libarchive (3.8.9-1) unstable; urgency=medium

  * New upstream release.
    - Fix CVE-2026-15028 (Closes: #1142833).
    - Fix CVE-2026-16517 (Closes: #1142834).

 -- Syed Shahrukh Hussain <syed.shahrukh@ossrevival.org>  Sat, 1 Aug 2026 06:15:11 +0500

libarchive (3.8.8-2) unstable; urgency=medium

  * debian/patches:
    - Backport upstream patch to fix a regression causing "Seek error"
      failures when importing tar archives with systemd's importctl.

 -- Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>  Sat, 11 Jul 2026 03:39:56 +0000

libarchive (3.8.8-1) unstable; urgency=medium

  * New upstream release.
    - Fix CVE-2026-5745 (Closes: #1132998).
    - Fix CVE-2026-14164 (Closes: #1141180).

 -- Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>  Thu, 02 Jul 2026 01:15:33 +0000

libarchive (3.8.7-1) unstable; urgency=medium

  * New upstream release.
    -  Fix CVE-2026-4424 (Closes: #1131446).
    -  Fix CVE-2026-4426 (Closes: #1131444).
    -  Fix CVE-2026-5121 (Closes: #1133002).

 -- Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>  Mon, 20 Apr 2026 01:49:47 +0000

libarchive (3.8.6-1) unstable; urgency=medium

  [ Antoine Le Gonidec ]
  * Dropping myself from the list of Uploaders.

  [ Gabriel Barrantes ]
  * New upstream release.
    -  Fix CVE-2026-4111 (Closes: #1130753).

 -- Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>  Sat, 14 Mar 2026 23:08:23 +0000

libarchive (3.8.5-1) unstable; urgency=medium

  [ Gabriel Barrantes ]
  * New upstream release.
  * Packaging changes:
    - Remove debian/.gitignore.
    - Bump Standards-Version to 4.7.3, drop obsolete Priority field
      in debian/control.
    - Update debian/copyright years to 2026.
    - Update debian/watch to version 5.
  * Changelog correction:
    - The 3.8.4-1 entry incorrectly referenced a Debian bug number for
      CVE-2025-60753; there is no associated Debian bug.

 -- Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>  Fri, 09 Jan 2026 12:48:50 +0000

libarchive (3.8.4-1) unstable; urgency=medium

  [ Gabriel Barrantes ]
  * New upstream release.
    - CVE-2025-60753 (Closes: #1037093).
  * Update debian/libarchive13t64.symbols.
  * Remove upstream-vcs-tag setting from debian/gbp.conf.
  * Delete debian/README.Debian, as it is no longer applicable.
  * Add debian/.gitignore.
  * Make minor improvements to debian/upstream/metadata.
  * Update debian/copyright file years, fix some typos.
  * Adopt the package (Closes: #1122503).
  * Drop obsolete patches:
    - debian/patches/typos.patch: forwarded upstream
    - debian/patches/test-locale-C.UTF-8.patch: originally added to help
      reprotest CI, but reprotest has since been replaced by debrebuild
      and tests now pass without it

  [ Peter Pentchev ]
  * Run the test suite by default at package build time.
  * Add the year 2025 to my debian/* copyright notice.
  * Update the Salsa CI configuration:
    - use the now-canonical pipeline definition
    - temporarily disable reprotest, it interferes with some of
      the unit tests run at build time
  * Always run the unit test suite at build time:
    - dump the logfiles for failed tests
    - add the unzip-test-env patch to fix a test
    - use the C.UTF-8 locale for testing
    - no longer create the en_US.UTF-8 locale for the tests
    - let dh_auto_test handle parallel running by itself

  [ Antoine Le Gonidec ]
  * Add myself as Uploader.

