python-tornado (6.4.2-1ubuntu0.25.04.3) plucky-security; urgency=medium

  * SECURITY UPDATE: Cross site scripting in custom HTTP headers.
    - debian/patches/CVE-2025-67724-pre*.patch: Restrict headers to printable
      ASCII characters in tornado/httputil.py.
    - debian/patches/CVE-2025-67724.patch: Add check for "<" and add
      escape.xhtml_escape in status messages in tornado/web.py. Add tests in
      tornado/test/web_test.py.
    - CVE-2025-67724
  * SECURITY UPDATE: Denial of service due to malicious HTTP requests with
    repeated header names.
    - debian/patches/CVE-2025-67725.patch: Replace self._dict with
      self._combined_cache in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - debian/patches/CVE-2025-67725-post1.patch: Fix in-operator being case
      sensitive due to last patch changes in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - CVE-2025-67725
  * SECURITY UPDATE: Denial of service due to inefficient parsing of HTTP
    header values.
    - debian/patches/CVE-2025-67726.patch: Change _parseparam logic in
      tornado/httputil.py. Add tests in tornado/test/httputil_test.py.
    - CVE-2025-67726

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Wed, 07 Jan 2026 10:16:12 -0330

python-tornado (6.4.2-1ubuntu0.25.04.1) plucky-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2025-47287.patch: httputil: Raise errors
      instead of logging in multipart/form-data parsing
    - CVE-2025-47287

 -- Shishir Subedi <shishir.subedi@canonical.com>  Mon, 19 May 2025 13:28:53 +0545

python-tornado (6.4.2-1) unstable; urgency=medium

  * Team upload.
  * New upstream release:
    - CVE-2024-52804: Parsing of the cookie header is now much more
      efficient.  The older algorithm sometimes had quadratic performance
      which allowed for a denial-of-service attack in which the server would
      spend excessive CPU time parsing cookies and block the event loop
      (closes: #1088112).

 -- Colin Watson <cjwatson@debian.org>  Fri, 29 Nov 2024 13:09:50 +0000

python-tornado (6.4.1-3) unstable; urgency=medium

  * Team upload.
  * Remove dependency on old singledispatch backport
  * Disable on test that fails on Salsa CI but not locally

 -- Alexandre Detiste <tchet@debian.org>  Wed, 25 Sep 2024 10:15:25 +0200

python-tornado (6.4.1-2) unstable; urgency=medium

  * Team upload.
  * Fix tests with Twisted 24.7.0 (closes: #1078411).
  * Fix tests with openssl >= 3.3.1-5 (see discussion in #965041).

 -- Colin Watson <cjwatson@debian.org>  Mon, 19 Aug 2024 17:06:53 +0100

python-tornado (6.4.1-1) unstable; urgency=medium

  * Remove hurd patch - obsolete according to upstream
  * Package new upstream.
  * Drop obsolete patch for empty AsyncTestCase

 -- Julien Puydt <jpuydt@debian.org>  Thu, 13 Jun 2024 17:28:38 +0200

python-tornado (6.4.0-2) unstable; urgency=medium

  * Team upload.
  * Allow to instantiate an empty AsyncTestCase (Closes: #1072153)
  * Bump Standards-Version to 4.7.0

  [ Ondřej Nový ]
  * Remove myself from Uploaders.

 -- Timo Röhling <roehling@debian.org>  Wed, 29 May 2024 12:47:59 +0200

python-tornado (6.4.0-1) unstable; urgency=medium

  * Team upload.

  [ Alexandre Detiste ]
  * New upstream version 6.4.0 (Closes: #1042594, #1056508, #1058128)
  * remove old dependency on python3-mock, upstream uses unittest.mock

  [ Stefano Rivera ]
  * Patch: Handle PYTHONPATH in autoreload_test.

 -- Stefano Rivera <stefanor@debian.org>  Sun, 21 Jan 2024 16:06:11 -0400

python-tornado (6.3.2-1) unstable; urgency=medium

  * New upstream release (Closes: #1036875).
  * Refresh patches.
  * Bump standards-version to 4.6.2.

 -- Julien Puydt <jpuydt@debian.org>  Mon, 26 Jun 2023 07:42:05 +0200

python-tornado (6.2.0-3) unstable; urgency=medium

  [ Debian Janitor ]
  * Apply multi-arch hints. + python-tornado-doc: Add Multi-Arch: foreign.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Sun, 20 Nov 2022 12:24:11 +0000

python-tornado (6.2.0-2) unstable; urgency=medium

  [ Debian Janitor ]
  * Remove constraints unnecessary since buster:
    + python3-tornado: Drop versioned constraint on python3-zmq in Breaks.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Mon, 17 Oct 2022 02:43:30 +0100

python-tornado (6.2.0-1) unstable; urgency=medium

  * New upstream release.
  * Bump standards-version to 4.6.1.
  * Refresh patches.
  * Run tests for all supported Python 3 versions.

