expat (2.8.1-1) unstable; urgency=medium

  * New upstream release.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 23 May 2026 09:01:54 +0200

expat (2.8.0-2) unstable; urgency=high

  * Backport upstream fixes for self-testing:
    - drop casts around malloc that C99 does not need,
    - drop casts around XML_GetUserData that C99 does not need.
  * Backport upstream fixes for CVE-2026-45186: attribute name collision
    checks allowed denial of service attacks through moderately sized
    crafted XML input (closes: #1136164).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 10 May 2026 16:51:27 +0200

expat (2.8.0-1) unstable; urgency=high

  * New upstream release:
    - fixes CVE-2026-41080: improve protection against hash flooding
      (closes: #1134732).
  * Update libexpat1 symbols.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 25 Apr 2026 07:19:30 +0200

expat (2.7.5-1) unstable; urgency=high

  * New upstream release:
    - fixes CVE-2026-32776: NULL function pointer dereference for empty
      external parameter entities (closes: #1131117),
    - fixes CVE-2026-32777: protect from XML_TOK_INSTANCE_START infinite
      loop in entityValueProcessor() (closes: #1131118),
    - fixes CVE-2026-32778: NULL dereference in setContext() on retry after
      an earlier ouf-of-memory condition (closes: #1131119).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Tue, 17 Mar 2026 22:23:17 +0100

expat (2.7.4-1) unstable; urgency=high

  * New upstream release:
    - fixes CVE-2026-25210: integer overflow check for tag buffer
      reallocation (closes: #1126697),
    - no longer ships expat.m4 file.
  * Update watch file.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 31 Jan 2026 15:29:44 +0100

expat (2.7.3-2) unstable; urgency=high

  * Backport upstream fix for CVE-2026-24515: make
    XML_ExternalEntityParserCreate() copy unknown encoding handler user data
    (closes: 1126277).
  * Remove now redundant Rules-Requires-Root value.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 23 Jan 2026 16:48:32 +0100

expat (2.7.3-1) unstable; urgency=high

  * New upstream release:
    - fix alignment of internal allocations for some non-amd64
      architectures, fixes up on the fix to CVE-2025-59375,
    - fix a class of false positives where input should have been rejected
      with error XML_ERROR_ASYNC_ENTITY; regression from CVE-2024-8176.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 24 Sep 2025 23:31:38 +0200

expat (2.7.2-1) unstable; urgency=high

  * New upstream release:
    - fixes CVE-2025-59375: disallow use of disproportional amounts of
      dynamic memory from within an Expat parser (closes: #1115298).
  * Update fix-expat-cmake patch.
  * Update libexpat1 symbols.
  * Update Standards-Version to 4.7.2 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Tue, 16 Sep 2025 19:59:38 +0200

expat (2.7.1-2) unstable; urgency=medium

  * Move libc6 dependency to pre-dependency on libexpat1 to prevent
    dist-upgrade errors with python packages (closes: #1108934).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Mon, 14 Jul 2025 08:05:27 +0000

expat (2.7.1-1) unstable; urgency=medium

  * New upstream release:
    - fixes libxml-parser-perl regression (closes: #1100845).
  * Update watch file.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 27 Mar 2025 19:56:41 +0100

expat (2.7.0-1) unstable; urgency=high

  * New upstream release:
    - fixes CVE-2024-8176: long linear chains of entities crash with stack
      overflow.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 14 Mar 2025 20:12:24 +0100

expat (2.6.4-1) unstable; urgency=medium

  * New upstream release.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 08 Nov 2024 17:45:00 +0100

expat (2.6.3-2) unstable; urgency=high

  * Backport upstream fix for CVE-2024-50602: stop XML_ResumeParser() from
    crashing (closes: #1086134).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 27 Oct 2024 17:58:30 +0100

expat (2.6.3-1) unstable; urgency=medium

  * New upstream release.
  * Update watch file.
  * Update Standards-Version to 4.7.0 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 04 Sep 2024 20:33:01 +0200

expat (2.6.2-2) unstable; urgency=high

  * Backport security fix for CVE-2024-45490: reject negative len for
    XML_ParseBuffer() (closes: #1080149).
  * Backport security fix for CVE-2024-45491: detect integer overflow in
    dtdCopy() (closes: #1080150).
  * Backport security fix for CVE-2024-45492: detect integer overflow in
    function nextScaffoldPart() (closes: #1080152).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 31 Aug 2024 11:48:45 +0200

expat (2.6.2-1) unstable; urgency=medium

  * New upstream release.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 13 Mar 2024 21:40:29 +0100

expat (2.6.1-2) unstable; urgency=high

  * Backport security fix for CVE-2024-28757: prevent billion laughs attacks
    in isolated external parser (closes: #1065868).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 10 Mar 2024 18:24:38 +0100

expat (2.6.1-1) unstable; urgency=medium

  * New upstream release.

  [ Helmut Grohne <helmut@subdivi.de> ]
  * Move files to /usr (DEP17) (closes: #1063553).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 06 Mar 2024 06:55:07 +0100

expat (2.6.0-1) unstable; urgency=high

  * New upstream release:
    - fixes CVE-2023-52425: fix quadratic runtime issues with big tokens that
      can cause denial of service (closes: #1063238),
    - fixes CVE-2023-52426: fix billion laughs attacks for users compiling
      without XML_DTD defined (which is not common) (closes: #1063240).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Tue, 06 Feb 2024 22:00:26 +0100

expat (2.5.0-2) unstable; urgency=medium

  [ Samuel Thibault <sthibault@debian.org> ]
  * Generalize libbsd-dev build dependency on kfreebsd and hurd ports
    (closes: #1035556).

  [ Henry N. <henrynmail-debian@yahoo.com> ]
  * Fix building with profile nodoc (stage1) (closes: #1037080).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 14 Jun 2023 22:08:48 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libexpat1`.
