curl (8.18.0-1ubuntu2.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Use after free in curl_easy_reset.
    - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in
      include/curl/curl.h, lib/http2.c,
      lib/setopt.c, lib/url.c, and lib/urldata.h
    - CVE-2026-10536
  * SECURITY UPDATE: Denial of service in QUIC UDP.
    - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets
      and enforce an upper bound in
      lib/vquic/vquic.c
    - CVE-2026-11352
  * SECURITY UPDATE: Improper certificate validation in native_ca_store.
    - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to
      keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to
      calculate every easy transfer if a native CA store shall be used or
      not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c
    - CVE-2026-11564
  * SECURITY UPDATE: Memory exhaustion in ws.c
    - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless
      there is sufficient space left in the websocket send buffer in
      lib/ws.c.
    - CVE-2026-11586
  * SECURITY UPDATE: Improper validation in config2setopts.
    - debian/patches/CVE-2026-12064.patch: Use default protocol properly in
      src/config2setopts.c.
    - CVE-2026-12064

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 06 Jul 2026 10:45:44 -0600

curl (8.18.0-1ubuntu2.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Connection reuse for starttls protocols.
    - debian/patches/CVE-2026-8286.patch: When a connection is tested for
      reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),
      the SSL configuration must match the existing connection in lib/url.c
    - CVE-2026-8286
  * SECURITY UPDATE: Connection reuse in SASL.
    - debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in
      in lib/curl_sasl.c, lib/http_negotiate.c, lib/http_ntlm.c, lib/imap.c,
      lib/openldap.c, and lib/pop3.c
    - CVE-2026-8458
  * SECURITY UPDATE: Cookie injection in is_public_suffix.
    - debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking
      PSL in lib/cookie.c.
    - CVE-2026-8924
  * SECURITY UPDATE: Double-free in gsasl.
    - debian/patches/CVE-2026-8925.patch: Require libgasl 1.6.0 to handle
      NULL argument in lib/vauth/gsasl.c.
    - CVE-2026-8925
  * SECURITY UPDATE: Information disclosure in netrc.
    - debian/patches/CVE-2026-8926.patch: Do not return a password from
      parsenetrc() when the requested login did not match the credentials
      found for the matched machine in lib/netrc.c.
    - CVE-2026-8926
  * SECURITY UPDATE: Information disclosure in libcurl
    - debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as
      previous and flush state in lib/url.c and lib/urldata.h.
    - debian/patches/CVE-2026-9079.patch: Verify NULLed proxy credentials
      in lib/setopt.c.
    - debian/patches/CVE-2026-9545.patch: Hard fail when certificate
      verification fails in lib/vquic/curl_ngtcp2.c.
    - CVE-2026-8927
    - CVE-2026-9079
    - CVE-2026-9545
  * SECURITY UPDATE: Use-after-free in curl_easy_parse
    - debian/patches/CVE-2026-9080.patch: Introduce magic struct field to
      assert against NULL pointers in lib/multi_ev.c
    - CVE-2026-9080
  * SECURITY UPDATE: Man-in-the-middle in libcurl.
    - debian/patches/CVE-2026-9547.patch: Reject host key mismatches in
      in lib/vssh/libssh.c
    - CVE-2026-9547

 -- Kyle Kernick <kyle.kernick@canonical.com>  Thu, 25 Jun 2026 15:11:42 -0600

curl (8.18.0-1ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: connection reuse ignores TLS requirement
    - debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls
      connection if new requires TLS in lib/url.c.
    - CVE-2026-4873
  * SECURITY UPDATE: wrong reuse of HTTP Negotiate connection
    - debian/patches/CVE-2026-5545.patch: improve connection reuse on
      negotiate in lib/url.c.
    - CVE-2026-5545
  * SECURITY UPDATE: wrong reuse of SMB connection
    - debian/patches/CVE-2026-5773.patch: disable connection reuse for
      SMB(S) in lib/smb.c.
    - CVE-2026-5773
  * SECURITY UPDATE: proxy credentials leak over redirect-to proxy
    - debian/patches/CVE-2026-6253-pre1.patch: chunked response, error code
      in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c, tests/*.
    - debian/patches/CVE-2026-6253-pre2.patch: fix error code, remove SMB
      use in tests/data/test445.
    - debian/patches/CVE-2026-6253.patch: clear the proxy credentials as
      well on port or scheme change in lib/http.c, lib/transfer.*, tests/*.
    - CVE-2026-6253
  * SECURITY UPDATE: stale custom cookie host causes cookie leak
    - debian/patches/CVE-2026-6276.patch: move cookiehost to struct
      SingleRequest in lib/http.c, lib/request.c, lib/request.h, lib/url.c,
      lib/urldata.h, tests/*.
    - CVE-2026-6276
  * SECURITY UPDATE: netrc credential leak with reused proxy connection
    - debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes
      pushed over insecure connections in lib/http2.c.
    - debian/patches/CVE-2026-6429-pre2.patch: same origin tests in
      lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.
    - debian/patches/CVE-2026-6429.patch: clear credentials better on
      redirect in lib/http.c, tests/*.
    - CVE-2026-6429
  * SECURITY UPDATE: cross-proxy Digest auth state leak
    - debian/patches/CVE-2026-7168.patch: clear proxy auth properties when
      switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.
    - CVE-2026-7168

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Apr 2026 07:35:43 -0400

curl (8.18.0-1ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: bad reuse of HTTP Negotiate connection
    - debian/patches/CVE-2026-1965-1.patch: fix reuse of connections using
      HTTP Negotiate in lib/url.c.
    - debian/patches/CVE-2026-1965-2.patch: fix copy and paste
      url_match_auth_nego mistake in lib/url.c.
    - CVE-2026-1965
  * SECURITY UPDATE: token leak with redirect and netrc
    - debian/patches/CVE-2026-3783.patch: only send bearer if auth is
      allowed in lib/http.c, tests/data/Makefile.am, tests/data/test2006.
    - CVE-2026-3783
  * SECURITY UPDATE: wrong proxy connection reuse with credentials
    - debian/patches/CVE-2026-3784.patch: add additional tests in
      lib/url.c, tests/http/test_13_proxy_auth.py,
      tests/http/testenv/curl.py.
    - CVE-2026-3784
  * SECURITY UPDATE: use after free in SMB connection reuse
    - debian/patches/CVE-2026-3805.patch: free the path in the request
      struct properly in lib/smb.c.
    - CVE-2026-3805

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 09 Mar 2026 08:30:05 -0400

curl (8.18.0-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2138401). Remaining changes:
    - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe
    - d/control: do not use gnutls for the curl binary
    - d/control: don't build-depend on python3-impacket and stunnel on i386

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Wed, 14 Jan 2026 11:47:19 -0800

curl (8.18.0-1) unstable; urgency=medium

  * New upstream version 8.18.0
  * debian/control:
      - Bump stds-version to 4.7.3.
      - Remove Priority field, it already defaults to optional.
      - Remove Rules-Requires-Root, it already defaults to no.
  * debian/copyright: bump packaging copyright years, happy 2026!

