haproxy (2.8.16-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: overflow in FCGI demux record length field
    - debian/patches/CVE-2026-55203.patch: mux-fcgi: fix uint16_t overflow in
      drl += drp in src/mux_fcgi.c.
    - CVE-2026-55203
  * SECURITY UPDATE: NULL dereference in hpack_dht_insert()
    - debian/patches/CVE-2026-55204.patch: hpack-tbl: add missing NULL check
      after hpack_dht_defrag() in src/hpack-tbl.c.
    - CVE-2026-55204

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 19 Jun 2026 11:04:08 -0400

haproxy (2.8.16-0ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: HTTP/3 parser request smuggling issue
    - debian/patches/CVE-2026-33555.patch: check body size with
      content-length on empty FIN in src/h3.c.
    - CVE-2026-33555

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 15 Apr 2026 14:04:24 -0400

haproxy (2.8.16-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2127664)
    - The API for the lua HTTPMessage "class" was improved to be able to
      change the body length. It was mandatory to be able to write a lua
      filter altering the message payload. HTTPMessage:set_body_len() can now
      be used for this purpose
    - Still in lua, The HTTP client is not supposed to be used to process
      several requests but there was nothing to prevent this usage. An error
      is now triggered in that case
    - For further information, see the upstream release notes:
      + https://www.mail-archive.com/haproxy@formilux.org/msg46201.html
  * d/p/CVE-2025-11230.patch: drop patch fixed upstream in 2.8.16

 -- Athos Ribeiro <athos@ubuntu.com>  Wed, 03 Dec 2025 12:12:24 -0300

haproxy (2.8.15-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2112526)
    - This new release introduce several fixes, including bug fixes for QUIC,
      for the SSL stack, and LUA.
    - New configuration options were introduced, and a new default value for
      the hard limit on the number of file descriptors was introduced. These
      are described in the Debian NEWS file.
    - For further information, see the upstream release notes:
      + https://www.mail-archive.com/haproxy@formilux.org/msg44606.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg44632.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg44787.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg44790.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45060.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45317.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45413.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45486.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45570.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45806.html
  * d/NEWS: add NEWS file.
  * Dropped paches applied upstream:
    - d/p/CVE-2024-53008-1.patch
    - d/p/CVE-2024-53008-2.patch
    - d/p/CVE-2025-32464.patch

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Wed, 08 Oct 2025 10:50:30 -0300

haproxy (2.8.5-1ubuntu3.4) noble-security; urgency=medium

  * SECURITY UPDATE: DoS via MJSON
    - debian/patches/CVE-2025-11230.patch: fix possible DoS when parsing
      numbers in src/mjson.c.
    - CVE-2025-11230

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Oct 2025 13:01:09 -0400

haproxy (2.8.5-1ubuntu3.3) noble-security; urgency=medium

  * SECURITY UPDATE: heap overflow in sample_conv_regsub
    - debian/patches/CVE-2025-32464.patch: fix risk of overflow when
      replacing multiple regex back-refs in src/sample.c.
    - CVE-2025-32464

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 09 Apr 2025 08:50:46 -0400

haproxy (2.8.5-1ubuntu3.2) noble-security; urgency=medium

  * SECURITY UPDATE: Request smuggling
    - debian/patches/CVE-2024-53008-1.patch: Check pseudo-header method
      contains only valid characters according to RFC 9110
    - debian/patches/CVE-2024-53008-2.patch: Check pseudo-header scheme
      contains only valid characters according to RFC 9110
    - CVE-2024-53008

 -- Bruce Cable <bruce.cable@canonical.com>  Mon, 02 Dec 2024 15:01:44 +1100

haproxy (2.8.5-1ubuntu3.1) noble; urgency=medium

  * SRU: LP: #2083480: No-change rebuild to disable frame pointers on
    ppc64el and s390x.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 02 Oct 2024 14:40:51 +0200

haproxy (2.8.5-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 16:52:53 +1100

haproxy (2.8.5-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 18:10:10 +0000

haproxy (2.8.5-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040383). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe.
    - d/control: Upgrade lua build dependency to 5.4
    - d/rules: Change lua include location to /usr/include/lua5.4
  * New changes:
    - d/{control,rules}: do not link against jemalloc (universe).

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 05 Jan 2024 11:05:29 -0300

haproxy (2.8.5-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 09 Dec 2023 16:14:43 +0100

haproxy (2.8.4-2) experimental; urgency=medium

  * d/rules: really link against jemalloc.
  * d/rules: enable USE_QUIC (with USE_QUIC_OPENSSL_COMPAT).

