dnsmasq (2.92-1ubuntu0.4) resolute-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in log_query.
    - debian/patches/CVE-2026-12725.patch: Account for the "not supported"
      string in logs, and add checks to catch overflow in src/cache.c and
      src/dnssec.c
    - CVE-2026-12725
  * SECURITY UPDATE: Buffer OOB read in find_soa.
    - debian/patches/CVE-2026-12969.patch: change the extrabytes argument
      from 0 to 10 in src/rfc1035.c
    - CVE-2026-12969

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 13 Jul 2026 16:07:58 -0600

dnsmasq (2.92-1ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: OOB write via BOOTREPLY packet
    - debian/patches/CVE-2026-6507.patch: Fix 1-byte buffer overflow in
      relay_reply4() in src/rfc2131.c.
    - CVE-2026-6507

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 22 May 2026 13:06:00 -0400

dnsmasq (2.92-1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow on malicious caches in DNS
    forwarding.
    - debian/patches/CVE-2026-2291.patch: Expand char name size in
      src/dnsmasq.h.
    - CVE-2026-2291
  * SECURITY UPDATE: NSEC bitmap parsing infinite loop
    - debian/patches/CVE-2026-4890.patch: Correct erroneous iteration index
      in src/dnssec.c
    - CVE-2026-4890
  * SECURITY UPDATE: Unbounded length field in RRSIG packets.
    - debian/patches/CVE-2026-4891.patch: Validate rdlen in src/dnssec.c
    - CVE-2026-4891
  * SECURITY UPDATE: Buffer overflow in create_helper
    - debian/patches/CVE-2026-4892.patch: Add upper bound to for loop in
      src/helper.c
    - CVE-2026-4892
  * SECURITY UPDATE: Erroneous client subnet validation
    - debian/patches/CVE-2026-4893.patch: Fixed length passed to check_source
      in src/forward.c
    - CVE-2026-4893
  * SECURITY UPDATE: Buffer overflow in extract_addresses.
    - debian/patches/CVE-2026-5172.patch: Check index after extracting name
      in src/rfc1035.c
    - CVE-2026-5172

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 29 Apr 2026 12:33:48 -0600

dnsmasq (2.92-1) unstable; urgency=medium

  * d/t/functions:
    - Fix a typo.
    - In function check_utils, wait 1s before checking for cleared lease file.
      This measure should avoid occasional test failures.
  * Upload to unstable.

 -- Sven Geuer <sge@debian.org>  Sun, 18 Jan 2026 17:01:16 +0100

dnsmasq (2.92-1~exp1) experimental; urgency=medium

  * New upstream version 2.92
  * d/p/*: Drop work-around-bug-1122015.patch, the bug has been fixed.
  * d/control: Bump Standards-Version to 4.7.3.
  * d/copyright: Bump upstream and packaging copyright years.

 -- Sven Geuer <sge@debian.org>  Fri, 16 Jan 2026 20:07:33 +0100

dnsmasq (2.92~rc3-1) unstable; urgency=medium

  * New upstream version 2.92~rc3
  * d/p/*:
    - Adapt patches to new upstream release.
    - Add work-around-bug-1122015.patch fixing temporary problem with
      systemd integration test.

 -- Sven Geuer <sge@debian.org>  Sun, 07 Dec 2025 20:12:47 +0100

dnsmasq (2.92~rc1-1) unstable; urgency=medium

  * New upstream version 2.92~rc1
  * d/p/*:
    - Adapt eliminate-privacy-breaches.patch to new upstream version.
    - Add en-manpage.patch fixing typos reported by lintian.
    - Add sv-manpage.patch fixing lintian warning and a typo.
  * d/watch: Update watch file to version 5 format.
  * d/control: Drop 'Rules-Requires-Root: no', it's the default now.

 -- Sven Geuer <sge@debian.org>  Thu, 04 Dec 2025 19:02:47 +0100

dnsmasq (2.91-1) unstable; urgency=medium

  * New upstream version 2.91
  * d/control: Bump Standards-Version to 4.7.2.

