nghttp2 (1.68.0-2ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: HTTP request/response smuggling issue
    - debian/patches/CVE-2026-58055.patch: nghttpx: Tighten up CONNECT and HTTP
      Upgrade handling in src/shrpx_downstream.cc, src/shrpx_downstream.h,
      src/shrpx_http2_upstream.cc, src/shrpx_http3_upstream.cc,
      src/shrpx_http_downstream_connection.cc,
      src/shrpx_http_downstream_connection.h, src/shrpx_https_upstream.cc.
    - CVE-2026-58055

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 30 Jun 2026 12:37:58 -0400

nghttp2 (1.68.0-2ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service through assertion failure.
    - debian/patches/CVE-2026-27135.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - CVE-2026-27135

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 05 May 2026 15:08:54 -0230

nghttp2 (1.68.0-2) unstable; urgency=medium

  [ Luca Boccassi ]
  * Always use invoke-rc.d when checking status (Closes: #1128487)

 -- Tomasz Buchert <tomasz@debian.org>  Tue, 24 Feb 2026 23:24:40 +0100

nghttp2 (1.68.0-1) unstable; urgency=medium

  * New upstream version 1.68.0
  * Start using signed releases tarballs in favor of tags
  * Remove obsolete patches
  * Removing fetch-ocsp-response -> no longer supported
  * Update copyright to account for source file changes
  * Minor packaging fixes and refreshes

 -- Tomasz Buchert <tomasz@debian.org>  Sat, 07 Feb 2026 15:29:22 +0100

nghttp2 (1.64.0-1.1) unstable; urgency=medium

  * Add patch: lp-2104171-avoid-rubydomain-namespace.patch (Closes: #1095360)

 -- Maximiliano Curia <maxy@debian.org>  Fri, 11 Apr 2025 17:50:32 +0200

nghttp2 (1.64.0-1) unstable; urgency=medium

  * New upstream version 1.64.0

 -- Tomasz Buchert <tomasz@debian.org>  Mon, 28 Oct 2024 20:45:36 +0100

nghttp2 (1.63.0-1) unstable; urgency=medium

  * New upstream version 1.63.0
  * Update std-ver to 4.7.0

 -- Tomasz Buchert <tomasz@debian.org>  Sun, 01 Sep 2024 08:23:00 +0200

nghttp2 (1.62.1-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * Install systemd unit using dh_installsystemd. (Closes: #1073057)

 -- Tomasz Buchert <tomasz@debian.org>  Wed, 10 Jul 2024 22:55:43 +0200

nghttp2 (1.62.1-1) unstable; urgency=medium

  * New upstream version 1.62.1

 -- Tomasz Buchert <tomasz@debian.org>  Sat, 18 May 2024 09:28:10 +0200

nghttp2 (1.61.0-1) unstable; urgency=high

  * New upstream version 1.61.0 (fixes CVE-2024-28182)

 -- Tomasz Buchert <tomasz@debian.org>  Fri, 05 Apr 2024 00:56:35 +0200

nghttp2 (1.60.0-1) unstable; urgency=medium

  * New upstream version 1.60.0

 -- Tomasz Buchert <tomasz@debian.org>  Fri, 08 Mar 2024 22:31:26 +0100

nghttp2 (1.59.0-1) unstable; urgency=medium

  * New upstream version 1.59.0

 -- Tomasz Buchert <tomasz@debian.org>  Thu, 01 Feb 2024 23:43:52 +0100

nghttp2 (1.58.0-1) unstable; urgency=medium

  * New upstream version 1.58.0

 -- Tomasz Buchert <tomasz@debian.org>  Sat, 04 Nov 2023 23:21:22 +0100

nghttp2 (1.57.0-1) unstable; urgency=medium

  * New upstream version 1.57.0
  * Fixes HTTP/2 Rapid Reset advisory

 -- Tomasz Buchert <tomasz@debian.org>  Thu, 12 Oct 2023 23:19:30 +0200

nghttp2 (1.56.0-1) unstable; urgency=medium

  * New upstream version 1.56.0

 -- Tomasz Buchert <tomasz@debian.org>  Tue, 05 Sep 2023 08:39:33 +0200

nghttp2 (1.55.1-1) unstable; urgency=medium

  * New upstream version 1.55.1 (1.55.0 skipped intentionally)

 -- Tomasz Buchert <tomasz@debian.org>  Wed, 19 Jul 2023 08:03:17 +0200

nghttp2 (1.54.0-1) unstable; urgency=medium

  * New upstream version 1.54.0

 -- Tomasz Buchert <tomasz@debian.org>  Sat, 10 Jun 2023 09:25:26 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libnghttp2-doc`.
