python-tornado (6.5.5-2) unstable; urgency=medium

  * Team upload.
  * Apply upstream patch to fix tests with pycurl 7.46.0

 -- Scott Talbert <swt@techie.net>  Thu, 14 May 2026 09:46:43 -0400

python-tornado (6.5.5-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - CVE-2026-31958: Introduces new limits on the size and complexity of
      multipart bodies, including a default limit of 100 parts per request
      to mitigate a possible DoS. It is also possible to disable parsing
      multipart/form-data entirely if not required (closes: #1130507).
    - The domain, path, and samesite arguments to RequestHandler.set_cookie
      are now validated for illegal characters, which could be abused to
      inject other attributes on the cookie.
    - Carriage return characters are no longer accepted in multipart/form-data
      headers.
  * d/python3-tornado.lintian-overrides: Fix matches.

 -- Daniel Leidert <dleidert@debian.org>  Tue, 31 Mar 2026 01:01:46 +0200

python-tornado (6.5.4-1) unstable; urgency=medium

  * Team upload.
  * debian/patches/Make-tests-compatible-with-curl-8.19.0.patch: new patch.
    (Closes: #1129145)

 -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Fri, 06 Mar 2026 01:04:28 -0300

python-tornado (6.5.4-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream release.
    - CVE-2025-67724: Header injection and XSS via reason argument.
      (Closes: #1122660)
    - CVE-2025-67725: Quadratic DoS via Repeated Header Coalescing.
      (Closes: #1122661)
    - CVE-2025-67726: Quadratic DoS via Crafted Multipart Parameters.
      (Closes: #1122663)

 -- Adrian Bunk <bunk@debian.org>  Mon, 05 Jan 2026 13:12:01 +0200

python-tornado (6.5.2-3) unstable; urgency=medium

  * Team upload.
  * Increase timeout to fix ftbfs issue on slow architectures.
    Thanks to Aurelien Jarno <aurel32@debian.org>. (Closes: #1117144)

 -- Bo YU <vimer@debian.org>  Sat, 04 Oct 2025 18:42:36 +0800

python-tornado (6.5.2-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Sun, 28 Sep 2025 11:43:57 +0200

python-tornado (6.5.2-1) experimental; urgency=medium

  * Team upload.
  * New upstream release.
  * Refreshed some patches.
  * Removed pythonpath-autoreload-test.patch now useless.
  * Removed CVE-2025-47287.patch applied upstream.

 -- Thomas Goirand <zigo@debian.org>  Tue, 26 Aug 2025 11:13:28 +0200

python-tornado (6.4.2-3) unstable; urgency=medium

  * Team upload.
  * Increase timeout on riscv64 to fix FTBFS issue. (Closes: #1106130)

 -- Bo YU <vimer@debian.org>  Thu, 22 May 2025 21:16:28 +0800

python-tornado (6.4.2-2) unstable; urgency=medium

  * Team upload.
  * CVE-2025-47287: httputil: Raise errors instead of logging in
    multipart/form-data parsing (closes: #1105886).

 -- Colin Watson <cjwatson@debian.org>  Sun, 18 May 2025 16:43:40 +0100

python-tornado (6.4.2-1) unstable; urgency=medium

  * Team upload.
  * New upstream release:
    - CVE-2024-52804: Parsing of the cookie header is now much more
      efficient.  The older algorithm sometimes had quadratic performance
      which allowed for a denial-of-service attack in which the server would
      spend excessive CPU time parsing cookies and block the event loop
      (closes: #1088112).

 -- Colin Watson <cjwatson@debian.org>  Fri, 29 Nov 2024 13:09:50 +0000

python-tornado (6.4.1-3) unstable; urgency=medium

  * Team upload.
  * Remove dependency on old singledispatch backport
  * Disable on test that fails on Salsa CI but not locally

 -- Alexandre Detiste <tchet@debian.org>  Wed, 25 Sep 2024 10:15:25 +0200

python-tornado (6.4.1-2) unstable; urgency=medium

  * Team upload.
  * Fix tests with Twisted 24.7.0 (closes: #1078411).
  * Fix tests with openssl >= 3.3.1-5 (see discussion in #965041).

 -- Colin Watson <cjwatson@debian.org>  Mon, 19 Aug 2024 17:06:53 +0100

python-tornado (6.4.1-1) unstable; urgency=medium

  * Remove hurd patch - obsolete according to upstream
  * Package new upstream.
  * Drop obsolete patch for empty AsyncTestCase

 -- Julien Puydt <jpuydt@debian.org>  Thu, 13 Jun 2024 17:28:38 +0200

python-tornado (6.4.0-2) unstable; urgency=medium

  * Team upload.
  * Allow to instantiate an empty AsyncTestCase (Closes: #1072153)
  * Bump Standards-Version to 4.7.0

  [ Ondřej Nový ]
  * Remove myself from Uploaders.

 -- Timo Röhling <roehling@debian.org>  Wed, 29 May 2024 12:47:59 +0200

python-tornado (6.4.0-1) unstable; urgency=medium

  * Team upload.

  [ Alexandre Detiste ]
  * New upstream version 6.4.0 (Closes: #1042594, #1056508, #1058128)
  * remove old dependency on python3-mock, upstream uses unittest.mock

  [ Stefano Rivera ]
  * Patch: Handle PYTHONPATH in autoreload_test.

 -- Stefano Rivera <stefanor@debian.org>  Sun, 21 Jan 2024 16:06:11 -0400

python-tornado (6.3.2-1) unstable; urgency=medium

  * New upstream release (Closes: #1036875).
  * Refresh patches.
  * Bump standards-version to 4.6.2.

 -- Julien Puydt <jpuydt@debian.org>  Mon, 26 Jun 2023 07:42:05 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python3-tornado`.