 -- Vincent Bernat <bernat@debian.org>  Wed, 22 Nov 2023 22:52:31 +0100

haproxy (2.8.4-1) experimental; urgency=medium

  * New upstream release.
  * d/rules: link against jemalloc.

 -- Vincent Bernat <bernat@debian.org>  Fri, 17 Nov 2023 19:53:48 +0100

haproxy (2.8.3-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 08 Sep 2023 20:25:39 +0200

haproxy (2.8.2-1) experimental; urgency=medium

  * New upstream release. Fix CVE-2023-40225.

 -- Vincent Bernat <bernat@debian.org>  Sat, 12 Aug 2023 13:33:36 +0200

haproxy (2.8.1-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 03 Jul 2023 21:13:18 +0200

haproxy (2.8.0-1) experimental; urgency=medium

  * New upstream release.
  * d/NEWS: remove
  * d/lintian-overrides: override warning about obsolete lsb-base dependency

 -- Vincent Bernat <bernat@debian.org>  Sat, 03 Jun 2023 00:11:07 +0200

haproxy (2.7.8-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 06 May 2023 15:08:44 +0200

haproxy (2.7.7-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 27 Apr 2023 21:22:39 +0200

haproxy (2.7.6-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 31 Mar 2023 08:46:51 +0200

haproxy (2.7.5-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 18 Mar 2023 14:00:02 +0100

haproxy (2.7.4-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 10 Mar 2023 21:18:59 +0100

haproxy (2.7.3-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 15 Feb 2023 08:18:45 +0100

haproxy (2.7.2-2) experimental; urgency=medium

  * BUG/CRITICAL: http: properly reject empty http header field names
    (CVE-2023-25725).

 -- Vincent Bernat <bernat@debian.org>  Mon, 13 Feb 2023 19:37:55 +0100

haproxy (2.7.2-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 20 Jan 2023 22:15:56 +0100

haproxy (2.7.1-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 19 Dec 2022 21:11:23 +0100

haproxy (2.7.0-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 01 Dec 2022 17:25:51 +0100

haproxy (2.6.15-1ubuntu2) mantic; urgency=medium

  * d/control: Upgrade lua build dependency to 5.4
  * d/rules: Change lua include location to /usr/include/lua5.4

 -- Lena Voytek <lena.voytek@canonical.com>  Thu, 17 Aug 2023 09:53:22 -0700

haproxy (2.6.15-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 16 Aug 2023 07:40:54 -0400

haproxy (2.6.14-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018073). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 16 Jun 2023 11:08:54 -0300

haproxy (2.6.13-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 07 Jun 2023 14:12:21 -0400

haproxy (2.6.9-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it is
      in universe.
  * Dropped changes:
    - debian/patches/CVE-2023-0056.patch: removed, included in new version.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 17 Feb 2023 08:07:41 -0500

haproxy (2.6.7-1ubuntu2) lunar; urgency=medium

  * SECURITY UPDATE: DoS via certain interim responses
    - debian/patches/CVE-2023-0056.patch: refuse interim responses with
      end-stream flag set in src/mux_h2.c.
    - CVE-2023-0056

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 19 Jan 2023 10:33:43 -0500

haproxy (2.6.7-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993402). Remaining changes:
    - d/{control,rules}: Removing support for OpenTracing due to it is
      in universe.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 14 Dec 2022 11:49:52 -0300

haproxy (2.6.6-2) unstable; urgency=medium

  * Upload to unstable.

 -- Vincent Bernat <bernat@debian.org>  Sat, 22 Oct 2022 10:19:03 +0200

haproxy (2.6.6-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 22 Sep 2022 20:22:23 +0200

haproxy (2.6.5-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 03 Sep 2022 19:33:51 +0200

haproxy (2.6.4-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 22 Aug 2022 19:01:25 +0200

haproxy (2.6.3-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 19 Aug 2022 19:16:11 +0200

haproxy (2.6.2-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 22 Jul 2022 18:21:43 +0200

haproxy (2.6.1-1) experimental; urgency=medium

  [ Lucas Kanashiro ]
  * d/t/utils: add helper functions to be re-used in tests
  * d/t/proxy-localhost: refactor to use the check_index_file helper function
  * d/t/proxy-ssl-termination: add test for the SSL termination proxy feature
  * d/t/proxy-ssl-pass-through: add test for the SSL Pass-Through proxy feature

