google-guest-agent (20250506.01-0ubuntu3) stonking; urgency=medium

  * SECURITY UPDATE: denial of service via unexpected SSH global responses
    - debian/extra/vendor/golang.org/x/crypto/ssh/mux.go: use a non-blocking
      send for global request responses and drain stale responses.
    - 4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946
    - CVE-2026-39830
  * SECURITY UPDATE: user presence verification bypass for security keys
    - debian/extra/vendor/golang.org/x/crypto/ssh/keys.go: enforce the
      user-presence bit in signatures from FIDO/U2F security keys.
    - b61cf853a89d82cad68da5e12a6beca2116f8456
    - CVE-2026-39831
  * SECURITY UPDATE: denial of service via integer overflow on large writes
    - debian/extra/vendor/golang.org/x/crypto/ssh/channel.go: avoid uint32
      truncation that caused an infinite loop on large channel writes.
    - e052873987615dc96fe67607a9a6adb76311344f
    - CVE-2026-39834
  * SECURITY UPDATE: source-address critical option authorization bypass
    - debian/extra/vendor/golang.org/x/crypto/ssh/server.go: enforce the
      source-address critical option for all callback types.
    - 533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce
    - CVE-2026-46595

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 22 Jun 2026 15:09:39 -0230

google-guest-agent (20250506.01-0ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/extra/vendor/golang.org/x/crypto was patched
      with a backport of e79546e28b85ea53dd37afe1c4102746ef553b9c in file
      ssh/ssh_gss.go.
    - debian/extra/vendor adding patches-applied and README.txt for 
      track/documentation propose about patches applied in vendored sources.
    - CVE-2025-58181

 -- Nishit Majithia <nishit.majithia@canonical.com>  Fri, 09 Jan 2026 16:25:22 +0530

google-guest-agent (20250506.01-0ubuntu1) questing; urgency=medium

  * New upstream version for upstream tag 20250506.01. (LP: #2113792)
    * Golang revendoring for the bump from 1.20 to 1.23.

 -- Chloé 'kajiya' Smith <chloe.smith@canonical.com>  Mon, 09 Jun 2025 21:56:02 +0100

google-guest-agent (20250116.00-0ubuntu2) plucky; urgency=medium

  * No-change rebuild against Go 1.24.

 -- Shengjing Zhu <shengjing.zhu@canonical.com>  Mon, 24 Feb 2025 09:32:57 +0000

google-guest-agent (20250116.00-0ubuntu1) plucky; urgency=medium

  * New upstream version for upstream tag 20250116.00. (LP: #2096765) 

 -- Chloé 'kajiya' Smith <chloe.smith@canonical.com>  Mon, 27 Jan 2025 13:26:46 +0000

google-guest-agent (20241011.01-0ubuntu1) plucky; urgency=medium

  * New version for upstream tag 20241011.01. (LP: #2084498)
     * Revendor golang dependencies.

 -- Chloé 'kajiya' Smith <chloe.smith@canonical.com>  Mon, 14 Oct 2024 20:46:56 +0100

google-guest-agent (20240716.00-0ubuntu1) oracular; urgency=medium

  [ Utkarsh Gupta ]
  * New upstream version 20240716.00. (LP: #2073163)
  * Update vendored dependencies.
  * Set DH_GOLANG_INSTALL_EXTRA to editions_defaults.binpb.

  [ Chloé Smith ]
  * d/p/0006-add-after-cloud-config-service.patch: add patch
    to force ordering between cloud-init and the guest agent.
    (LP: #2057965)

 -- Utkarsh Gupta <utkarsh@ubuntu.com>  Thu, 18 Jul 2024 23:47:17 +0530

google-guest-agent (20240213.00-0ubuntu4) oracular; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/extra/vendor/googgle.golang.org/protobuf was
      patched with a backport of f01a588e5810b90996452eec4a28f22a0afae023
      in files encoding/protojson/well_known_types.go,
      internal/encoding/json/decode.go.
    - debian/extra/vendor adding patches-applied and README.txt for
      track/documentation propose about patches applied in vendored sources.
    - CVE-2024-24786

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Wed, 12 Jun 2024 10:15:12 -0300

google-guest-agent (20240213.00-0ubuntu3) noble; urgency=medium

  * No-change rebuild against Go 1.22.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Mon, 08 Apr 2024 14:53:33 +1200

google-guest-agent (20240213.00-0ubuntu2) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 16:50:39 +1100

google-guest-agent (20240213.00-0ubuntu1) noble; urgency=medium

  [ Utkarsh Gupta ]
  * Add a reason to include include-binaries file.

  [ Chloé 'kajiya' Smith ]
  * New upstream version, v20240213.00. (LP: #2054484)
  * d/extra/vendor: Update the vendored dependencies.
  * d/source/include-binaries: add new file.

 -- Chloé 'kajiya' Smith <chloe.smith@canonical.com>  Wed, 21 Feb 2024 00:25:47 +0000

google-guest-agent (20231004.02-0ubuntu3) noble; urgency=medium

  * d/control: Fix dependency version of `google-compute-engine-oslogin`
    to match archive (LP: #2050956)

 -- Chloé 'kajiya' Smith <chloe.smith@canonical.com>  Fri, 26 Jan 2024 15:12:02 +0000

google-guest-agent (20231004.02-0ubuntu2) noble; urgency=medium

  * d/control: There should b a dependency on `google-compute-engine-oslogin`
    to match the Google managed control file (LP: #2050956)
    * Also updated the `Vcs-` fields and removed the `Uploaders` field.

 -- Chloé 'kajiya' Smith <chloe.smith@canonical.com>  Tue, 23 Jan 2024 13:43:24 +0000

google-guest-agent (20231004.02-0ubuntu1) noble; urgency=medium

  * New upstream version 20231004.02. (LP: #2040945)
  * d/extra/vendor: Update vendored dependencies.

 -- Utkarsh Gupta <utkarsh@ubuntu.com>  Thu, 26 Oct 2023 03:12:14 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog google-guest-agent`.
