a lot of bug fixes

fix --nocheck build which I broke in october rhbz#909767

workaround for crc/len check failure, rhbz#877567

remaining cleanups from merge bug rhbz#226079
do not put the docs in the main package, only in -devel rhbz#864731

upstream release of 2.9.0
A few new API entry points
More resilient push parser mode
A lot of portability improvement
Faster XPath evaluation
a lot of bug fixes and smaller improvement

upstream release candidate 1 of 2.9.0
introduce a small API change, but ABI compatible, see
August/msg00005.html
data-connector are upstream
many bug fixes including security aspects and small improvements