  [ Vincent Bernat ]
  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 22 Jun 2022 20:06:08 +0200

haproxy (2.6.0-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 02 Jun 2022 08:49:38 +0200

haproxy (2.5.7-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 14 May 2022 12:01:07 +0200

haproxy (2.5.6-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Tue, 26 Apr 2022 17:59:23 +0200

haproxy (2.5.5-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 14 Mar 2022 19:26:46 +0100

haproxy (2.5.4-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 25 Feb 2022 17:39:11 +0100

haproxy (2.5.3-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 18 Feb 2022 20:22:25 +0100

haproxy (2.5.2-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 16 Feb 2022 19:09:04 +0100

haproxy (2.5.1-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Tue, 11 Jan 2022 19:23:50 +0100

haproxy (2.5.0-1) experimental; urgency=medium

  * New upstream release.
  * d/patches: patch to make logging work without rsyslog with systemd

 -- Vincent Bernat <bernat@debian.org>  Thu, 25 Nov 2021 21:20:30 +0100

haproxy (2.4.19-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 30 Sep 2022 09:07:13 +0200

haproxy (2.4.18-1ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/{control,rules}: Removing support for OpenTracing due to it is
      in universe.
  * Dropped (in 2.4.18-1):
    - d/t/utils: add helper functions to be re-used in tests.
    - d/t/proxy-localhost: refactor to use the check_index_file helper function.
    - d/t/proxy-ssl-termination: add test for the SSL termination proxy feature.
    - d/t/proxy-ssl-pass-through: add test for the SSL Pass-Through proxy feature.
    - d/t/control: add both SSL related tests.

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 15 Aug 2022 09:46:33 -0300

haproxy (2.4.18-1) unstable; urgency=medium

  [ Lucas Kanashiro ]
  * d/t/utils: add helper functions to be re-used in tests
  * d/t/proxy-localhost: refactor to use the check_index_file helper function
  * d/t/proxy-ssl-termination: add test for the SSL termination proxy feature
  * d/t/proxy-ssl-pass-through: add test for the SSL Pass-Through proxy feature

  [ Vincent Bernat ]
  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 27 Jul 2022 15:59:36 +0200

haproxy (2.4.17-1ubuntu2) kinetic; urgency=medium

  * d/t/utils: add helper functions to be re-used in tests.
  * d/t/proxy-localhost: refactor to use the check_index_file helper function.
  * d/t/proxy-ssl-termination: add test for the SSL termination proxy feature.
  * d/t/proxy-ssl-pass-through: add test for the SSL Pass-Through proxy feature.
  * d/t/control: add both SSL related tests.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 15 Jun 2022 17:34:52 -0300

haproxy (2.4.17-1ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1971279). Remaining changes:
    - d/{control,rules}: Removing support for OpenTracing due to it is
      in universe.

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 16 May 2022 10:41:37 -0300

haproxy (2.4.17-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 14 May 2022 14:27:20 +0200

haproxy (2.4.16-1) unstable; urgency=medium

  * New upstream release.
  * d/install: do not install halog explicitely.

 -- Vincent Bernat <bernat@debian.org>  Fri, 29 Apr 2022 17:42:42 +0200

haproxy (2.4.15-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 14 Mar 2022 20:17:04 +0100

haproxy (2.4.14-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/{control,rules}: Removing support for OpenTracing due to it is
      in universe.
  * Dropped:
    - d/p/fix-ftbfs-openssl3.patch: Cherry-picked from upstream to fix
      the build against OpenSSL3 (LP #1945773)
      [Fixed upstream]

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 28 Feb 2022 13:48:21 -0300

haproxy (2.4.14-1) unstable; urgency=medium

  * New upstream release.
    - Fix compilation with OpenSSL 3.0. Closes: #996423, #1006007.

 -- Vincent Bernat <bernat@debian.org>  Fri, 25 Feb 2022 18:38:27 +0100

haproxy (2.4.13-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1961195). Remaining changes:
    - d/p/fix-ftbfs-openssl3.patch: Cherry-picked from upstream to fix
      the build against OpenSSL3 (LP #1945773)
    - d/{control,rules}: Removing support for OpenTracing due to it is
      in universe.

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 18 Feb 2022 15:27:14 -0300

haproxy (2.4.13-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 17 Feb 2022 10:03:46 +0100

haproxy (2.4.12-1ubuntu2) jammy; urgency=medium

  * No-change rebuild to update maintainer scripts, see LP: 1959054

 -- Dave Jones <dave.jones@canonical.com>  Wed, 16 Feb 2022 17:01:23 +0000

haproxy (2.4.12-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1957099). Remaining changes:
    - d/p/fix-ftbfs-openssl3.patch: Cherry-picked from upstream to fix
      the build against OpenSSL3 (LP #1945773)
    - d/{control,rules}: Removing support for OpenTracing due to it is
      in universe.

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 11 Jan 2022 14:40:07 -0300

haproxy (2.4.12-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Tue, 11 Jan 2022 12:06:17 +0100

haproxy (2.4.11-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1946859). Remaining changes:
    - d/p/fix-ftbfs-openssl3.patch: Cherry-picked from upstream to fix
      the build against OpenSSL3 (LP #1945773)
    - d/{control,rules}: Removing support for OpenTracing due to it is
      in universe.

