mozjs140 (140.8.0-4) unstable; urgency=medium

  [ Alessandro Astone ]
  * d/p: Fix misalignment of pthread_cond_t, causing SIGBUS on armhf
    (LP: #2144310)

 -- Marco Trevisan (Treviño) <marco@ubuntu.com>  Thu, 19 Mar 2026 14:27:54 +0100

mozjs140 (140.8.0-3) unstable; urgency=medium

  * Team upload
  * d/p/riscv64a23-support: Match riscv64 candidate with RUST_TARGET

 -- Max Gilmour <max.gilmour@canonical.com>  Wed, 18 Mar 2026 08:22:32 -0400

mozjs140 (140.8.0-2) unstable; urgency=medium

  * Team upload
  * d/{rules,p/{riscv64a23-support,series}}: Add RVA23 support (LP: #2143666)

 -- Max Gilmour <max.gilmour@canonical.com>  Wed, 11 Mar 2026 14:28:32 -0400

mozjs140 (140.8.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2026-2763: Use-after-free in the JavaScript Engine component
    - CVE-2026-2764: Use-after-free in the JavaScript Engine: JIT component
    - CVE-2026-2765: Use-after-free in the JavaScript Engine component
    - CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component
    - CVE-2026-2783: Information disclosure due to JIT miscompilation
    - CVE-2026-2785: Invalid pointer in the JavaScript Engine component
    - CVE-2026-2786: Use-after-free in the JavaScript Engine component

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 25 Feb 2026 12:10:14 -0500

mozjs140 (140.7.0-2) unstable; urgency=medium

  * Cherry-pick patches to fix build with Python 3.14
  * Bump Standards Version to 4.7.3

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 31 Jan 2026 17:45:05 -0500

mozjs140 (140.7.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2026-0884: Use-after-free in the JavaScript Engine component
    - CVE-2026-0885: Use-after-free in the JavaScript GC component
    - CVE-2026-0891: Memory safety bugs
  * Remove three patches that are no longer needed.
    One is for armel which has been unable to build mozjs for a while, the
    other two are for mips* and ia64 which aren't used in Debian any more.
    Technically, the mips patch is useful for underpowered build machines
    but it doesn't appear there are any building mozjs currently.
    It's also from 4 years ago so hopefully machines have more RAM now.

 -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 22 Jan 2026 14:18:54 -0500

mozjs140 (140.6.0-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * arm64: add Breaks on libgjs0 << 1.86.0-3.1

 -- NoisyCoil <noisycoil@debian.org>  Mon, 19 Jan 2026 01:44:40 +0100

mozjs140 (140.6.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2025-14325: JIT miscompilation in the JavaScript Engine: JIT component
    - CVE-2025-14330: JIT miscompilation in the JavaScript Engine: JIT component
  * Salsa CI: Stop explicitly disabling reprotest
  * Salsa CI: Skip redundant build jobs because this is only Architecture: any

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 09 Dec 2025 09:23:25 -0500

mozjs140 (140.5.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2025-13016: Incorrect boundary conditions in the
      JavaScript: WebAssembly component

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 11 Nov 2025 14:51:36 -0500

mozjs140 (140.4.0-1) unstable; urgency=high

  [ Jeremy Bícha ]
  * New upstream release
    - CVE-2025-11711: Some non-writable Object properties could be modified
    - CVE-2025-11715: Memory safety bug

  [ Marco Trevisan (Treviño) ]
  * debian/gbp-repack-mozjs-source: Filter-out __pycache__ files

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 15 Oct 2025 08:08:52 -0400

mozjs140 (140.3.0-1) unstable; urgency=medium

  * New upstream release
  * Remove obsolete Rules-Requires-Root: no field
  * debian/watch: Convert to Version: 5

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 16 Sep 2025 08:55:35 -0400

mozjs140 (140.2.0-1) unstable; urgency=medium

  * New upstream release
  * Remove Bug-1973993-Install-ProfilingCategoryList.h patch:
    applied in new release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 18 Aug 2025 13:23:56 -0400

mozjs140 (140.1.0-4) unstable; urgency=medium

  * Opt into Salsa CI but disable blhc & reprotest checks for now
  * Add more tests to Expect-some-floating-point-tests-to-fail-on-i386.patch
  * Refresh patches