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Wed, 07 Jan 2026 21:09:51 -0300

curl (8.18.0~rc3-1) unstable; urgency=medium

  * New upstream version 8.18.0~rc3
  * Refresh patches
  * d/copyright: Remove entries for files removed upstream
  * Refresh patches:
     - ZZZgnutls-build.patch
     - build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch
  * d/copyright: Remove entries for files removed upstream:
     - lib/vtls/mbedtls_threadlock.c
     - lib/vtls/mbedtls_threadlock.h

 -- Samuel Henrique <samueloph@debian.org>  Sun, 28 Dec 2025 21:54:41 -0800

curl (8.18.0~rc2-1) unstable; urgency=medium

  * New upstream version 8.18.0~rc2
  * d/copyright: Remove entries for files removed upstream
  * d/patches:
    - Drop patches merged upstream:
      ~ fix-progress-meter-in-parallel-mode.patch
      ~ wcurl-CVE-2025-11563.patch
    - Update patches:
      ~ ZZZgnutls-build.patch:
        + Variables AM_CFLAGS and AM_LDFLAGS were dropped
          in lib/Makefile.am
        + Update patch's context.
      ~ build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch:
        + Context update.
        + Update patch offset.
      ~ 11_omit-directories-from-config.patch:
        + Update for upstream usage of double quotes (replacing single quotes)
          for variables and usage of '&& test' instead of '-a' in
          curl-config.in.
  * d/libcurl4-doc.docs: Some docs were converted to .md:
    - docs/FAQ.md
    - docs/KNOWN_BUGS.md
    - docs/TODO.md

 -- Samuel Henrique <samueloph@debian.org>  Mon, 15 Dec 2025 18:51:22 -0800

curl (8.17.0-3) unstable; urgency=medium

  * d/p/fix-progress-meter-in-parallel-mode.patch: cherry-pick from upstream.

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Sun, 23 Nov 2025 21:41:12 -0300

curl (8.17.0-2) unstable; urgency=medium

  * d/p/wcurl-CVE-2025-11563.patch: Import new upstream patch to fix
    CVE-2025-11563

 -- Samuel Henrique <samueloph@debian.org>  Wed, 12 Nov 2025 20:08:24 -0800

curl (8.17.0-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2130119). Remaining changes:
    - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe
    - d/control: do not use gnutls for the curl binary
    - d/control: don't build-depend on python3-impacket and stunnel on i386

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Fri, 07 Nov 2025 13:42:15 +0100

curl (8.17.0-1) unstable; urgency=medium

  * New upstream version 8.17.0

 -- Samuel Henrique <samueloph@debian.org>  Wed, 05 Nov 2025 08:22:23 +0000

curl (8.17.0~rc3-1) unstable; urgency=medium

  * New upstream version 8.17.0~rc3
  * d/copyright: Drop lib/curl_des.c and lib/curl_des.h, removed upstream

 -- Samuel Henrique <samueloph@debian.org>  Wed, 29 Oct 2025 18:33:28 +0000

curl (8.17.0~rc2-1) unstable; urgency=medium

  * New upstream version 8.17.0~rc2
  * Revert "d/salsa-ci: enable ARM build test"
  * Drop patches merged upstream:
    - setopt-accept-_SSL_VERIFYHOST-set-to-2L.patch
    - asyn-thrdd-drop-pthread_cancel.patch
    - setopt-make-CURLOPT_MAXREDIRS-accept-1-again.patch
  * Refresh patches:
    - ZZZgnutls-build.patch
    - build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch
  * d/copyright: Drop entry for lib/krb5.c, file was removed
  * d/libcurl*.symbols: Add new symbols curl_multi_notify_disable and
    curl_multi_notify_enable

 -- Samuel Henrique <samueloph@debian.org>  Mon, 20 Oct 2025 19:05:21 +0100

curl (8.16.0-4) unstable; urgency=medium

  * debian/patches/setopt-make-CURLOPT_MAXREDIRS-accept-1-again.patch: import
    from upstream. (Closes: #1117593)

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Wed, 08 Oct 2025 13:05:07 -0300

curl (8.16.0-3) unstable; urgency=medium

  * d/control: Fix required versions of libnghttp3 and libngtcp2 packages.
     - Append "~" to the end of the version, for a backports-friendly package.
     - Add an explicit dependency on libnghttp3-9 and libngtcp2-16, as
       otherwise dpkg picks a lower version as a dependency, but we need
       newer versions for HTTP/3.
     - Bump the version requirement for libnghttp3-dev to 1.11.0.
  * d/control: wrap-and-sort -taf

 -- Samuel Henrique <samueloph@debian.org>  Tue, 07 Oct 2025 20:47:19 +0100

curl (8.16.0-2) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * d/rules: use DEB_DISTRIBUTION to add configure flags for experimental
  * d/watch-rc: keep a watch file for curl RC releases

  [ Marcos Felipe de Almeida Souza ]
  * d/patches: Add upstream commits to fix regressions
    - async-thrdd-drop-pthread_cancel.patch: Upstream changes
    - setopt-accept-_SSL_VERIFYHOST-set-to-2L.patch: Upstream changes

  [ Samuel Henrique ]
  * Build OpenSSL HTTP/3 support with ngtcp2
    - Add B-D on libngtcp2-crypto-ossl-dev (>= 1.16.0)
    - Add Depends on libngtcp2-crypto-ossl-dev (>= 1.16.0) and
      libngtcp2-dev (>= 1.16.0) in the OpenSSL -dev package
    - Bump libngtcp2-dev and libngtcp2-crypto-gnutls-dev Depends in the
      GnuTLS -dev package to >= 1.16.0
    - Drop --with-openssl-quic configure flag in OpenSSL build
    - Set --with-ngtcp2 and --with-nghttp3 configure flag for both builds
      (OpenSSL and GnuTLS)

 -- Samuel Henrique <samueloph@debian.org>  Thu, 02 Oct 2025 22:29:47 +0100

curl (8.16.0-1) unstable; urgency=medium

  * d/watch: Point to GitHub for GA releases
  * New upstream version 8.16.0

 -- Samuel Henrique <samueloph@debian.org>  Wed, 10 Sep 2025 08:40:58 +0100

curl (8.16.0~rc3-1) unstable; urgency=medium

  * New upstream version 8.16.0~rc3.