 -- Andreas Hasenack <andreas@canonical.com>  Sat, 08 Jan 2022 18:58:44 -0300

haproxy (2.4.11-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 07 Jan 2022 17:25:51 +0100

haproxy (2.4.10-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 23 Dec 2021 19:13:26 +0100

haproxy (2.4.9-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 24 Nov 2021 19:42:28 +0100

haproxy (2.4.8-3) unstable; urgency=medium

  * d/logrotate: only use rsyslog-rotate if present. Closes: #1000436.

 -- Vincent Bernat <bernat@debian.org>  Wed, 24 Nov 2021 09:29:54 +0100

haproxy (2.4.8-2ubuntu3) jammy; urgency=medium

  * d/{control,rules}: Remove support for OpenTracing because it is
    in universe.

 -- Miriam España Acebal <miriam.espana@canonical.com>  Thu, 09 Dec 2021 11:57:06 +0100

haproxy (2.4.8-2ubuntu2) jammy; urgency=medium

  * No-change rebuild against libssl3

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 08 Dec 2021 23:32:48 +0000

haproxy (2.4.8-2ubuntu1) jammy; urgency=medium

  [ Simon Chopin ]
  * d/p/fix-ftbfs-openssl3.patch: Cherry-picked from upstream to fix the build
    against OpenSSL3 (LP: #1945773)

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Fri, 19 Nov 2021 18:36:04 -0300

haproxy (2.4.8-2) unstable; urgency=medium

  * Non-maintainer upload.
  * Enable OpenTracing support.

 -- Stephen Gelman <ssgelm@debian.org>  Tue, 09 Nov 2021 23:06:46 -0600

haproxy (2.4.8-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 04 Nov 2021 08:36:56 +0100

haproxy (2.4.7-2) unstable; urgency=medium

  * Upload to unstable.

 -- Vincent Bernat <bernat@debian.org>  Sat, 16 Oct 2021 20:43:13 +0200

haproxy (2.4.7-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 07 Oct 2021 09:08:09 +0200

haproxy (2.4.4-1) experimental; urgency=medium

  * New upstream release.
  * d/patches: remove patches applied upstream.

 -- Vincent Bernat <bernat@debian.org>  Wed, 08 Sep 2021 08:38:05 +0200

haproxy (2.4.3-2) experimental; urgency=high

  * d/patches: fix missing header name length check in HTX (CVE-2021-40346).

 -- Vincent Bernat <bernat@debian.org>  Sat, 04 Sep 2021 11:56:31 +0200

haproxy (2.4.3-1) experimental; urgency=medium

  * New upstream release.
  * d/patches: remove patches applied upstream.
  * d/patches: h2: match absolute-path not path-absolute for :path.

 -- Vincent Bernat <bernat@debian.org>  Sat, 21 Aug 2021 16:32:25 +0200

haproxy (2.4.2-2) experimental; urgency=medium

  * Fix HTTP request smuggling via HTTP/2 desync attacks.

 -- Vincent Bernat <bernat@debian.org>  Fri, 13 Aug 2021 16:12:31 +0200

haproxy (2.4.2-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 07 Jul 2021 21:47:17 +0200

haproxy (2.4.1-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 17 Jun 2021 13:57:57 +0200

haproxy (2.4.0-1) experimental; urgency=medium

  * New upstream release.
  * d/rules: switch to SLZ instead of zlib
  * d/rules: update build for contrib → admin
  * d/rules: remove use of USE_REGPARM (outdated)
  * d/rules: remove hack around gcc_s
  * d/copyright: update

 -- Vincent Bernat <bernat@debian.org>  Tue, 18 May 2021 22:00:05 +0200

haproxy (2.3.10-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 24 Apr 2021 18:22:41 +0200

haproxy (2.3.9-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Tue, 30 Mar 2021 19:50:42 +0200

haproxy (2.3.8-1) experimental; urgency=medium

  * New upstream release.
  * d/logrotate: reduce log retention to 7 days. Closes: #985441.

 -- Vincent Bernat <bernat@debian.org>  Thu, 25 Mar 2021 18:17:18 +0100

haproxy (2.3.7-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Tue, 16 Mar 2021 18:41:25 +0100

haproxy (2.3.6-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 04 Mar 2021 13:57:49 +0100

haproxy (2.3.5-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 06 Feb 2021 17:12:53 +0100

haproxy (2.3.4-1) experimental; urgency=medium

  * New upstream release:
    - Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"

 -- Vincent Bernat <bernat@debian.org>  Fri, 15 Jan 2021 14:13:28 +0100

haproxy (2.3.3-1) experimental; urgency=medium

  * d/tests: sleep before test to let Apache2 start.
    Closes: #976997.
  * New upstream release:
    - BUG/MAJOR: ring: tcp forward on ring can break the reader counter.
    - BUG/MAJOR: spoa/python: Fixing return None
    - BUG/MEDIUM: local log format regression. Closes: #974977.