 -- Sven Geuer <sge@debian.org>  Thu, 20 Mar 2025 18:22:04 +0100

dnsmasq (2.91~test9-1) unstable; urgency=medium

  * New upstream pre-release 2.91~test9

 -- Sven Geuer <sge@debian.org>  Thu, 23 Jan 2025 12:37:39 +0100

dnsmasq (2.91~test6-1) unstable; urgency=medium

  * New upstream pre-release 2.91~test6
  * d/watch: Consider only tar.gz archives.
  * d/p/*: Drop fix-crash-when-reloading-DHCP-config-on-SIGHUP.patch,
    applied upstream.
  * d/t/functions.d/options*.patterns: Adapt pattern files to the new
    upstream version.
  * d/rules: Call dh_auto_build without --no-parallel, upstream meanwhile
    supports parallel build.
  * d/copyright:
    - Correct copyright years of src/dnssec.c.
    - Bump copyright years to 2025.

 -- Sven Geuer <sge@debian.org>  Mon, 13 Jan 2025 13:18:22 +0100

dnsmasq (2.90-7) unstable; urgency=medium

  * d/p/*:
    - Add patch to fix crash when reloading DHCP config on SIGHUP
      (closes: #1090352).

 -- Sven Geuer <sge@debian.org>  Tue, 17 Dec 2024 22:21:34 +0100

dnsmasq (2.90-6) unstable; urgency=medium

  * Enhance autopkgtests.
    - d/t/functions:
      - Deal with dhcpcd in addition to isc-dhcp-client (closes: #1089585).
    - d/t/*:
      - Make sure ifupdown is installed with tests relying on it and remove
        systemd-resolved possibly installed by default (closes: #1089586).
      - Drop trailing empty lines.
    - Thanks to Lukas Märdian <slyon@ubuntu.com> for bringing up the issues
      and for providing patches.

 -- Sven Geuer <sge@debian.org>  Tue, 10 Dec 2024 20:44:54 +0100

dnsmasq (2.90-5) unstable; urgency=medium

  * d/control + d/copyright:
    - Update my email address to the d.o one.
  * d/control:
    - Mark all packages as Multi-Arch: foreign (closes: #934477). Thanks to
      "Yuriy M. Kaminskiy" <yumkam+debian@gmail.com> for the patch.
  * d/dnsmasq.service + d/dnsmasq@.service:
    - Require network-online.target instead of network.target (closes: #774970,
      lp: #1531184). Thanks to David Britton <david.britton@canonical.com> for
      the patch.
    - Add Documentation key.
  * d/init-system-common:
    - Run resolvconf asynchronously (closes: #871958, lp: #1778073). Thanks to
      Ciaby, https://launchpad.net/~ciaby, for tracking down what caused a
      deadlock between dnsmasq, resolvconf and postfix.
  * d/tests/*:
    - Add test to verify the fix to bug #871958 still works.
  * d/p/*:
    - Add patch to remove trailing white space from dnsmasq.conf.example
      (closes: #1022706).
  * d/rules:
    - Apply dh_installexamples instead of explicit code to package
      dnsmasq.conf.example.
  * d/dnsmasq.init:
    - Fix lintian issue init.d-script-missing-lsb-short-description.

 -- Sven Geuer <sge@debian.org>  Sat, 23 Nov 2024 18:50:11 +0100

dnsmasq (2.90-4) unstable; urgency=medium

  * d/dnsmasq-base.postrm:
    - Handle the rare case "userdel" not being available (closes: #1071142).
  * Bump Standards-Version to 4.7.0.

 -- Sven Geuer <debmaint@g-e-u-e-r.de>  Fri, 17 May 2024 17:33:51 +0200

dnsmasq (2.90-3) unstable; urgency=medium

  * Update d/control:
    - Add passwd to Depends of dnsmasq-base(-lua) (closes: #1064518).
    - Update the Vcs-* fields (closes: #1065347).
    - Fix lintian issue build-depends-on-obsolete-package.
    - Add myself as uploader.
  * Update d/copyright:
    - Fix lintian issue missing-field-in-dep5-copyright.
  * Add missing CVE number to the 2.90-1 change log.

 -- Sven Geuer <debmaint@g-e-u-e-r.de>  Sat, 09 Mar 2024 20:18:53 +0100

dnsmasq (2.90-2) unstable; urgency=medium

  [ Sven Geuer ]
  * Relax limits imposed by d/t/functions.d/ip-addr.patterns to allow for
    successful tests on ci.debian.net.