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Thu, 04 Sep 2025 21:26:46 -0300

curl (8.16.0~rc2-2) unstable; urgency=medium

  * d/t/common-upstream-tests: Invoke dh clean, not override_dh_auto_clean.

 -- Sergio Durigan Junior <sergiodj@debian.org>  Fri, 29 Aug 2025 23:37:58 -0400

curl (8.16.0~rc2-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 8.16.0~rc2
  * d/watch: Point to rc releases and pick tar.xz tarballs
  * Update patches:
    - 11_omit-directories-from-config.patch: Upstream changes in Makefile
    - ZZZgnutls-build.patch: Upstream changes in Makefile
    - build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch: Update
      context
  * d/libcurl*.symbols: New symbols "curl_multi_get_offt" and
    "curl_ws_start_frame"
  * d/rules: Add missing backslash to escape newline
  * d/rules: Remove "--cache-files" from curl-config

  [ Sergio Durigan Junior ]
  * Use d/clean instead of overriding dh_auto_clean
  * d/rules:
    - Enable symbol hiding when compiling curl.
    - New variables with_{openssl,gnutls}.
    - Specify --cache-file when invoking configure.
    - Expand removal of aclocal to debian/tmp*/ directories.
    - Use "define" to create a template of the configure step.
    - Use "define" to create a template of the build step.
    - Use "define" to create a template of the test step.
    - Use "define" to create a template of the install step.

  [ Aquila Macedo ]
  * d/copyright: sync licenses
  * d/copyright: add myself
  * d/lrc.config: add initial exclusions to suppress false positives

 -- Samuel Henrique <samueloph@debian.org>  Mon, 25 Aug 2025 23:21:04 +0100

curl (8.15.0-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 8.15.0
  * d/patches:
    - Drop patches merged upstream
    - build-Divide-mit-krb5-gssapi...: Refresh patch
    - ZZZgnutls-build.patch: Update patch
  * d/copyright:
    - Update with renamed and removed files
    - Remove dropped files build-openssl.bat and checksrc.bat

  [ Carlos Henrique Lima Melara ]
  * d/patches/:
    - Refresh patches
    - Rebase patches against new upstream version
  * d/libcurl4-doc.docs: remove docs/examples/README.md, it's in .examples *

  [ Aquila Macedo ]
  * d/tests/common-upstream-tests: centralize common build steps

 -- Samuel Henrique <samueloph@debian.org>  Sun, 10 Aug 2025 16:38:32 +0100

curl (8.14.1-2ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2117511). Remaining changes:
    - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe
    - d/{control,rules}: do not use gnutls for the curl binary
    - debian/control: don't build-depend on python3-impacket and stunnel4 on i386

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Tue, 22 Jul 2025 08:58:22 -0700

curl (8.14.1-2) unstable; urgency=medium

  * gbp pq import/export: Updated hunks offsets
  * d/patches:
    - tool_getparam_fix_ftp_pasv.patch: New upstream patch to fix regression
      in --ftp-pasv
    - curl_path_make_SFTP_handle_a_path.patch: New patch to fix longstanding
      regression on paths /~ for SFTP
    - tool_operate_fix_return_code_when_retry_is_used_but_not_triggered.patch:
      New patch to fix regression from 8.14.1

 -- Samuel Henrique <samueloph@debian.org>  Wed, 11 Jun 2025 19:18:58 +0100

curl (8.14.1-1ubuntu3) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Thu, 28 Aug 2025 19:13:38 +0000

curl (8.14.1-1ubuntu2) questing; urgency=medium

  * Drop part of delta as it was merged upstream:
    - d/rules: use libssh2-dev as it is in main (LP #2076865)

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Mon, 16 Jun 2025 12:40:58 -0700

curl (8.14.1-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2113994). Remaining changes:
    - d/rules: use libssh2-dev as it is in main (LP #2076865)
    - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe
    - d/{control,rules}: do not use gnutls for the curl binary
    - debian/control: don't build-depend on python3-impacket and stunnel4 on i386

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Wed, 11 Jun 2025 13:36:53 -0700

curl (8.14.1-1) unstable; urgency=medium

  * New upstream version 8.14.1
    - Fix CVE-2025-5399: WebSocket endless loop
  * d/p/multi_fix_add_handle_resizing: Drop patch, merged in 8.14.1

 -- Samuel Henrique <samueloph@debian.org>  Wed, 04 Jun 2025 08:21:05 +0100

curl (8.14.0-1) unstable; urgency=medium

  * New upstream version 8.14.0
  * Drop vendored wcurl now that it's in the upstream tarball
  * d/copyright: Update for upstream moved files:
    - They were moved from lib/ to lib/curlx/:
       ~ lib/curlx/version_win32.c
       ~ lib/curlx/version_win32.h
       ~ lib/curlx/inet_pton.c
  * d/patches:
    - Refresh patches
    - ZZZgnutls-build.patch: Update to also work with tests/tunit makefile
    - multi_fix_add_handle_resizing.patch: New patch to fix regression
    - Drop patches merged upstream:
      ~ autotools_install_shell_completion_files_on_cross_build.patch
      ~ scripts_completion_pl_sort_the_completion_file_for_all_shells.patch

 -- Samuel Henrique <samueloph@debian.org>  Wed, 28 May 2025 19:26:28 +0100

curl (8.13.0-5ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2111373). Remaining changes:
    - d/rules: use libssh2-dev as it is in main (LP #2076865)
    - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe
    - d/{control,rules}: do not use gnutls for the curl binary
    - debian/control: don't build-depend on python3-impacket and stunnel4 on i386

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Sun, 18 May 2025 19:46:02 -0700

curl (8.13.0-5) unstable; urgency=medium

  * d/t/upstream-*: ensure clean build by calling override_dh_auto_clean
  * d/salsa-ci: enable ARM build test

 -- Aquila Macedo Costa <aquilamacedo@riseup.net>  Fri, 25 Apr 2025 21:31:31 +0100

curl (8.13.0-4) unstable; urgency=medium

  * d/tests/control: Install curl for the openssl tests
  * d/p/autotools_install_shell_completion_files_on_cross_build: Fix FTCBFS,
    thanks to Helmut Grohne (closes: #1103938)

 -- Samuel Henrique <samueloph@debian.org>  Thu, 24 Apr 2025 00:02:26 +0100

curl (8.13.0-3) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * d/t/upstream-tests-*: use correct version of curl in tests

  [ наб ]
  * d/README.source: delete (false)

  [ Matheus Polkorny ]
  * d/copyright: Update to reflect upstream copyright changes