 -- Vincent Bernat <bernat@debian.org>  Sat, 09 Jan 2021 15:18:10 +0100

haproxy (2.3.2-1) experimental; urgency=medium

  * New upstream release.
    - BUG/MAJOR: connection: reset conn->owner when detaching from session
                 list
    - BUG/MAJOR: filters: Always keep all offsets up to date during data
                 filtering
    - BUG/MAJOR: peers: fix partial message decoding
    - BUG/MAJOR: tcpcheck: Allocate input and output buffers from the buffer
                 pool

 -- Vincent Bernat <bernat@debian.org>  Sat, 28 Nov 2020 20:25:34 +0100

haproxy (2.3.1-1) experimental; urgency=medium

  * New upstream release.
    - BUG/MAJOR: spoe: Be sure to remove all references on a released spoe
                 applet
  * d/patches: remove patches applied upstream.

 -- Vincent Bernat <bernat@debian.org>  Sat, 14 Nov 2020 23:17:20 +0100

haproxy (2.3.0-1) experimental; urgency=medium

  * New upstream release.
  * d/gbp, d/watch: prepare for 2.3.0 release

 -- Vincent Bernat <bernat@debian.org>  Wed, 11 Nov 2020 16:30:10 +0100

haproxy (2.2.17-1) unstable; urgency=medium

  * New upstream release.
  * d/patches: remove upstream-applied patch.

 -- Vincent Bernat <bernat@debian.org>  Thu, 09 Sep 2021 19:42:08 +0200

haproxy (2.2.16-3) unstable; urgency=high

  * d/patches: fix missing header name length check in HTX (CVE-2021-40346).

 -- Vincent Bernat <bernat@debian.org>  Sat, 04 Sep 2021 16:14:51 +0200

haproxy (2.2.16-2) unstable; urgency=medium

  * d/patches: h2: match absolute-path not path-absolute for :path

 -- Vincent Bernat <bernat@debian.org>  Sat, 21 Aug 2021 16:19:52 +0200

haproxy (2.2.16-1) unstable; urgency=high

  * New upstream release.
  * Fix CVE-2021-39240, CVE-2021-39241, CVE-2021-39242.
  * d/patches: remove upstream-applied patch.

 -- Vincent Bernat <bernat@debian.org>  Thu, 19 Aug 2021 07:22:05 +0200

haproxy (2.2.15-1) UNRELEASED; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 16 Jul 2021 11:18:32 +0200

haproxy (2.2.14-1) UNRELEASED; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 29 Apr 2021 15:32:49 +0200

haproxy (2.2.13-1) UNRELEASED; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 02 Apr 2021 21:18:28 +0200

haproxy (2.2.12-1) UNRELEASED; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 31 Mar 2021 20:31:24 +0200

haproxy (2.2.11-1) UNRELEASED; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 18 Mar 2021 21:34:40 +0100

haproxy (2.2.10-1) UNRELEASED; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 04 Mar 2021 19:08:41 +0100

haproxy (2.2.9-2) unstable; urgency=medium

  * d/patches: fix agent-check regression putting down servers.
    Closes: #988779.

 -- Vincent Bernat <bernat@debian.org>  Thu, 27 May 2021 15:00:01 +0200

haproxy (2.2.9-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: connection: reset conn->owner when detaching from session
                 list

 -- Vincent Bernat <bernat@debian.org>  Sat, 06 Feb 2021 18:52:20 +0100

haproxy (2.2.8-1) unstable; urgency=medium

  * New upstream release.
    - Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"

 -- Vincent Bernat <bernat@debian.org>  Thu, 14 Jan 2021 11:48:52 +0100

haproxy (2.2.7-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: ring: tcp forward on ring can break the reader counter.
    - BUG/MAJOR: spoa/python: Fixing return None

 -- Vincent Bernat <bernat@debian.org>  Sat, 09 Jan 2021 15:31:08 +0100

haproxy (2.2.6-2) unstable; urgency=medium

  * d/tests: sleep before test to let Apache2 start.
    Closes: #976997.