 -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 14 Aug 2025 15:24:47 -0400

mozjs140 (140.1.0-3) unstable; urgency=medium

  [ Marco Trevisan (Treviño) ]
  * d/p: Drop duplicated patch

  [ Jeremy Bícha ]
  * Release to unstable

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 12 Aug 2025 18:23:19 -0400

mozjs140 (140.1.0-2) experimental; urgency=medium

  * d/p: Add patches suggested/required for building newer GJS
  * debian/libmozjs-140-0.docs: Add Apache NOTICE files to docs
  * debian/source/lintian-overrides: Drop unused rule
  * debian/copyright: Drop superfluous file paths

 -- Marco Trevisan (Treviño) <marco@ubuntu.com>  Sun, 03 Aug 2025 18:13:21 +0200

mozjs140 (140.1.0-1) unstable; urgency=medium

  * New upstream release
  * Add patch from Chimera Linux to fix Unsupported OS error (Closes: #1108794)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 26 Jul 2025 15:28:01 +0200

mozjs140 (140.0-2) unstable; urgency=medium

  * Release to unstable
  * Bump Standards Verson to 4.7.2

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 04 Jul 2025 12:19:37 -0400

mozjs140 (140.0-1) experimental; urgency=medium

  * New upstream series (Closes: #1108229)
  * Copy patch from Debian's firefox to work around build issue with -Wno-format
  * Disable an ARM patch that may not be needed any more
  * Refresh patches

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 23 Jun 2025 13:22:36 -0400

mozjs128 (128.11.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2025-5263: Error handling for script execution was incorrectly isolated
      from web content
  * Update debian/upstream/signing-key.asc per upstream rotation

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 27 May 2025 09:34:04 -0400

mozjs128 (128.10.0-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 30 Apr 2025 08:13:03 -0400

mozjs128 (128.9.0-1) unstable; urgency=high

  * New upstream release (LP: #2105631)
    - CVE-2025-3028 Use-after-free triggered by XSLTProcessor
    - CVE-2025-3029 URL bar spoofing via non-BMP Unicode characters
    - CVE-2025-3030 Memory safety bugs

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 31 Mar 2025 12:49:25 -0400

mozjs128 (128.8.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2025-1933 JIT corruption of WASM i386 return value on 64-bit CPUs
    - CVE-2025-1934 Unexpected GC during RegExp bailout processing
    - CVE-2025-1936 Adding %00 and a fake extension changed interpretation
    - CVE-2025-1937 Memory safety bugs

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 03 Mar 2025 13:57:32 -0500

mozjs128 (128.7.0-1) unstable; urgency=high

  [ Jeremy Bícha ]
  * New upstream release
    - CVE-2025-11704 Potential double-free in PKCS#7 decryption handling

  [ Simon McVittie ]
  * Build-Depend on rustc 1.76.0, as per python/mozboot/mozboot/util.py
    (Closes: #1092630)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 04 Feb 2025 18:31:04 -0500

mozjs128 (128.6.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2025-0240: Compartment mismatch when parsing JavaScript JSON module
    - CVE-2025-0241: Memory corruption when using JavaScript Text Segmentation

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 08 Jan 2025 08:29:17 -0900

mozjs128 (128.5.0-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 26 Nov 2024 15:33:47 -0500

mozjs128 (128.4.0-4) unstable; urgency=medium

  * Team upload
  * d/p/Bug-1926140-Replace-pipes-imports-r-jmaher.patch,
    d/p/Bug-1925198-Move-telnetlib-import-to-BaseEmulator-r-jmahe.patch:
    Add patches from mozilla-central partially fixing build with
    python3.13 as default (Helps: #1084616)
  * d/control, d/rules, d/clean: Use python3-legacy-cgi for tests,
    replacing the standard library module that is no longer included
    in python3.13.
    Because of the Mozilla build system's use of virtualenv, python3.13
    doesn't seem to pick it up from /usr/lib/python3/dist-packages,
    so create a debian/site-packages/ with cgi.py and put that in the
    PYTHONPATH. (Closes: #1084616)

 -- Simon McVittie <smcv@debian.org>  Sat, 16 Nov 2024 16:59:31 +0000

mozjs128 (128.4.0-3) unstable; urgency=medium

  * Team upload
  * Install js128, js128-config to non-PATH locations.
    They aren't multi-arch co-installable if installed to /usr/bin,
    and the only package that build-depends on libmozjs-128-dev (gjs)
    doesn't actually use them anyway.
  * Install headers to a multiarch-friendly location.
    The headers contain facts about the host system (in js-config.h)
    so are not architecture-independent.
  * Mark libmozjs-128-dev as Multi-Arch: same.
    This will allow libgjs-dev to be usefully Multi-Arch: same, too.

