bubblewrap (0.12.0-1) unstable; urgency=high

  * New upstream release
    - Prevent sandbox escape via symlink traversal.
      If an app framework such as Flatpak mounts subdirectories into a
      directory controlled by the sandboxed app, a malicious or compromised
      sandboxed app could create symlinks in that directory to arrange for
      files/directories to be created on the host system.
      (GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655)
    - d/rules: Stop passing -Dsupport_setuid=false.
      The option no longer exists, and the new version of bubblewrap always
      behaves as though its value was false.
    - d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream
    - d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
      Adjust patch to apply to the new upstream release
  * d/rules: Don't compile fallback code paths for kernel older than 5.10.
    This ensures that we're using the safest available mechanisms,
    using the openat2() syscall rather than emulating it in user-space.
    As a result, this version will not work on kernels older than the
    one found in Debian 11.

 -- Simon McVittie <smcv@debian.org>  Wed, 26 Aug 2026 11:32:16 +0100

bubblewrap (0.11.2-2) unstable; urgency=medium

  * d/rules: Stop allowing bubblewrap to run when setuid, matching
    the upstream default. This ensures that vulnerabilities similar to
    CVE-2026-41163 can't happen in future.
  * d/control, d/NEWS, d/README.Debian: Update documentation accordingly
  * Standards-Version: 4.7.4 (no changes required)

 -- Simon McVittie <smcv@debian.org>  Tue, 12 May 2026 18:57:32 +0100

bubblewrap (0.11.2-1) unstable; urgency=medium

  * New upstream release
    - Fixes a root privilege escalation vulnerability if bwrap has been
      made setuid root locally (CVE-2026-41163, Closes: #1134704).
      Most Debian systems have a non-setuid bubblewrap and therefore
      are unaffected by this.
  * d/rules: Temporarily allow bubblewrap to be setuid root.
    This configuration is a security risk and rarely necessary, so the
    option is deprecated, and a future upstream version will
    unconditionally refuse to run if it detects that it has been run
    setuid root.
  * d/README.Debian: Update to reflect deprecation of setuid-root bwrap
  * d/NEWS: Mention deprecation of setuid-root mode

 -- Simon McVittie <smcv@debian.org>  Thu, 23 Apr 2026 12:25:34 +0100

bubblewrap (0.11.1-1) unstable; urgency=medium

  * New upstream release
  * Stop overriding kernel.unprivileged_userns_clone sysctl.
    The setting we use has been the default for several years.
  * d/control: Remove Recommends on procps.
    This was only needed as a way to force the required value of
    kernel.unprivileged_userns_clone during the transition from Debian 10
    to 11, and even then, only on non-systemd systems.
  * d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
    Refresh patch to apply after a grammatical fix upstream
  * d/control: Replace transitional libselinux1-dev with libselinux-dev
  * d/control: Bump Standards-Version to 4.7.3.
    Remove Priority: optional, no longer required with current dpkg-dev.
  * d/copyright: Stop quoting the FSF's former postal address
  * d/rules: Stop overriding build system.
    This was only necessary while bubblewrap supported both Meson and
    Autotools builds, which it hasn't since 0.11.0.
  * d/clean: Remove another Autotools remnant
  * d/rules: Install NEWS.md as the upstream changelog
  * Stop using debhelper's historical special case for a single binary
    package. Explicitly list what we intend to install, instead.
  * d/watch: Update to v5 format
  * d/README.Debian: Mention glycin as a prominent use of bubblewrap
  * d/README.Debian: Reduce focus on pre-Debian-10 kernels

 -- Simon McVittie <smcv@debian.org>  Sat, 21 Mar 2026 18:52:56 +0000

bubblewrap (0.11.0-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * d/tests: Drop obsolete upstream-usrmerge autopkgtest.
    This test was added to additionally run the upstream test suite on
    a /usr-merged system. Now that all systems are merged-/usr, this
    test no longer provides any benefit, and removing it will unblock
    removal of the usrmerge package. (Closes: #1091676)

  [ Simon McVittie ]
  * Also remove d/tests/upstream-usrmerge symlink

 -- Simon McVittie <smcv@debian.org>  Mon, 30 Dec 2024 11:17:50 +0000

bubblewrap (0.11.0-1) unstable; urgency=medium

  * New upstream release

 -- Simon McVittie <smcv@debian.org>  Wed, 30 Oct 2024 16:15:12 +0000

bubblewrap (0.10.0+30+g0545e72-1) experimental; urgency=low

  * New upstream snapshot
    - New options to create overlay mounts (--overlay, etc.)
    - New option --level-prefix
    - Handle EINTR
    - Ensure socket control message data is aligned correctly
    - Remove Autotools build system
    - Silence Meson and compiler warnings
  * d/salsa-ci.yml: Don't run Salsa-CI for branches targeting Ubuntu
  * Standards-Version: 4.7.0 (no changes required)

 -- Simon McVittie <smcv@debian.org>  Fri, 18 Oct 2024 19:52:17 +0100

bubblewrap (0.10.0-1) unstable; urgency=high

  * New upstream release
    - This version adds the --[ro-]bind-fd option, which is necessary to
      resolve CVE-2024-42472 in Flatpak without introducing a potentially
      exploitable race condition.

 -- Simon McVittie <smcv@debian.org>  Wed, 14 Aug 2024 09:43:11 +0100

bubblewrap (0.9.0-1) unstable; urgency=medium

  * New upstream release
  * d/copyright: Update
  * d/p/tests-Explicitly-unshare-userns-when-testing-disable-user.patch,
    d/p/tests-Try-harder-to-evade-disable-userns.patch:
    Drop patches that were included upstream

 -- Simon McVittie <smcv@debian.org>  Tue, 26 Mar 2024 21:16:50 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog bubblewrap`.