 -- Vincent Bernat <bernat@debian.org>  Thu, 07 Jan 2021 07:56:14 +0100

haproxy (2.2.6-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: filters: Always keep all offsets up to date during data
                 filtering
    - BUG/MAJOR: peers: fix partial message decoding
    - BUG/MAJOR: spoe: Be sure to remove all references on a released spoe
                 applet
    - BUG/MAJOR: tcpcheck: Allocate input and output buffers from the buffer
                 pool
  * d/patches: remove patches applied upstream

 -- Vincent Bernat <bernat@debian.org>  Mon, 30 Nov 2020 20:02:49 +0100

haproxy (2.2.5-2) unstable; urgency=medium

  * Upload to unstable.

 -- Vincent Bernat <bernat@debian.org>  Wed, 11 Nov 2020 16:21:12 +0100

haproxy (2.2.5-1) experimental; urgency=medium

  * New upstream release.
    - BUG/MAJOR: mux-h2: Don't try to send data if we know it is no longer
                 possible
  * d/patches: warn if payload of an errorfile doesn't match the C-L

 -- Vincent Bernat <bernat@debian.org>  Sun, 08 Nov 2020 19:12:02 +0100

haproxy (2.2.4-1) experimental; urgency=medium

  * New upstream release.
  * d/patches: drop patch for ARM32

 -- Vincent Bernat <bernat@debian.org>  Fri, 02 Oct 2020 21:29:56 +0200

haproxy (2.2.3-2) experimental; urgency=medium

  * d/patches: add upstream patch to fix build on ARM32

 -- Vincent Bernat <bernat@debian.org>  Wed, 09 Sep 2020 19:38:52 +0200

haproxy (2.2.3-1) experimental; urgency=medium

  * New upstream version.
    - BUG/MAJOR: dns: disabled servers through SRV records never recover

 -- Vincent Bernat <bernat@debian.org>  Tue, 08 Sep 2020 23:12:05 +0200

haproxy (2.2.2-1) experimental; urgency=medium

  * New upstream version.
    - BUG/MAJOR: dns: don't treat Authority records as an error
    - BUG/MAJOR: dns: fix null pointer dereference in
                 snr_update_srv_status

 -- Vincent Bernat <bernat@debian.org>  Sat, 01 Aug 2020 17:06:42 +0200

haproxy (2.2.1-1) experimental; urgency=medium

  * New upstream version.
    - BUG/MAJOR: tasks: don't requeue global tasks into the local
                 queue
    - BUG/MAJOR: dns: Make the do-resolve action thread-safe

 -- Vincent Bernat <bernat@debian.org>  Thu, 23 Jul 2020 13:39:14 +0200

haproxy (2.2.0-1) experimental; urgency=medium

  * New upstream version.
  * Upload to experimental
  * Update d/watch to look for 2.2 stable releases
  * d/gbp.conf: set branch names for 2.2
  * d/patches: refresh patches

 -- Vincent Bernat <bernat@debian.org>  Tue, 14 Jul 2020 16:53:23 +0200

haproxy (2.1.7-1) experimental; urgency=medium

  * New upstream version.

 -- Vincent Bernat <bernat@debian.org>  Fri, 12 Jun 2020 07:50:48 +0200

haproxy (2.1.5-1) experimental; urgency=medium

  * New upstream version.
    - BUG/MAJOR: mux-fcgi: Stop sending loop if FCGI stream is blocked for
                 any reason
    - Revert "BUG/MINOR: connection: always send address-less LOCAL PROXY
              connections"
    - Revert "BUG/MINOR: connection: make sure to correctly tag local
              PROXY connections"

 -- Vincent Bernat <bernat@debian.org>  Mon, 01 Jun 2020 08:52:56 +0200

haproxy (2.1.4-1) experimental; urgency=medium

  * New upstream version.
    - BUG/CRITICAL: hpack: never index a header into the headroom after
                    wrapping
    - BUG/MAJOR: http-ana: Always abort the request when a tarpit is
                 triggered
    - BUG/MAJOR: list: fix invalid element address calculation
    - BUG/MAJOR: proxy_protocol: Properly validate TLV lengths
  * d/control: fix maintainer address. Closes: #955553.

 -- Vincent Bernat <bernat@debian.org>  Sun, 12 Apr 2020 13:29:54 +0200

haproxy (2.1.3-3) experimental; urgency=medium

  * d/copryight: document OpenSSL exception. Closes: #951782.
  * d/haproxy.cfg: use "ssl-min-ver" to set minimum version.
  * d/patches: fix an overflow in HTTP/2 header handling.
    Fix CVE-2020-11100.

 -- Vincent Bernat <bernat@debian.org>  Wed, 01 Apr 2020 21:18:57 +0200

haproxy (2.1.3-2) experimental; urgency=medium

  * d/dconv: use Python 3 to build the documentation.
    Closes: #948296, #950435.
  * d/dconv: replace cgi.escape by html.escape. Closes: #951416.