  [ Samuel Henrique ]
  * Update wcurl to v2025.04.20

 -- Samuel Henrique <samueloph@debian.org>  Mon, 21 Apr 2025 00:23:44 +0100

curl (8.13.0-2) unstable; urgency=medium

  * Link with OpenSSL for the curl CLI (closes: #1095986)
  * d/control: Recommends bash-completion for curl binary package
  * d/p/scripts_completion_pl..: New patch to fix build reprocibility
  * d/curl.NEWS: Add an entry to mention switch back to OpenSSL

 -- Samuel Henrique <samueloph@debian.org>  Sun, 06 Apr 2025 22:13:18 +0100

curl (8.13.0-1) unstable; urgency=medium

  * New upstream version 8.13.0
  * Update Standards-Version to 4.7.2
  * Ship shell completions on crossbuilds. Upstream changed the way they are
    generated and it doesn't need to call the compiled binary anymore.
  * d/copyright: Drop removed files genroot.sh and genserv.sh
  * d/watch: Point to GitHub for GA releases

 -- Samuel Henrique <samueloph@debian.org>  Wed, 02 Apr 2025 09:12:40 +0100

curl (8.13.0~rc3-1) unstable; urgency=medium

  * New upstream version 8.13.0~rc3
  * d/p/runtests-feat-filter.patch: Drop patch, merged upstream
  * d/watch: Properly identify RC release IDs (rc1, rc2...)

  [ Vladimir Petko ]
  * Revert Ubuntu compatibility changes for building with libssh
    (closes: #1079076)

 -- Samuel Henrique <samueloph@debian.org>  Wed, 26 Mar 2025 18:37:55 +0000

curl (8.13.0~rc2-2) unstable; urgency=medium

  * Team upload.
  * d/p/runtests-feat-filter.patch: Import upstream patch for feature-based
    test filtering
  * d/rules:
    - Add pkg.curl.debug profile support
    - Add 'feat:debug' as option to the TESTS_GENERAL_PARAMETERS in debug
      profile
  * d/tests:
    - Add new autopkgtests for event-based tests
    - Redirect specific autopkgtest outputs to artifacts to reduce build log
      noise
    - Reduce override_dh_auto_test verbosity in the event-based autopkgtests

 -- Aquila Macedo Costa <aquilamacedo@riseup.net>  Mon, 17 Mar 2025 21:04:08 -0300

curl (8.13.0~rc2-1) unstable; urgency=medium

  * New upstream version 8.13.0~rc2
    - gnutls: fix use of pkcs11 urls for keys/certs (closes: #1077060)
    - gnutls: set priority via --ciphers (closes: #1095981)
  * d/p/build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a: Refresh patch
  * d/p/fix-managen-script: Drop merged patch
  * d/watch: Point to rc releases and pick tar.xz tarballs

 -- Samuel Henrique <samueloph@debian.org>  Mon, 17 Mar 2025 16:40:32 +0000

curl (8.12.1-3ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
    - d/{control,rules}: Do not use gnutls for the curl binary.
    - d/{control,rules}: Drop nghttp3 and ngtcp2 dependencies in Universe.
    - d/rules: Use libssh2-dev as it is in Main (LP: #2076865).

 -- Simon Quigley <tsimonq2@ubuntu.com>  Tue, 04 Mar 2025 20:32:39 -0600

curl (8.12.1-3) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * d/p/fix-managen-script: cherry-pick from upstream to fix manpage

  [ Samuel Henrique ]
  * Update wcurl to 2025.02.24

 -- Samuel Henrique <samueloph@debian.org>  Tue, 25 Feb 2025 19:30:46 +0000

curl (8.12.1-2ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
    - d/{control,rules}: Do not use gnutls for the curl binary.
    - d/{control,rules}: Drop nghttp3 and ngtcp2 dependencies in Universe.
    - d/rules: Use libssh2-dev as it is in Main (LP: #2076865).

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 19 Feb 2025 02:06:13 -0600

curl (8.12.1-2) unstable; urgency=medium

  * Revert "Use valgrind in tests"
    valgrind is not available on all archs, and there were too many test
    failures on some that have it.
    We should instead enable valgrind on experimental first, then address
    those issues, and only then do it on unstable.
  * d/copyright: Remove entry for projects/build-wolfssl.bat, removed file

 -- Samuel Henrique <samueloph@debian.org>  Fri, 14 Feb 2025 21:27:50 +0000

curl (8.12.1-1ubuntu2) plucky; urgency=medium

  * Disable valgrind on riscv64.
  * Drop libcurl4-openssl-dev's runtime dependency on libnghttp3-dev in
    Universe.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Tue, 18 Feb 2025 01:47:49 -0600

curl (8.12.1-1ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.
    - d/{control,rules}: Do not use gnutls for the curl binary.
    - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of
      libcurl-gnutls to avoid component-mismatch.
    - d/rules: Use libssh2-dev as it is in main (LP: #2076865).

 -- Simon Quigley <tsimonq2@ubuntu.com>  Fri, 14 Feb 2025 21:43:29 -0600

curl (8.12.1-1) unstable; urgency=medium

  * New upstream version 8.12.1.
  * Revert "d/copyright: exclude Windows related stuff from upstream tarball".
    Not needed when using upstream releases or daily snapshots.
  * Use valgrind in tests.
  * d/control: libcurl4-openssl-dev: Depend on libnghttp3-dev.
  * d/rules: Build OpenSSL with HTTP3 support.

 -- Samuel Henrique <samueloph@debian.org>  Thu, 13 Feb 2025 22:17:23 +0000

curl (8.12.0+git20250209.89ed161+ds-1ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.
    - d/{control,rules}: Do not use gnutls for the curl binary.
    - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of
      libcurl-gnutls to avoid component-mismatch.
    - d/rules: Use libssh2-dev as it is in main (LP: #2076865).

 -- Simon Quigley <tsimonq2@ubuntu.com>  Mon, 10 Feb 2025 22:22:17 -0600

curl (8.12.0+git20250209.89ed161+ds-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * d/curl.NEWS: Update wcurl's list of features

  [ Carlos Henrique Lima Melara ]
  * New upstream version 8.12.0+git20250209.89ed161+ds.
  * d/copyright: update maintainer's copyright years.
  * d/libcurl*.symbols: add symbols introduced in 8.12.0.
  * d/patches/: rebase patches against 8.12.0
      - async_thread_avoid_closing_eventfd_twice.patch: drop, present in 8.12.0.
      - sectransp_free_certificate_on_error.patch: drop, present in 8.12.0.

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Sun, 09 Feb 2025 00:08:26 +0100

curl (8.11.1-1ubuntu1) plucky; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.
    - d/{control,rules}: Do not use gnutls for the curl binary.
    - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of
      libcurl-gnutls to avoid component-mismatch.
    - d/rules: Use libssh2-dev as it is in main (LP: #2076865).