 -- Antoine Le Gonidec <vv221@debian.org>  Thu, 08 Jan 2026 02:46:50 +0100

libarchive (3.7.4-4) unstable; urgency=medium

  * Add the CVE-2025-5914, CVE-2025-5915, CVE-2025-5916, and
    CVE-2025-5917 patches.
    Closes: #1107621, #1107622, #1107623, #1107626

 -- Peter Pentchev <roam@debian.org>  Thu, 24 Jul 2025 17:40:32 +0300

libarchive (3.7.4-3) unstable; urgency=medium

  * Rename the CVE-2025-1632 patch to CVE-2025-1632-25724, use the exact
    upstream commit that fixes two problems at once.
    Also closes: #1103479

 -- Peter Pentchev <roam@debian.org>  Sun, 27 Apr 2025 23:19:29 +0300

libarchive (3.7.4-2) unstable; urgency=high

  * Acknowledge NMU; thanks, Salvatore!
  * Point to the debian/trixie branch in the gbp.conf file since
    the master branch in the repository already contains changes that
    did not make it in time for the Trixie freeze.
  * Add the CVE-2025-1632 patch. Closes: #1103494
  * Add the year 2025 to my debian/* copyright notice.

 -- Peter Pentchev <roam@debian.org>  Sat, 26 Apr 2025 11:34:57 +0300

libarchive (3.7.4-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * rar4 reader: protect copy_from_lzss_window_to_unp() (CVE-2024-20696)
    (Closes: #1086155)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 01 Nov 2024 21:30:39 +0100

libarchive (3.7.4-1) unstable; urgency=medium

  * Drop a t64-related Lintian override.
  * Declare compliance with Policy 4.7.0 with no changes.
  * Use debhelper compat level 14:
    - use X-DH-Compat
    - let debhelper take care of some default dependencies
  * New upstream version:
    - use `git rm` in the `upstream` branch to remove two test files that
      was forgotten in the upstream tarball generation
    - update the symbols file
    - drop the fix-OOB-in-rar-e8-filter-2135, iso9660-hash, test-zstd-32bit, and
      robust-error-reporting patches, they were either taken from upstream or
      integrated there
    - refresh the typos patch
    - refresh the line numbers in the fix-OOB-* patches
  * Use debputy's X-Style: black.

 -- Peter Pentchev <roam@debian.org>  Wed, 07 Aug 2024 14:36:27 +0300

libarchive (3.7.2-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * fix: OOB in rar e8 filter (CVE-2024-26256) (Closes: #1072107)
  * fix: OOB in rar delta filter
  * fix: OOB in rar audio filter

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 01 Jun 2024 15:50:51 +0200

libarchive (3.7.2-2) unstable; urgency=medium

  [ Luca Boccassi ]
  * libarchive-dev: depend on -dev packages in an attempt to
    fix pkg-config --static --libs
    Addresses: 1056317; more work needed on libarchive's own
    configure tests

  [ Peter Pentchev ]
  * Acknowledge Lukas Märdian 64-bit-time_t-related NMU. Thanks!
  * Add the year 2024 to my debian/* copyright notice.
  * Re-sort the dependencies lists in the debian/control file.
  * Switch the pkg-config dependency over to pkgconf.
  * Add the robust-error-reporting upstream patch. Closes: #1068047

 -- Peter Pentchev <roam@debian.org>  Sat, 30 Mar 2024 20:11:06 +0200

libarchive (3.7.2-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1062224

 -- Lukas Märdian <slyon@debian.org>  Thu, 29 Feb 2024 08:40:57 +0000

libarchive (3.7.2-1) unstable; urgency=medium

  * Add the iso9660-hash patch to fix file ordering. Closes: #1051322
  * Add the year 2023 to my debian/* copyright notice.
  * Declare compatibility with version 1 of the dpkg build API:
    - drop the implied Rules-Requires-Root declaration
    - include dpkg's default.mk file for completeness
  * Use dh-package-notes to record ELF package metadata.
  * New upstream version:
    - build and install the new bsdunzip tool in libarchive-tools
    - drop the iconv-pkgconfig patch, applied upstream
    - update the upstream copyright information
  * Do not detect -amd64 versions in the watch file.
  * Add the test-zstd-32bit upstream patch.

 -- Peter Pentchev <roam@debian.org>  Sat, 14 Oct 2023 18:28:55 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libarchive13t64`.