 -- Vincent Bernat <bernat@debian.org>  Wed, 19 Feb 2020 07:53:53 +0100

haproxy (2.1.3-1) experimental; urgency=medium

  * New upstream version.
    - BUG/MAJOR: hashes: fix the signedness of the hash inputs
    - BUG/MAJOR: memory: Don't forget to unlock the rwlock if the pool is
                 empty.

 -- Vincent Bernat <bernat@debian.org>  Mon, 20 Jan 2020 06:53:23 +0100

haproxy (2.1.2-1) experimental; urgency=medium

  * New upstream version 2.1.2.
    - BUG/MAJOR: task: add a new TASK_SHARED_WQ flag to fix foreign requeuing
  * d/logrotate.conf: use rsyslog helper instead of SysV init script.
    Closes: #946973.

 -- Vincent Bernat <bernat@debian.org>  Fri, 20 Dec 2019 08:20:33 +0100

haproxy (2.1.1-1) experimental; urgency=medium

  * New upstream version 2.1.1.
    - BUG/MAJOR: dns: add minimalist error processing on the Rx path

 -- Vincent Bernat <bernat@debian.org>  Sat, 14 Dec 2019 11:20:32 +0100

haproxy (2.1.0-2) experimental; urgency=medium

  * Link against libatomic on riscv64

 -- Apollon Oikonomopoulos <apoikos@debian.org>  Fri, 29 Nov 2019 14:03:49 +0200

haproxy (2.1.0-1) experimental; urgency=medium

  * New upstream version 2.1.0
  * Upload to experimental
  * Update d/watch to look for 2.1 stable releases
  * d/gbp.conf: set branch names for 2.1
  * Bump Standards-Version to 4.4.1; no changes needed
  * Bump dh compat level to 12
    + B-D on debhelper-compat and remove debian/compat
    + Override dh_installsystemd with the same args as dh_installinit
    + Add ${misc:Pre-Depends} to haproxy's Pre-Depends

 -- Apollon Oikonomopoulos <apoikos@debian.org>  Wed, 27 Nov 2019 23:30:30 +0200

haproxy (2.0.19-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: mux-h2: Don't try to send data if we know it is no longer
                 possible

 -- Vincent Bernat <bernat@debian.org>  Fri, 06 Nov 2020 19:33:59 +0100

haproxy (2.0.18-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 30 Sep 2020 13:41:09 +0200

haproxy (2.0.17-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: dns: Make the do-resolve action thread-safe

 -- Vincent Bernat <bernat@debian.org>  Sat, 01 Aug 2020 20:05:01 +0200

haproxy (2.0.16-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: stream: Mark the server address as unset on new outgoing
                 connection
  * d/patches: refresh patches.

 -- Vincent Bernat <bernat@debian.org>  Sat, 18 Jul 2020 13:50:56 +0200

haproxy (2.0.15-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: stream-int: always detach a faulty endpoint on connect
                 failure

 -- Vincent Bernat <bernat@debian.org>  Sat, 13 Jun 2020 18:48:25 +0200

haproxy (2.0.14-1) unstable; urgency=medium

  * New upstream release.
    - BUG/CRITICAL: hpack: never index a header into the headroom after
                    wrapping
    - BUG/MAJOR: http-ana: Always abort the request when a tarpit is
                 triggered
    - BUG/MAJOR: list: fix invalid element address calculation
    - BUG/MAJOR: proxy_protocol: Properly validate TLV lengths
  * d/control: fix maintainer address. Closes: #955553.

 -- Vincent Bernat <bernat@debian.org>  Thu, 16 Apr 2020 18:34:22 +0200

haproxy (2.0.13-2) unstable; urgency=medium

  * d/dconv: replace cgi.escape by html.escape. Closes: #951416.
  * d/copryight: document OpenSSL exception. Closes: #951782.
  * d/haproxy.cfg: use "ssl-min-ver" to set minimum version.
  * Apply one patch to fix an overflow in HTTP/2 header handling.
    Fix CVE-2020-11100.

 -- Vincent Bernat <bernat@debian.org>  Wed, 01 Apr 2020 21:49:32 +0200

haproxy (2.0.13-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: hashes: fix the signedness of the hash inputs
    - BUG/MAJOR: memory: Don't forget to unlock the rwlock if the pool is
                 empty.
  * d/dconv: use Python 3 to build the documentation.
    Closes: #948296, #950435.

 -- Vincent Bernat <bernat@debian.org>  Sat, 15 Feb 2020 15:32:32 +0100

haproxy (2.0.12-1) unstable; urgency=medium

  * New upstream version.
    - BUG/MAJOR: task: add a new TASK_SHARED_WQ flag to fix foreign requeuing
  * d/logrotate.conf: use rsyslog helper instead of SysV init script.
    Closes: #946973.