 -- Julien Puydt <jpuydt@debian.org>  Sun, 10 Jul 2022 23:08:31 +0200

python-tornado (6.1.0-3) unstable; urgency=medium

  * Drop a dead link. (Closes: #988772)
  * Add a patch replace_deprecated_unittest_aliases.patch.
  * Bump standards-version to 4.6.0.
  * Refresh lintian overrides.

 -- Julien Puydt <jpuydt@debian.org>  Fri, 03 Dec 2021 09:57:21 +0100

python-tornado (6.1.0-2) unstable; urgency=medium

  [ Stefano Rivera ]
  * Team upload.
  * Patch: Ignore known DeprecationWarnings in Python 3.10 (Closes: #1000287)

  [ Debian Janitor ]
  * Update standards version to 4.5.1, no changes needed.

 -- Stefano Rivera <stefanor@debian.org>  Sat, 20 Nov 2021 22:10:29 -0400

python-tornado (6.1.0-1) unstable; urgency=medium

  * New upstream version 6.1.0
  * Rebase patches, drop fix_971108.patch (fixed upstream)

 -- Gordon Ball <gordon@chronitis.net>  Fri, 13 Nov 2020 19:13:45 +0000

python-tornado (6.0.4-3) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/control: Update Maintainer field with new Debian Python Team
    contact address.
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Julien Puydt ]
  * Update patch headers so lintian doesn't complain.
  * Update lintian overrides.
  * Use my @debian.org mail address.
  * Bump dh compat to 13.
  * Add upstream patch (Closes: #971108).

 -- Julien Puydt <jpuydt@debian.org>  Tue, 13 Oct 2020 08:08:15 +0200

python-tornado (6.0.4-2) unstable; urgency=medium

  * Add breaks against pcs (<< 0.10.5-1), mitmproxy (<< 5)
  * Upload to unstable

 -- Gordon Ball <gordon@chronitis.net>  Tue, 12 May 2020 19:07:07 +0000

python-tornado (6.0.4-1) experimental; urgency=medium

  * New upstream release: 6.0.4 (Closes: #939271, again)
  * Refresh patches:
     - Applied upstream:
       + d/p/py38-0001-test-silence-deprecation-warning.patch
       + d/p/py38-0002-dont-log-CancelledError.patch
       + d/p/New_test_crt.patch
     - No longer needed:
       + d/p/0006-Use-SOURCE_DATE_EPOCH-for-copyright-year-to-make-build-reproducible.patch
  * Reintroduce dependency on python3-sphinxcontrib-asyncio
  * Update to Standards-Version 4.5.0
  * Declare Rules-Requires-Root: no

 -- Gordon Ball <gordon@chronitis.net>  Wed, 29 Apr 2020 13:19:45 +0000

python-tornado (6.0.3+really5.1.1-3) unstable; urgency=medium

  [ Debian Janitor ]
  * Use secure URI in Homepage field.
  * Bump debhelper from old 11 to 12.
  * Remove obsolete field Name from debian/upstream/metadata (already
    present in machine-readable debian/copyright).

  [ Sandro Tosi ]
  * Drop python2 support; Closes: #938220

 -- Sandro Tosi <morph@debian.org>  Wed, 01 Apr 2020 16:42:59 -0400

python-tornado (6.0.3+really5.1.1-2) unstable; urgency=medium

  * Applied patches from Ubuntu to fix Python 3.8 FTBFS:
    - d/p/py38-0001-test-silence-deprecation-warning.patch
    - d/p/py38-0002-dont-log-CancelledError.patch: Cherry-picked from upstream
      master to fix issues detected by failing py38 tests.
    (Closes: #945222)

 -- Ondřej Nový <onovy@debian.org>  Fri, 22 Nov 2019 09:16:53 +0100

python-tornado (6.0.3+really5.1.1-1) unstable; urgency=medium

  * Re-upload old version so deps can follow.

 -- Julien Puydt <jpuydt@debian.org>  Sun, 20 Oct 2019 10:45:08 +0200

python-tornado (6.0.3-1) unstable; urgency=medium

  [ Michael Hudson-Doyle ]
  * Bump ASYNC_TEST_TIMEOUT when running the autopkgtests as well.

  [ Gianfranco Costamagna ]
  * Commit Ubuntu delta in Debian packaging repo

  [ Julien Puydt ]
  * New upstream release 6.0.3 (Closes: #939271)
  * Bump std-vers to 4.4.0.
  * Update patches (and drop those upstreamed [new CRT and reproducible]).
  * Adapt to upstream only supporting Python 3 (Closes: #938220)

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.
  * Bump Standards-Version to 4.4.1.

  [ Julien Puydt ]
  * Add python3-sphinxcontrib-asyncio as new build-dep.
  * Use my debian.org mail address.
  * Update lintian overrides.

 -- Julien Puydt <jpuydt@debian.org>  Sat, 19 Oct 2019 22:48:34 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python-tornado-doc`.