 -- Simon Quigley <tsimonq2@ubuntu.com>  Sat, 14 Dec 2024 03:39:34 -0600

curl (8.11.1-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 8.11.1
    - Fix CVE-2024-11053: netrc and redirect credential leak (closes: #1089682)
  * Update wcurl to 2024.12.08
  * New patches:
    - async_thread_avoid_closing_eventfd_twice: Fix file descriptor issue with eventfd
    - sectransp_free_certificate_on_error: Fix memory leak
  * Refresh patches:
    - ZZZgnutls-build
    - build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a
  * d/p/11_omit-directories-from-config: Update patch
  * Drop merged patches:
    - cmdline_ech_md_formatting_cleanups
    - duphandle_also_init_netrc
    - libssh_when_using_IPv6_numerical_address_add_brackets
    - netrc_support_large_file_longer_lines_longer_tokens
    - setopt_fix_CURLOPT_HTTP_CONTENT_DECODING
  * d/p/Remove-curl-s-LDFLAGS-from-curl-config-static-libs: Remove patch, not needed anymore

  [ Carlos Henrique Lima Melara ]
  * d/t/upstream-tests-*: test gnutls backend against installed curl
  * d/t/control: install curl on upstream-tests-gnutls and remove on openssl

 -- Samuel Henrique <samueloph@debian.org>  Thu, 12 Dec 2024 21:38:04 +0000

curl (8.11.0-1ubuntu2) plucky; urgency=medium

  * Update debian/rules to actually use libssh2 on Ubuntu

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 22 Nov 2024 14:34:26 -0500

curl (8.11.0-1ubuntu1) plucky; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.
    - d/{control,rules}: Do not use gnutls for the curl binary.
    - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of
      libcurl-gnutls to avoid component-mismatch.
    - d/rules: Use libssh2-dev as it is in main (LP: #2076865).

 -- Simon Quigley <tsimonq2@ubuntu.com>  Thu, 21 Nov 2024 15:44:22 -0600

curl (8.11.0-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 8.11.0
  * Fix CVE-2024-9681: HSTS subdomain overwrites parent cache entry
   (closes: #1086804)
  * Update patches for the new release
  * d/rules: Drop '--enable-websockets', it's enabled by default now
  * d/libcurl*.symbols: Remove HIDDEN@HIDDEN 7.16.2
  * Add 5 upstream patches to fix regressions:
    - cmdline_ech_md_formatting_cleanups.patch
    - duphandle_also_init_netrc.patch
    - libssh_when_using_IPv6_numerical_address_add_brackets.patch
    - netrc_support_large_file_longer_lines_longer_tokens.patch
    - setopt_fix_CURLOPT_HTTP_CONTENT_DECODING.patch

  [ Carlos Henrique Lima Melara ]
  * d/rules: add sed rule to make curl-config get CPPFLAGS in run-time
  * d/control: move libldap2-dev to Depends and use newer libldap-dev name
  * d/control: move libkrb5-dev from Suggests to Depends for -dev packages

 -- Samuel Henrique <samueloph@debian.org>  Sat, 09 Nov 2024 17:34:22 +0000

curl (8.10.1-2) unstable; urgency=medium

  * d/patches/gtls_add_p12_format_support.patch: New upstream patch for P12
    support

 -- Samuel Henrique <samueloph@debian.org>  Thu, 10 Oct 2024 23:22:24 +0100

curl (8.10.1-1) unstable; urgency=medium

  * New upstream version 8.10.1
  * d/p/ZZZgnutls-build.patch: Update patch

 -- Samuel Henrique <samueloph@debian.org>  Wed, 18 Sep 2024 07:27:29 +0100

curl (8.10.0-2) unstable; urgency=medium

  [ Simon McVittie ]
  * d/rules: Do not allow any undefined symbols when linking
  * ZZZgnutls-build.patch: Resync libraries used for GNUTLS flavour
    (closes: #1081514, #1081517, #1081533)
  * ZZZgnutls-build.patch: De-conditionalize libcurlu.la  parameters

 -- Samuel Henrique <samueloph@debian.org>  Thu, 12 Sep 2024 21:35:48 +0100

curl (8.10.0-1) unstable; urgency=medium

  * New upstream version 8.10.0
    - Fix CVE-2024-8096 - OCSP stapling bypass with GnuTLS
    - Fix curl -w '%{size_header}' for GnuTLS (closes: #1076800)
  * d/copyright: Remove entry for deleted file tests/server/fake_ntlm.c
  * d/patches:
    - Refresh patches
    - ignore-SIGPIPE-after-init.patch: Drop patch, merged upstream
  * d/rules:
    - Replace buildconf invocation with autoreconf -fi
    - dh_installchangelogs: s/CHANGES/CHANGES.md
  * d/libcurl4-doc.docs: Remove dropped docs
  * d/libcurl4t64.lintian-overrides: Remove unused overrides

 -- Samuel Henrique <samueloph@debian.org>  Wed, 11 Sep 2024 20:32:59 +0100

curl (8.9.1-2ubuntu3) plucky; urgency=medium

  * SECURITY UPDATE: HSTS expiry overwrites parent cache entry.
    - debian/patches/CVE-2024-9681.patch: Add bestsub, blen, and hostname
      comparison in lib/hsts.c.
    - CVE-2024-9681

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Wed, 06 Nov 2024 09:10:08 -0330

curl (8.9.1-2ubuntu2) oracular; urgency=medium

  * SECURITY UPDATE: OCSP stapling bypass with GnuTLS
    - debian/patches/CVE-2024-8096.patch: fix OCSP stapling management in
      lib/vtls/gtls.c.
    - CVE-2024-8096

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 16 Sep 2024 10:46:36 -0400

curl (8.9.1-2ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2076679). Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.
    - d/{control,rules}: Do not use gnutls for the curl binary.
    - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of
      libcurl-gnutls to avoid component-mismatch.
  * Drop Changes:
    - d/t/upstream-tests-{gnutls,openssl}: Add workaround to fix
      LP: 2071468. The issue was fixed in dpkg-dev 1.22.11ubuntu1.
  * New Changes:
    - d/rules: Use libssh2-dev as it is in main (LP: #2076865).

 -- Vladimir Petko <vladimir.petko@canonical.com>  Tue, 13 Aug 2024 09:16:22 +1200

curl (8.9.1-2) unstable; urgency=medium

  [ Steve McIntyre ]
  * Improve the patch for the gnutls build. Instead of calling quilt
    during the binary package build, use autotools to do the work we
    need when calling configure etc. Closes: #1077650

  [ Carlos Henrique Lima Melara ]
  * debian/control: bump Standards-Version to 4.7.0, no changes needed.
  * debian/patches/ignore-SIGPIPE-after-init.patch: add new patch from
    upstream. (Closes: #1077854)
  * debian/tests/build-using-libcurl*: add tests to check if libcurl headers
    and pkgconf info are correct.

