libgit2 (1.9.1+ds-1ubuntu1.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Path traversal in submodule.
    - debian/patches/CVE-2026-53584.patch: Ensure that we do not try to load
      a submodule who has a filesystem path that points outside of our
      repository in src/libgit2/submodule.c and src/util/fs_path.h.
    - CVE-2026-53584
  * SECURITY UPDATE: Memory exhaustion in delta apply.
    - debian/patches/CVE-2026-53585.patch: Prevent overly large sized
      objects in packfiles in include/git2/common.h, src/libgit2/delta.c,
      src/libgit2/indexer.c, and src/libgit2/settings.c
    - CVE-2026-53585
  * SECURITY UPDATE: Credential leakage in HTTP transport.
    - debian/patches/CVE-2026-53586.patch: Give the URL of the current host
      in src/libgit2/transports/http.c.
    - CVE-2026-53586
  * SECURITY UPDATE: Out-of-bounds read in smart-pkt transport.
    - debian/patches/CVE-2026-53587.patch: Ensure that the current packet
      buffer is large enough in src/libgit2/transports/smart_pkt.c
    - CVE-2026-53587

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 11 Aug 2026 11:34:59 -0600

libgit2 (1.9.1+ds-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2130163). Remaining changes:
    - Vendor llhttp within package (LP #2080872)
      + Added d/p/use-vendored-llhttp.patch
      + Changed d/{rules,control} to use vendored lhttp
      + Added llhttp to d/copyright
    - d/{control,rules}: use OpenSSL as the crypto backend
    - d/tests/control: use cmake:native

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Tue, 04 Nov 2025 17:04:26 +0100

libgit2 (1.9.1+ds-1) unstable; urgency=medium

  * New upstream version 1.9.1+ds
  * Update patches.
    Merged: Use-Multi-Arch-destination-for-CMake-config.patch

 -- Timo Röhling <roehling@debian.org>  Wed, 13 Aug 2025 14:27:15 +0200

libgit2 (1.9.0+ds-2ubuntu2) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Fri, 05 Sep 2025 17:42:31 +0000

libgit2 (1.9.0+ds-2ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Vendor llhttp within package (LP #2080872)
      + Added d/p/use-vendored-llhttp.patch
      + Changed d/rules,control to use vendored lhttp
      + Added llhttp to d/copyright
    - Use OpenSSL as the crypto backend
    - d/tests/control: use cmake:native

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Fri, 16 May 2025 11:06:29 +0200

libgit2 (1.9.0+ds-2) unstable; urgency=medium

  * Upload to unstable.
  * Bump Standards-Version to 4.7.2
  * Replace old FSF address by weblink in d/copyright

 -- Timo Röhling <roehling@debian.org>  Thu, 03 Apr 2025 17:28:22 +0200

libgit2 (1.9.0+ds-1ubuntu1) plucky; urgency=medium

  * Merge from Debian Experimental. Remaining changes:
    - Use OpenSSL as the crypto backend
    - Use cmake:native in d/tests/control
    - d/copyright: re-add llhttp for vendoring
    - deps/llhttp: re-vendors llhttp v9.2.1
    - d/rules,control: use vendored llhttp and writes llhttp vendor tag
      (LP: #2080872)
    - Add use-vendored-llhttp.patch to satisfy dpkg-source.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 19 Feb 2025 11:35:09 -0600

libgit2 (1.9.0+ds-1) experimental; urgency=medium

  * New upstream version 1.9.0+ds
    (Closes: #1092215)
  * Drop Debian patch for mbedTLS default cipher list (fixed upstream)
  * Wrap and sort Debian package files
  * Bump SONAME to 1.9
  * Install new CMake config
  * Update d/copyright

 -- Timo Röhling <roehling@debian.org>  Sun, 12 Jan 2025 00:39:53 +0100

libgit2 (1.8.4+ds-3ubuntu2) plucky; urgency=medium

  [ Zixing Liu ]
  * d/copyright: re-add llhttp for vendoring
  * deps/llhttp: re-vendors llhttp v9.2.1
  * d/rules,control: use vendored llhttp and writes llhttp vendor tag
    (LP: #2080872)

  [ Simon Quigley ]
  * Add use-vendored-llhttp.patch to satisfy dpkg-source.