 -- Simon McVittie <smcv@debian.org>  Wed, 06 Nov 2024 11:25:43 +0000

mozjs128 (128.4.0-2) unstable; urgency=medium

  * Team upload
  * d/p/js-src-tests-Avoid-using-legacy-MST-time-zone-name.patch:
    Add proposed patch to fix a test failure without tzdata-legacy
    installed (Closes: #1086298)

 -- Simon McVittie <smcv@debian.org>  Wed, 30 Oct 2024 10:01:18 +0000

mozjs128 (128.4.0-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 29 Oct 2024 17:22:22 +0100

mozjs128 (128.3.0-1) unstable; urgency=high

  * New upstream release (LP: #2083344)
    - CVE-2024-9396 Potential memory corruption when cloning certain objects
    - CVE-2024-9400 Potential memory corruption during JIT compilation
    - CVE-2024-9402 Memory safety bugs
  * Remove libatomic patch applied in new release
  * Revert "Add -latomic to LDFLAGS to try to fix armel build"

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 01 Oct 2024 11:46:49 -0400

mozjs128 (128.2.0-1) unstable; urgency=high

  [ Jeremy Bícha ]
  * New upstream release
    - CVE-2024-8381 Type confusion when looking up property names
    - CVE-2024-8382 Internal event interfaces exposed to web content
    - CVE-2024-8384 Garbage collection could mis-color cross-compartment objects
    - CVE-2024-8385 WASM type confusion involving ArrayTypes
    - CVE-2024-8387 Memory safety bugs

  [ Simon McVittie ]
  * Add patch to fix detection of architectures that require -latomic
    (Closes: #1079077)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 04 Sep 2024 09:51:21 -0400

mozjs128 (128.1.0-3) unstable; urgency=medium

  * Add -latomic to LDFLAGS to try to fix armel build

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 16 Aug 2024 17:02:03 -0400

mozjs128 (128.1.0-2) unstable; urgency=medium

  * Fix autopkgtest

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 14 Aug 2024 22:38:35 -0400

mozjs128 (128.1.0-1) unstable; urgency=medium

  * New upstream release
  * Remove 12 patches applied in new release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 14 Aug 2024 07:04:31 -0400

mozjs128 (128.0-2) unstable; urgency=medium

  * New upstream series (Closes: #1076037)
  * Add Build-Depends: cbindgen
  * Refresh patches
  * Drop 5 patches that are no longer needed
  * Cherry-pick 12 patches from future 128.1.0 to fix various issues
  * debian/rules: Set MOZBUILD_STATE_PATH
  * debian/test.sh: Remove reference to no-longer-provided run-mozilla.sh

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 31 Jul 2024 19:38:33 -0400

mozjs115 (115.13.0-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 09 Jul 2024 15:35:34 -0400

mozjs115 (115.12.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2024-5688 Use-after-free in JavaScript object transplant
    - CVE-2024-5700 Memory safety bugs

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 11 Jun 2024 14:34:32 -0400

mozjs115 (115.11.0-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 14 May 2024 18:32:36 +0200

mozjs115 (115.10.0-1) unstable; urgency=high

  * New upstream release (LP: #2061860)
    - CVE-2024-3852: GetBoundName in the JIT returned the wrong object
    - CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement
    - CVE-2024-3857: Incorrect JITting of arguments led to use-after-free
      during garbage collection

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 16 Apr 2024 07:52:09 -0400

mozjs115 (115.9.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2024-2607: JIT code failed to save return registers on Armv7-A

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 18 Mar 2024 11:47:42 -0400

mozjs115 (115.8.0-3) unstable; urgency=medium

  * Build-depend on dpkg-dev (>= 1.22.5) (Closes: #1065286)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 02 Mar 2024 18:02:34 -0500

mozjs115 (115.8.0-2) unstable; urgency=medium

  * Release to unstable (Closes: #1046520)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 27 Feb 2024 21:59:28 -0500

mozjs115 (115.8.0-2~exp1) experimental; urgency=medium

  [ Steve Langasek ]
  * Rename libraries for 64-bit time_t transition

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 19 Feb 2024 17:39:30 -0500

mozjs115 (115.8.0-1) unstable; urgency=medium

  * New upstream release
    - CVE-2024-1553: Memory safety bug
  * Drop 3 patches applied in new release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 19 Feb 2024 17:36:52 -0500

mozjs115 (115.7.0-4) unstable; urgency=medium

  * Team upload

  [ Simon McVittie ]
  * d/p/python3.12-six.patch:
    Rediff patch so quilt, dpkg-source and gbp pq agree on its effect