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Fri, 09 Aug 2024 19:47:58 -0300

curl (8.9.1-1) unstable; urgency=medium

  * New upstream version 8.9.1. (Closes: 1077656)
    - fix CVE-2024-7264: ASN.1 date parser overread.
  * debian/patch/build-Divide-mit-[...].patch: refresh patch.

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Wed, 31 Jul 2024 22:12:06 +0900

curl (8.9.0-3) unstable; urgency=medium

  * debian/control: make libcurl*-dev packages Depends on -dev packages.
    (Closes: #1077197, #1077190)
  * debian/rules: decrease tests parallelism multiplier.

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Sun, 28 Jul 2024 19:26:49 +0900

curl (8.9.0-2) unstable; urgency=medium

  * debian/control: make libcurl*-dev packages Recommends -dev packages.
    (Closes: #1077197, #1077190)

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Sat, 27 Jul 2024 12:53:28 +0900

curl (8.9.0-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * debian/curl.NEWS: Update wcurl description.

  [ Carlos Henrique Lima Melara ]
  * New upstream version 8.9.0. (Closes: #1076996)
    - fix CVE-2024-6197: freeing stack buffer in utf8asn1str.
    - fix CVE-2024-6874: macidn punycode buffer overread.
  * debian/copyright: drop copyright from removed file.
  * debian/patches/: drop merged patches and refresh patches against new
    upstream release.
      - docs_makefile_am_make_curl_config_1_install.patch: drop.
      - fix-x509asn1-fallback-to-dotted-OID-representation.patch: drop.
  * debian/gbp.conf: add upstream-branch definition.

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Thu, 25 Jul 2024 22:14:54 +0900

curl (8.8.0-4) unstable; urgency=medium

  [ Adrian Bunk ]
  * Revert "Temporarily disable build-time tests on 32-bit non-x86"
  * Don't use python3-impacket on non-Rust architectures that lack
    python-cryptography

  [ Lev Lazinskiy ]
  * Use SALSA_CI_DPKG_BUILDPACKAGE_ARGS in pipeline

  [ Samuel Henrique ]
  * Update wcurl to 2024.07.10

 -- Samuel Henrique <samueloph@debian.org>  Wed, 10 Jul 2024 22:36:04 +0100

curl (8.8.0-3ubuntu4) oracular; urgency=medium

  * Rebuild against new dpkg without elf-package-metadata.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 07 Aug 2024 15:22:33 +0200

curl (8.8.0-3ubuntu3) oracular; urgency=medium

  * d/{control,rules}: Do not use gnutls for the curl binary
  * d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of libcurl-gnutls
    to avoid component-mismatch

 -- Lukas Märdian <slyon@ubuntu.com>  Tue, 09 Jul 2024 14:30:56 +0200

curl (8.8.0-3ubuntu2) oracular; urgency=medium

  * d/t/upstream-tests-{gnutls,openssl}: Add workaround to fix
    LP: #2071468.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 08 Jul 2024 16:25:16 -0400

curl (8.8.0-3ubuntu1) oracular; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 08 Jul 2024 15:45:32 +0200

curl (8.8.0-3) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * d/p/fix-x509asn1-fallback-to-dotted-OID-representation.patch: add patch
    (Closes: #1075796)
  * d/p/11_omit-directories-from-config.patch: update to remove new issue
    (Closes: #1075802)
  * d/p/04_workaround_as_needed_bug.patch: drop patch, not needed anymore

  [ Samuel Henrique ]
  * Update wcurl to 2024-07-07

 -- Samuel Henrique <samueloph@debian.org>  Sun, 07 Jul 2024 00:42:42 +0100

curl (8.8.0-2ubuntu1) oracular; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 03 Jul 2024 11:43:21 +0200

curl (8.8.0-2) unstable; urgency=medium

  * curl.NEWS: Announce switch to GnuTLS, HTTP3 support and wcurl
  * Switch curl package/binary to use gnutls, now with HTTP3 support
  * Build libcurl-gnutls with HTTP3 support (build-dep on nghttp3 and ngtcp2)
  * Build libcurl-gnutls with ca-bundle=/etc/ssl/certs/ca-certificates.crt
  * Build with websockets support
  * Ship fish completion file
  * Ship wcurl and its manpage

 -- Samuel Henrique <samueloph@debian.org>  Sun, 30 Jun 2024 13:53:05 +0100

curl (8.8.0-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/control: Don't build-depend on python3-impacket and stunnel4 on
      i386 so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.
  * Drop CVE-2024-0853 CVE-2024-2004 and CVE-2024-2398 fixes, now upstream

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Fri, 24 May 2024 16:08:30 +0200

curl (8.8.0-1) unstable; urgency=medium

  * New upstream version 8.8.0
  * Refresh patches
  * Revert "Temporarily disable LDAP support on 32-bit non-x86"
  * d/patches: Drop merged patches
  * d/p/docs_makefile...: Upstream patch to fix curl-config regression
  * d/libcurl*.symbols: Add new symbol curl_multi_waitfds

 -- Samuel Henrique <samueloph@debian.org>  Wed, 22 May 2024 22:22:28 +0100

curl (8.7.1-5) unstable; urgency=high

  * d/p/content_encoding_brotli_and_others...patch: New patch to fix an
    encoding regression. Thank you to Jeroen Ooms and the curl developers
    (Daniel Stenberg and Stefan Eissing) for reporting and pointing out the
    fix.

 -- Samuel Henrique <samueloph@debian.org>  Mon, 29 Apr 2024 18:28:54 +0100

curl (8.7.1-4) unstable; urgency=medium

  * d/p/curl-8_7_1-h2-ngtcp2-write-error-handling.diff: New patch to address
    git+http2 issue. Thanks to Stefan Eissing <stefan@eissing.org> for
    doing the backport.

