cairo (1.16.0-5ubuntu2.1) jammy-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2017-9814-1.patch: replace calls to malloc with
      _cairo_malloc.
    - debian/patches/CVE-2017-9814-2.patch: check cmap size before allocating
      memory in src/cairo-truetype-subset.c.
    - CVE-2017-9814
  * SECURITY UPDATE: assertion failure
    - debian/patches/CVE-2019-6461.patch: adds check for NaN angles in
      src/cairo-arc.c.
    - CVE-2019-6461
  * SECURITY UPDATE: infinite loop
    - debian/patches/CVE-2019-6462.patch: defines max_segments for use in a
      while loop conditional to prevent an infinite loop in src/cairo-arc.c.
    - CVE-2019-6462

 -- Ian Constantin <ian.constantin@canonical.com>  Mon, 30 Mar 2026 16:16:09 +0300

cairo (1.16.0-5ubuntu2) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:09:57 +0200

cairo (1.16.0-5ubuntu1) hirsute; urgency=medium

  * Disable with lto for now, not ready upstream.
  * Don't build the udeb package when requested.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 30 Mar 2021 14:40:17 +0200

cairo (1.16.0-5build1) hirsute; urgency=medium

  * No-change rebuild to drop the udeb package.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 22 Feb 2021 10:30:21 +0100

cairo (1.16.0-5) unstable; urgency=medium

  * Team upload
  * d/patches: Add patches from upstream for CVE-2020-35492
    (Closes: #978658)
  * Build-Depend on gtk-doc-tools.
    autoconf 2.70 automatically runs gtkdocize to update gtk-doc-related
    files for packages that invoke the GTK_DOC_CHECK macro, causing FTBFS
    with that version if gtk-doc-tools is not installed. (Closes: #978779)
  * d/tests/build: Mark as superficial (see #904979)
  * d/tests/build: Fix shellcheck warnings
  * d/tests/build: Use correct compiler for proposed autopkgtest
    cross-architecture testing support (Closes: #946371)
  * d/shlibs.local: Generate lockstep dependencies between binary packages.
    Upstream developers are not going to support mixing binary packages
    of different versions from the same source package, and neither should
    we; they all migrate to testing as a unit anyway.
  * Add Build-Depends-Package to all symbols files
  * Remove migration path from libcairo2-dbg older than Debian 9 'stretch'
  * d/rules: Don't maintain shlibs version manually.
    The symbols files make this unnecessary under most circumstances, and -V
    (which is the default in debhelper compat level 12) generates a
    dependency on at least the corresponding upstream version as a fallback.
  * Move to debhelper-compat 12
    - Drop -V from dh_makeshlibs (it is now the default)
  * Set Rules-Requires-Root to no
  * Wrap a long line in the 1.12.4-1 changelog entry (thanks, lintian-brush)
  * d/patches: Move patches from upstream to beginning of series, and add
    metadata
  * Add Lintian override for documentation in /usr/share/gtk-doc/html.
    See #970275 for details of why this is correct.
  * libcairo-gobject2: Add override for library-not-linked-against-libc.
    This library uses functions from Cairo, GLib and GObject, and does not
    directly depend on glibc.
  * Register with doc-base using a symlink in /usr/share/doc.
    This silences a Lintian warning, and makes the documentation a bit more
    discoverable.
  * Standards-Version: 4.5.1 (no changes required)

 -- Simon McVittie <smcv@debian.org>  Thu, 31 Dec 2020 21:39:40 +0000

cairo (1.16.0-4) unstable; urgency=medium

  * Team upload
  * d/p/ft-Use-FT_Done_MM_Var-instead-of-free-when-available-in-c.patch:
    Apply patch to fix memory corruption with packages that set their
    own memory allocator, such as WebKitGTK+.
    (Closes: #915801, CVE-2018-19876)

 -- Simon McVittie <smcv@debian.org>  Fri, 15 Mar 2019 07:57:56 +0000

cairo (1.16.0-3) unstable; urgency=medium

  * debian/patches/git-pdf-add-missing-flush.patch:
    - backport patch to fix corrupted pdf exports/prints

 -- Sebastien Bacher <seb128@ubuntu.com>  Fri, 22 Feb 2019 15:07:18 +0100

cairo (1.16.0-2) unstable; urgency=medium

  * Restore -Wl,-O1 to our LDFLAGS
  * Bump Standards-Version to 4.3.0

 -- Jeremy Bicha <jbicha@debian.org>  Sun, 23 Dec 2018 18:02:09 -0500

cairo (1.16.0-1) unstable; urgency=medium

  * New upstream release
  * debian/watch: watch for stable releases
  * Drop 0005-Fix-assertion-failure-in-the-freetype-backend.patch:
    - Applied in new release

 -- Jeremy Bicha <jbicha@debian.org>  Sat, 20 Oct 2018 09:36:36 -0400

cairo (1.15.12-1) unstable; urgency=medium

  * New upstream snapshot release
  * debian/libcairo2.symbols: Add new symbols
  * Drop 0005-Revert-fix-warning-variable-X.patch: Applied in new release
  * Cherry-pick 0005-Fix-assertion-failure-in-the-freetype-backend.patch
  * Bump Standards-Version to 4.1.4
  * Build with all hardening flags
  * Minor update to debian/watch
  * Update debian/gbp.conf

 -- Jeremy Bicha <jbicha@debian.org>  Thu, 23 Aug 2018 20:05:13 -0400

# For older changelog entries, run 'apt-get changelog libcairo2'