 -- Simon Kelley <simon@thekelleys.org.uk>  Wed, 14 Feb 2024 11:33:14 +0000

dnsmasq (2.90-1) unstable; urgency=medium

  [ Simon Kelley ]
  * New upstream. (closes: #1033165)
    CVE-2023-28450
  * Move hard-coding of Lua version from the upstream Makefile
    to  d/rules.
  * Security fixes for Keytrap - DNSSEC validation CPU exhaustion.
    CVE-2023-50387 and CVE-2023-50868
  [ Sven Geuer ]
  * Introduce autokpgtests per d/tests/* (closes: #1034135).
  * Switch to dpkg-source 3.0 (quilt) format (closes: #1007041).
  * doc.html: Add patch to eliminate privacy breaches leaving the Donations
    paragraph as untouched as possible.
  * Prepend dnsmasq. to default, init, preinst, postinst, prerm, postrm.
  * Rename d/systemd.service to d/dnsmasq.service.
  * Rename d/systemd@.service to d/dnsmasq@.service.
  * Refactor d/rules to use the DH sequencer and fix major lintian issues
    (closes: #844989, #1040923, #1063551).
    Modified files:
    - d/rules
        Complete rewrite making use of debhelper and its tools, fixes lintian
        warning debian-rules-sets-dpkg-architecture-variable.
    - d/control
        Build-Depends, Pre-Depends, Depends added or changed as needed, lintian
        error depends-on-obsolete-package fixed.
    - d/dnsmasq.default
        ENABLED removed and comment changed to fix lintian error
        init.d-script-should-always-start-service.
    - d/dnsmasq.init
        Remove handling of obsolete ENABLED flag.
        Extract code used with System-V-style init and systemd into
        d/init-system-common, extract code used with systemd only
        into d/systemd-helper. This fixes lintian warning
        systemd-service-file-wraps-init-script.
        Drop workaround for hypothetically non-existent file
        /lib/lsb/init-functions, it has been around for more than a decade.
    - d/dnsmasq.service, d/dnsmasq@.service
        Adapt these files to make use of init-system-common and systemd-helper.
    - d/dnsmasq.{post,pre}{inst,rm}
        Rely mostly on the script snippets created by the DH tools to get
        things done, implicitly fixes the lintian warnings
        maintainer-script-should-not-use-dpkg-maintscript-helper and
        command-with-path-in-maintainer-script.
    - d/resolvconf*
        Change file mode bits to 0755, the installed files need it
    New files:
    - d/dnsmasq.{install,links,maintscript}
    - d/dnsmasq-base.{dirs,docs,install}
    - d/dnsmasq-base-lua.{dirs,docs,install,links}
    - d/dnsmasq-utils.{install,manpages}
        The DH tools use these to install what was scripted explicitly
        in the previous version of the d/rules file,
        lintian warning dbus-policy-in-etc fixed
    - d/init-system-common
    - d/systemd-helper
        These files contain slightly modified code formerly part of in
        d/dnsmasq.init.
    Deleted files:
    - d/*conffiles
    - d/lintian-override
    - d/installed-marker
        These are not in use anymore.
  * Deal with a removed conffile and changed links.
    Modified files:
    - d/dnsmasq-base.{postinst,postrm}
    New files:
    - d/dnsmasq-base.maintscript
    - d/dnsmasq-base-lua.maintscript
  * Add watch file and upstream's signing key.
    New files:
    - d/watch
    - d/u/signing-key.asc
  * Remove dependency on package adduser.
    Modified files:
    - d/control
    - d/dnsmasq.post{inst,rm}
  * Refactor d/copyright to comply with DEP 5 (closes: #966505).
  * Remove trailing whitespace from various files under debian/.
  * Bump Standards-Version to 4.6.2.
  * Specify Rules-Requires-Root.
  * Update http:// to https:// with Homepage, Vcs-Git and Vcs-Browser.
  * Introduce d/u/metadata.
  * Fix lintian issue duplicate-short-description.
  * Fix lintian issue capitalization-error-in-description.
  * Bump Lua version to 5.4 (closes: #1050750).
    Modified files:
    - d/control
    - d/t/functions.d/log.patterns

 -- Simon Kelley <simon@thekelleys.org.uk>  Fri, 23 Jan 2024 22:52:01 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog dnsmasq-base`.