 -- Samuel Henrique <samueloph@debian.org>  Sat, 27 Apr 2024 18:00:28 +0100

curl (8.7.1-3) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * d/p/fix-regression-in-curlinfo.patch: add patch from upstream, thanks to
    Antonio Terceiro for reporting it (closes: #1069292)

  [ Samuel Henrique ]
  * d/libcurl3t64-gnutls.lintian-overrides: Drop unused override

 -- Samuel Henrique <samueloph@debian.org>  Fri, 19 Apr 2024 19:06:23 +0100

curl (8.7.1-2) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * d/rules: fix sed substitution regex for curl-config
  * d/rules: make a call to dpkg-buildflags in curl-config to get CFLAGS
    (Closes: #1057138)
  * d/control: suggests dpkg-dev for -dev packages so we get dpkg goodies
  * d/libcurl4-doc.docs: list each markdown file to be installed
  * d/make-manpages-reproducible.patch: import from upstream
  * d/p/fix-regression-on-chunked-post.patch: add new patch from upstream

  [ Sergio Durigan Junior ]
  * d/p/openldap-create-ldap-URLs-correctly-for-IPv6-addresses.patch:
    (Closes: #1053643)

  [ Samuel Henrique ]
  * d/rules: Run tests in parallel
  * d/p/test1901...: New patch to confirm regression fix

 -- Samuel Henrique <samueloph@debian.org>  Wed, 03 Apr 2024 18:59:41 +0100

curl (8.7.1-1) unstable; urgency=medium

  * New upstream version 8.7.1
    - Fix CVE-2024-2004: Usage of disabled protocol
    - Fix CVE-2024-2398: HTTP/2 push headers memory-leak
  * d/patches: Drop patches present on this release

 -- Samuel Henrique <samueloph@debian.org>  Wed, 27 Mar 2024 19:02:14 +0000

curl (8.6.0-4) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * d/libcurl*.links: use substitution variables instead of executable files

  [ Simon McVittie ]
  * d/control: Add a build-profile that disables LDAP support
    (closes: #1066981)
  * Temporarily disable LDAP support on 32-bit non-x86 (closes: #1066982)
  * Temporarily disable build-time tests on 32-bit non-x86

 -- Samuel Henrique <samueloph@debian.org>  Sat, 16 Mar 2024 17:17:57 +0000

curl (8.6.0-3.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix wrong X-Time64-Compat for libcurl4t64.  Closes: #1065315.

 -- Steve Langasek <vorlon@debian.org>  Sat, 02 Mar 2024 18:43:58 +0000

curl (8.6.0-3.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1061992

 -- Steve Langasek <vorlon@debian.org>  Sat, 02 Mar 2024 07:11:53 +0000

curl (8.6.0-3) unstable; urgency=medium

  * d/p/vtls_revert_receive_max_buffer_add_test_case.patch: New patch to fix
    tls regression (closes: #1063462)

 -- Samuel Henrique <samueloph@debian.org>  Mon, 19 Feb 2024 22:16:17 +0000

curl (8.6.0-2) unstable; urgency=medium

  * d/p/sendf_ignore_response_body_to_head.patch: New upstream patch to fix a
    compat issue (closes: #1063342)
  * d/control: Switch from pkg-config to pkgconf

 -- Samuel Henrique <samueloph@debian.org>  Tue, 06 Feb 2024 20:52:46 +0000

curl (8.6.0-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 8.6.0
    - Fix CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Drop upstream patches from 8.6.0
  * Update approach for installing manpages
  * d/copyright: Update copyright

  [ Carlos Henrique Lima Melara ]
  * d/control: exclude dependency on gnutls-bin for tests on ppc64el
    (Closes: #1059952)

 -- Samuel Henrique <samueloph@debian.org>  Wed, 31 Jan 2024 21:51:05 +0000

curl (8.5.0-2ubuntu10.1) noble-security; urgency=medium

  * SECURITY UPDATE: Usage of disabled protocol
    - debian/patches/CVE-2024-2004-pre1.patch: test1474: removed.
    - debian/patches/CVE-2024-2004.patch: fix disabling all protocols in
      lib/setopt.c, tests/data/Makefile.inc, tests/data/test1474.
    - CVE-2024-2004
  * SECURITY UPDATE: HTTP/2 push headers memory-leak
    - debian/patches/CVE-2024-2398.patch: push headers better cleanup in
      lib/http2.c.
    - CVE-2024-2398

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 22 Apr 2024 12:00:57 -0400

curl (8.5.0-2ubuntu10) noble; urgency=high

  * No change rebuild against libgnutls30t64, libnettle8t64, libpsl5t64,
    libssl3t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:38:07 +0200

curl (8.5.0-2ubuntu9) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 00:50:18 +0000

curl (8.5.0-2ubuntu8) noble; urgency=medium

  * Drop build-dependency on stunnel4 for i386: we already don't run tests
    on i386.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 24 Mar 2024 03:10:54 +0000

curl (8.5.0-2ubuntu7) noble; urgency=medium

  * Rename libraries for 64-bit time_t transition.  Closes: #1061992,
    #1065315.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 15 Mar 2024 10:19:32 -0700

curl (8.5.0-2ubuntu6) noble; urgency=medium

  * Build without forcing the nocheck profile.

 -- Dan Bungert <daniel.bungert@canonical.com>  Mon, 11 Mar 2024 14:51:34 -0600

curl (8.5.0-2ubuntu5) noble; urgency=medium

  * Build with nocheck profile.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Mar 2024 10:56:24 +0100

curl (8.5.0-2ubuntu3) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 17:36:56 +0000

curl (8.5.0-2ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: OCSP verification bypass with TLS session reuse
    - debian/patches/CVE-2024-0853.patch: when verifystatus fails, remove
      session id from cache in lib/vtls/openssl.c.
    - CVE-2024-0853

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 31 Jan 2024 11:09:34 -0500

curl (8.5.0-2ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2045886). Remaining changes:
    - debian/control: Don't build-depend on python3-impacket on i386
      so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.

 -- Danilo Egea Gondolfo <danilo.egea.gondolfo@canonical.com>  Tue, 02 Jan 2024 09:32:27 +0000

curl (8.5.0-2) unstable; urgency=medium

  * d/p/openldap_fix_an_LDAP_crash.patch: New patch to fix ldap segfault
    (closes: #1057855)

 -- Samuel Henrique <samueloph@debian.org>  Fri, 29 Dec 2023 15:34:11 -0300

curl (8.5.0-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 8.5.0
    - Fix CVE-2023-46218: cookie mixed case PSL bypass (closes: #1057646)
    - Fix CVE-2023-46219: HSTS long file name clears contents (closes: #1057645)
  * d/rules: Use pkg-info.mk instead of dpkg-parsechangelog for DEB_VERSION
  * d/p/90_gnutls.patch: Update patch
  * d/p/dist_add_tests_errorcodes_pl_to_the_tarball.patch: Upstream patch to
    fix tests
  * d/p/add_errorcodes_upstream_file.patch: Include missing file from upstream
    tarball

  [ Carlos Henrique Lima Melara ]
  * d/control: change Maintainer field to curl packaging team
  * d/README.Debian: add readme to explain curl's team creation
  * d/control: add myself to Uploaders