 -- Vincent Bernat <bernat@debian.org>  Fri, 20 Dec 2019 08:20:33 +0100

haproxy (2.0.11-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: dns: add minimalist error processing on the Rx path

 -- Vincent Bernat <bernat@debian.org>  Fri, 13 Dec 2019 19:22:03 +0100

haproxy (2.0.10-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: h2: make header field name filtering stronger
    - BUG/MAJOR: h2: reject header values containing invalid chars
    - BUG/MAJOR: mux-h2: don't try to decode a response HEADERS frame in
                 idle state

 -- Vincent Bernat <bernat@debian.org>  Tue, 26 Nov 2019 13:22:17 +0100

haproxy (2.0.9-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: stream-int: Don't receive data from mux until SI_ST_EST
                 is reached

 -- Vincent Bernat <bernat@debian.org>  Sat, 16 Nov 2019 17:38:51 +0100

haproxy (2.0.8-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: idle conns: schedule the cleanup task on the correct
                 threads

 -- Vincent Bernat <bernat@debian.org>  Wed, 23 Oct 2019 08:55:55 +0200

haproxy (2.0.7-1) unstable; urgency=medium

  * New upstream release.  
    - BUG/MAJOR: mux-h2: Handle HEADERS frames received after a RST_STREAM
                 frame
    - BUG/MAJOR: mux_h2: Don't consume more payload than received for
                 skipped frames
    - BUG/MEDIUM: checks: make sure the connection is ready before trying
                  to recv

 -- Vincent Bernat <bernat@debian.org>  Fri, 27 Sep 2019 19:14:12 +0200

haproxy (2.0.6-2) unstable; urgency=medium

  * d/patches: fix regression with checks.

 -- Vincent Bernat <bernat@debian.org>  Wed, 18 Sep 2019 08:02:53 +0200

haproxy (2.0.6-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MAJOR: ssl: ssl_sock was not fully initialized.

 -- Vincent Bernat <bernat@debian.org>  Fri, 13 Sep 2019 21:25:38 +0200

haproxy (2.0.5-1) unstable; urgency=medium

  * New upstream release.
    - BUG/MEDIUM: mux_h1: Don't bother subscribing in recv if we're not
                  connected.
    - BUG/MEDIUM: mux_pt: Don't call unsubscribe if we did not subscribe.
    - BUG/MEDIUM: proxy: Don't forget the SF_HTX flag when upgrading
                  TCP=>H1+HTX.
    - BUG/MEDIUM: proxy: Don't use cs_destroy() when freeing the
                  conn_stream.
    - BUG/MEDIUM: stick-table: Wrong stick-table backends parsing.

 -- Vincent Bernat <bernat@debian.org>  Fri, 16 Aug 2019 19:51:24 +0200

haproxy (2.0.4-1) unstable; urgency=medium

  * New upstream release. Upload to unstable.
    - BUG/MAJOR: http/sample: use a static buffer for raw -> htx
                 conversion
    - BUG/MAJOR: queue/threads: avoid an AB/BA locking issue in
                 process_srv_queue()
  * d/haproxy.cfg: update default cipher lists to more secure defaults.
    TLSv1.0 and TLSv1.1 are disabled, as well as TLS tickets (they are
    breaking forward secrecy unless correctly rotated).
    Closes: #932763.

 -- Vincent Bernat <bernat@debian.org>  Fri, 09 Aug 2019 14:22:23 +0200

haproxy (2.0.3-1) experimental; urgency=medium

  * New upstream version.
    - BUG/CRITICAL: http_ana: Fix parsing of malformed cookies which start by
                    a delimiter (CVE-2019-14241)
    - BUG/MEDIUM: checks: Don't attempt to receive data if we already
                  subscribed.
    - BUG/MEDIUM: http/htx: unbreak option http_proxy
    - DOC: htx: Update comments in HTX files
    - BUG/MEDIUM: mux-h1: Trim excess server data at the end of a transaction
    - BUG/MEDIUM: tcp-checks: do not dereference inexisting conn_stream
  * Bump Standards-Version to 4.4.0; no changes needed

 -- Apollon Oikonomopoulos <apoikos@debian.org>  Tue, 23 Jul 2019 13:31:31 -0300

haproxy (2.0.2-1) experimental; urgency=medium

  * New upstream version.
    - BUG/MAJOR: listener: fix thread safety in resume_listener()

 -- Vincent Bernat <bernat@debian.org>  Wed, 17 Jul 2019 12:19:54 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog haproxy`.