 -- Zixing Liu <zixing.liu@canonical.com>  Mon, 16 Dec 2024 11:50:41 -0700

libgit2 (1.8.4+ds-3ubuntu1) plucky; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Use OpenSSL as the crypto backend
    - Use cmake:native in d/tests/control

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 10 Dec 2024 22:35:00 +0100

libgit2 (1.8.4+ds-3) unstable; urgency=medium

  * Use mbedTLS default cipher list for TLS handshake (Closes: #1088281)

 -- Timo Röhling <roehling@debian.org>  Wed, 27 Nov 2024 23:26:26 +0100

libgit2 (1.8.4+ds-2) unstable; urgency=medium

  * Bump cmake_minimum_required() for autopkgtest (Closes: #1087860)

 -- Timo Röhling <roehling@debian.org>  Thu, 21 Nov 2024 11:46:53 +0100

libgit2 (1.8.4+ds-1ubuntu1) plucky; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Use OpenSSL as the crypto backend
    - Use cmake:native in d/tests/control

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 14 Nov 2024 12:59:02 +0100

libgit2 (1.8.4+ds-1) unstable; urgency=medium

  * Unvendor llhttp again
  * New upstream version 1.8.4+ds
  * Print the file header on GIT_DIFF_FORMAT_PATCH_HEADER (Closes: #1086494)
  * Move back to http-parser again

 -- Timo Röhling <roehling@debian.org>  Sun, 03 Nov 2024 01:47:58 +0100

libgit2 (1.8.2~rc1+ds2-1) unstable; urgency=medium

  * Keep vendored llhttp for ports architectures
  * New upstream version 1.8.2~rc1+ds2
  * Update d/copyright
  * Use vendored llhttp on architectures without nodejs (Closes: #1084223)

 -- Timo Röhling <roehling@debian.org>  Tue, 08 Oct 2024 22:45:48 +0200

libgit2 (1.8.2~rc1+ds-2) unstable; urgency=medium

  * Upload to unstable.

 -- Timo Röhling <roehling@debian.org>  Sat, 05 Oct 2024 01:02:23 +0200

libgit2 (1.8.2~rc1+ds-1) experimental; urgency=medium

  * New upstream version 1.8.2~rc1+ds
    - Revert premature const correctness change to
      git_commit_create() and git_commit_create_buffer()

 -- Timo Röhling <roehling@debian.org>  Sun, 15 Sep 2024 09:52:48 +0200

libgit2 (1.8.1+ds-2) experimental; urgency=medium

  * Fix version ordering for -rc releases in d/watch
  * Wrap and sort Debian package files
  * Bump Standards-Version to 4.7.0
  * Move back to http-parser from llhttp (Closes: #1081534)

 -- Timo Röhling <roehling@debian.org>  Thu, 12 Sep 2024 16:04:48 +0200

libgit2 (1.8.1+ds-1) experimental; urgency=medium

  * Update Files-Excluded for newly vendored HTTP parser
  * New upstream version 1.8.1+ds
  * Update patches
    - Drop handle-bashim.patch (merged upstream)
  * Bump SONAME to 1.8
  * Migrate from http-parser to llhttp

 -- Timo Röhling <roehling@debian.org>  Mon, 20 May 2024 11:21:07 +0200

libgit2 (1.7.2+ds-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 01:58:30 +0000

libgit2 (1.7.2+ds-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 18:24:03 +0000

libgit2 (1.7.2+ds-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Use OpenSSL as the crypto backend
    - Use cmake:native in d/tests/control
    - Lower optimization level to O2 on ppc64el to fix a test failure

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 13 Feb 2024 09:12:02 +0100

libgit2 (1.7.2+ds-1) unstable; urgency=medium

  * New upstream version 1.7.2+ds
    - Fix CVE-2024-24575: Denial of service in git_revparse_single
      (Closes: #1063415)
    - Fix CVE-2024-24577: Use-after-free in git_index_add
      (Closes: #1063416)
  * Build-depend on pkgconf instead of pkg-config

 -- Timo Röhling <roehling@debian.org>  Thu, 08 Feb 2024 09:10:45 +0100

libgit2 (1.7.1+ds-2ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Use OpenSSL as the crypto backend
    - Use cmake:native in d/tests/control
    - Lower optimization level to O2 on ppc64el to fix a test failure

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sun, 03 Dec 2023 09:29:52 +0100

libgit2 (1.7.1+ds-2) unstable; urgency=medium

  * Upload to unstable.

 -- Timo Röhling <roehling@debian.org>  Sat, 02 Dec 2023 20:29:31 +0100

libgit2 (1.7.1+ds-1) experimental; urgency=medium

  * Update d/copyright
  * New upstream version 1.7.1+ds
  * Bump SONAME to 1.7

 -- Timo Röhling <roehling@debian.org>  Fri, 08 Sep 2023 10:45:39 +0200

libgit2 (1.6.4+ds-1) experimental; urgency=medium

  * New upstream version 1.6.4+ds
  * Refresh patches
    - Drop fix-unit-tests.patch (no longer needed)
  * Bump SONAME to 1.6
  * Add myself to uploaders
  * Update d/symbols

 -- Timo Röhling <roehling@debian.org>  Mon, 19 Jun 2023 20:45:38 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libgit2-1.9`.