  [ Amin Bandali ]
  * Cherry-pick more upstream patches to fix build with Python 3.12
    - debian/patches/python3.12-bug1831512.patch
    - debian/patches/python3.12-bug1857516.patch
    - debian/patches/python3.12-bug1860051.patch
    - debian/patches/python3.12-bug1874280.patch
    - debian/patches/python3.12-bug1851580.patch
    - debian/patches/python3.12-bug1866829.patch

 -- Amin Bandali <bandali@ubuntu.com>  Fri, 16 Feb 2024 11:28:22 -0500

mozjs115 (115.7.0-3) unstable; urgency=medium

  * Team upload
  * d/p/Export-js-detail-CanonicalizedNaNBits-on-architectures-th.patch:
    Add a patch to fix linking of gjs (>= 1.78.3) on mips64el
    (Closes: #1063446)
  * d/tests/dev: Add a superficial autopkgtest.
    In addition to exercising basic compilation and initialization,
    this verifies that #1063446 has been fixed.

 -- Simon McVittie <smcv@debian.org>  Thu, 08 Feb 2024 14:40:52 +0000

mozjs115 (115.7.0-2) unstable; urgency=medium

  * Cherry-pick patch to fix build with Python 3.12

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 24 Jan 2024 08:51:19 -0500

mozjs115 (115.7.0-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 23 Jan 2024 08:36:55 -0500

mozjs115 (115.6.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2023-6864: Memory safety bug

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 02 Jan 2024 15:48:13 -0500

mozjs115 (115.5.0-1) unstable; urgency=medium

  * New upstream release
  * Stop using debian/control.in and gnome-pkg-tools (no translations here)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 21 Nov 2023 12:43:37 -0500

mozjs115 (115.4.0-2) unstable; urgency=high

  * Add patch to fix the non-JIT armel build
  * Adjust patch to update expected armel failures for 115

 -- Adrian Bunk <bunk@debian.org>  Wed, 25 Oct 2023 19:32:07 -0400

mozjs115 (115.4.0-1) unstable; urgency=medium

  * New upstream release
    - CVE-2023-5728: Improper object tracking during GC could lead to a crash

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 23 Oct 2023 15:44:30 -0400

mozjs115 (115.3.0-1) unstable; urgency=medium

  * New upstream release
  * Release to unstable

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 26 Sep 2023 12:34:26 -0400

mozjs115 (115.1.0-1) experimental; urgency=medium

  [ Jeremy Bícha ]
  * New upstream release

  [ Marco Trevisan (Treviño) ]
  * debian/patches: Refresh
  * debian/autogen.sh: Do not run autoreconf on old-configure
  * debian/control: Remove build dependency on autoconf2.13
  * debian/gbp-repack-mozjs-source.sh: Do not export AUTOCONF variable
  * debian/control: Update VCS references to 115 branch
  * debian/rules: Remove commented mozjs configure removal
  * debian/libmozjs-115.0.docs: Install README and remove removed files

 -- Marco Trevisan (Treviño) <marco@ubuntu.com>  Tue, 22 Aug 2023 19:30:18 +0200

mozjs102 (102.15.1-1) unstable; urgency=medium

  * New upstream release
    - This is the final upstream release in the 102 series.
      It's recommended to switch to mozjs115 instead.

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 18 Sep 2023 16:30:07 -0400

mozjs102 (102.15.0-1) unstable; urgency=medium

  * New upstream release
    - This is the final upstream release in the 102 series.
      It's recommended to switch to mozjs115 instead.

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 01 Sep 2023 16:58:48 -0400

mozjs102 (102.14.0-1) unstable; urgency=high

  * New upstream release
    - CVE-2023-4046: Incorrect value used during WASM compilation

 -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 03 Aug 2023 11:29:17 -0400

mozjs102 (102.13.0-1) unstable; urgency=high

  * New upstream release (LP: #2026197)
    - CVE-2023-37202: Potential use-after-free from compartment mismatch
      in SpiderMonkey
    - CVE-2023-37211: Memory safety bugs

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 05 Jul 2023 09:05:35 -0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libmozjs-140-0`.