 -- Samuel Henrique <samueloph@debian.org>  Wed, 06 Dec 2023 20:15:49 +0000

curl (8.4.0-2ubuntu1) noble; urgency=medium

  * Merge from Debian unstable (LP: #2039798). Remaining changes:
    - debian/control: Don't build-depend on python3-impacket on i386
      so we can drop it (and its dependencies) from the i386 partial port.
      It's only used for the tests, which do not block the build in any case.
  * Drop patches for CVEs fixed upstream:
    - debian/patches/CVE-2023-38039.patch
    - debian/patches/CVE-2023-38545.patch
    - debian/patches/CVE-2023-38546.patch
  * Drop delta merged in Debian:
    - debian/tests/control
    - debian/tests/curl-ldapi-test

 -- Danilo Egea Gondolfo <danilo.egea.gondolfo@canonical.com>  Wed, 01 Nov 2023 12:06:23 +0000

curl (8.4.0-2) unstable; urgency=medium

  * d/rules: set CURL_PATCHSTAMP to package's version, so it shows up in
    "--version" output

 -- Samuel Henrique <samueloph@debian.org>  Sat, 14 Oct 2023 12:19:21 +0100

curl (8.4.0-1) unstable; urgency=medium

  * New upstream version 8.4.0
  * d/libcurl*.symbols: New symbol curl_multi_get_handles
  * d/patches:
    - Remove patches from 8.4.0 release
    - 90_gnutls.patch: Update patch

 -- Samuel Henrique <samueloph@debian.org>  Fri, 13 Oct 2023 00:53:16 +0100

curl (8.3.0-3) unstable; urgency=high

  * Add patches to fix CVE-2023-38545 and CVE-2023-38546

 -- Samuel Henrique <samueloph@debian.org>  Thu, 05 Oct 2023 22:26:40 +0100

curl (8.3.0-2) unstable; urgency=medium

  * d/rules: Add test 3102 to TESTS_FAILS_ON_IPV6_ONLY_MACHINES
  * d/patches: Import two upstream patches to try to fix FTBFS on armel/armhf
    - test650_fix_an_end_tag_typo.patch
    - tests_increase_the_default_server_logs_lock_timeout.patch
  * d/p/lib_use_wrapper_for_curl_mime_data_fseek_callback.patch: New patch to
    fix armel/armhf FTBFS

 -- Samuel Henrique <samueloph@debian.org>  Sun, 01 Oct 2023 15:01:42 +0100

curl (8.3.0-1) unstable; urgency=medium

  * New upstream version 8.3.0
    - Fix CVE-2023-38039: HTTP headers eat all memory
  * debian/: Remove files used for the nss packaging
  * d/patches:
    - Refresh patches
    - gen_pl_escape_all_dashes.patch: Drop merged patch
    - 90_gnutls.patch: Update patch
  * d/libcurl*.symbols: New symbol curl_global_trace

 -- Samuel Henrique <samueloph@debian.org>  Thu, 14 Sep 2023 16:13:10 +0530

curl (8.2.1-2) unstable; urgency=medium

  [ Andreas Hasenack ]
  * Move ldap-test to a script and add retry logic

  [ Samuel Henrique ]
  * Build without nss, dropped by upstream in the next release
  * d/p/gen_pl_escape_all_dashes.patch: New patch to fix manpage generation
    (closes: #1043309, #1043339)

 -- Samuel Henrique <samueloph@debian.org>  Fri, 25 Aug 2023 20:05:02 +0100

curl (8.2.1-1ubuntu3.1) mantic-security; urgency=medium

  * SECURITY UPDATE: SOCKS5 heap buffer overflow
    - debian/patches/CVE-2023-38545.patch: return error if hostname too
      long for remote resolve in lib/socks.c, tests/data/Makefile.inc,
      tests/data/test728.
    - CVE-2023-38545
  * SECURITY UPDATE: cookie injection with none file
    - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields
      in lib/cookie.c, lib/cookie.h, lib/easy.c.
    - CVE-2023-38546

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 03 Oct 2023 20:03:05 -0400

curl (8.2.1-1ubuntu3) mantic; urgency=medium

  * SECURITY UPDATE: HTTP headers eat all memory
    - debian/patches/CVE-2023-38039.patch: return error when receiving too
      large header set in lib/c-hyper.c, lib/cf-h1-proxy.c, lib/http.c,
      lib/http.h, lib/pingpong.c, lib/urldata.h.
    - CVE-2023-38039

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 11 Sep 2023 09:05:17 -0400

curl (8.2.1-1ubuntu2) mantic; urgency=medium

  * d/t/control, d/t/curl-ldapi-test: move test-command to an actual
    test script and add a retry logic (LP: #2030911)

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 09 Aug 2023 17:10:40 -0300

curl (8.2.1-1ubuntu1) mantic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Don't build-depend on python3-impacket on i386 so we can drop it
      (and its dependencies) from the i386 partial port.  It's only used for
      the tests, which do not block the build in any case.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 05 Aug 2023 16:06:26 +0200

curl (8.2.1-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 8.2.1

  [ Sergio Durigan Junior ]
  * d/p/{90_gnutls,99_nss}.patch:
    Update GNUTls/NSS patches to unbreak tests/http/clients
  * Drop unnecessary patches.
    d/p/CVE-2023-27533.patch
    d/p/CVE-2023-27534.patch
    d/p/CVE-2023-27535.patch
    d/p/CVE-2023-27536.patch
    d/p/CVE-2023-27537.patch
    d/p/CVE-2023-27538.patch
    d/p/CVE-2023-28319.patch
    d/p/CVE-2023-28320-1.patch
    d/p/CVE-2023-28320.patch
    d/p/CVE-2023-28321.patch
    d/p/CVE-2023-28322.patch
    d/p/CVE-2023-32001.patch
    d/p/Use-OpenLDAP-specific-functionality.patch
    d/p/fix-unix-domain-socket.patch

 -- Sergio Durigan Junior <sergiodj@debian.org>  Thu, 03 Aug 2023 20:00:01 -0400

curl (7.88.1-11) unstable; urgency=medium

  [ Carlos Henrique Lima Melara ]
  * Fix CVE-2023-32001: TOCTOU race condition in Curl_fopen():
    - Done by d/p/CVE-2023-32001.patch (Closes: #1041812).

  [ John Scott ]
  * LDAP backend: correct the usage of OpenLDAP-specific functionality being
    disabled with an upstream patch (Closes: #1041964)
    This corrects the improper fetching of binary attributes.
  * debian/tests: add a DEP-8 test that getting binary LDAP attributes works now

 -- Samuel Henrique <samueloph@debian.org>  Fri, 28 Jul 2023 21:11:25 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libcurl4t64`.
