python-urllib3 (2.3.0-3ubuntu0.6) questing-security; urgency=medium

  * SECURITY UPDATE: sensitive headers not stripped in cross-origin redirects
    - debian/patches/CVE-2026-44431.patch: remove sensitive headers in proxy
      pools too in dummyserver/asgi_proxy.py, src/urllib3/connectionpool.py,
      test/with_dummyserver/test_proxy_poolmanager.py.
    - CVE-2026-44431

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 22 May 2026 13:29:38 -0400

python-urllib3 (2.3.0-3ubuntu0.4) questing-security; urgency=medium

  * SECURITY REGRESSION: Zstandard missing attribute after CVE-2025-66471 fix.
    (LP: #2136906)
    - debian/patches/CVE-2025-66471-fix2.patch: Fall back if "needs_input" is
      not a zstd object attribute in src/urllib3/response.py.

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 13 Jan 2026 09:29:02 -0330

python-urllib3 (2.3.0-3ubuntu0.3) questing-security; urgency=medium

  * SECURITY REGRESSION: Zstd issues after CVE-2025-66471 fix. (LP: #2136906)
    - debian/patches/CVE-2025-66471-fix1.patch: Revert zstd fix due to not
      being compatible with zstandard.

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 12 Jan 2026 15:50:53 -0330

python-urllib3 (2.3.0-3ubuntu0.2) questing-security; urgency=medium

  * SECURITY UPDATE: Decompression bomb in HTTP redirect responses.
    - debian/patches/CVE-2026-21441.patch: Add decode_content to self.read()
      in src/urllib3/response.py. Add tests in
      test/with_dummyserver/test_connectionpool.py and dummyserver/app.py.
    - CVE-2026-21441

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 08 Jan 2026 14:32:03 -0330

python-urllib3 (2.3.0-3ubuntu0.1) questing-security; urgency=medium

  * SECURITY UPDATE: Denial of service due to unbounded decompression chain.
    - debian/patches/CVE-2025-66418.patch: Add max_decode_links limit and
      checks in src/urllib3/response.py. Add test in test/test_response.py.
    - CVE-2025-66418
  * SECURITY UPDATE: Denial of service due to decompression bomb.
    - debian/patches/CVE-2025-66471.patch: Fix decompression bomb in
      src/urllib3/response.py. Add tests in test/test_response.py.
    - debian/patches/CVE-2025-66471-post1.patch: Remove brotli version warning
      due to intrusive backport for brotli fixes and upstream version warning
      not being appropriate for distro backporting.
    - CVE-2025-66471

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Wed, 10 Dec 2025 12:29:16 -0330

python-urllib3 (2.3.0-3) unstable; urgency=medium

  * Team upload.
  * CVE-2025-50181: Fix a security issue where restricting the maximum
    number of followed redirects at the `urllib3.PoolManager` level via the
    `retries` parameter did not work (closes: #1108076).
  * CVE-2025-50182: Make the Node.js runtime respect redirect parameters
    such as `retries` and `redirects` (closes: #1108077).

 -- Colin Watson <cjwatson@debian.org>  Sun, 13 Jul 2025 14:09:35 +0200

python-urllib3 (2.3.0-2) unstable; urgency=medium

  * Team upload.
  * Ensure compatibility with httpx>=0.28 (closes: #1099277).

 -- Colin Watson <cjwatson@debian.org>  Wed, 12 Mar 2025 11:20:41 +0000

python-urllib3 (2.3.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
  * SingleTLSLayerTestCase: Catch BrokenPipeError.

 -- Colin Watson <cjwatson@debian.org>  Fri, 17 Jan 2025 13:54:06 +0000

python-urllib3 (2.2.3-4) unstable; urgency=medium

  * Team upload.
  * Mark package "Multi-Arch: foreign" (Closes: #1078034)

 -- Alexandre Detiste <tchet@debian.org>  Wed, 11 Dec 2024 13:16:51 +0100

python-urllib3 (2.2.3-3) unstable; urgency=medium

  * Team upload.
  * Upload to unstable.

 -- Colin Watson <cjwatson@debian.org>  Fri, 29 Nov 2024 16:38:06 +0000

python-urllib3 (2.2.3-2) experimental; urgency=medium

  * Team upload.
  * Mark test_http2_probe_blocked_per_thread with requires_network.

 -- Colin Watson <cjwatson@debian.org>  Tue, 12 Nov 2024 23:59:17 +0000

python-urllib3 (2.2.3-1) experimental; urgency=medium

  * Team upload.
  * New upstream release:
    - CVE-2024-37891: Added the Proxy-Authorization header to the list of
      headers to strip from requests when redirecting to a different host
      (closes: #1074149).
    - Added support for Python 3.13 (closes: #1082278).
  * Temporarily vendor hypercorn, since urllib3 needs a patched version for
    its tests (commit d1719f8c1570cbd8e6a3719ffdb14a4d72880abb; see
    https://github.com/urllib3/urllib3/issues/3334; closes: #1086794).

 -- Colin Watson <cjwatson@debian.org>  Sun, 10 Nov 2024 23:57:18 +0000

python-urllib3 (2.0.7-2) unstable; urgency=medium

  * Team upload.
  * Remove build & autopkgtest dependency on python3-mock
  * Disable a test that compare today's date against some "expiry date".
  * Patch: add a patch from upstream to handle new Exception strings.

 -- Alexandre Detiste <tchet@debian.org>  Wed, 12 Jun 2024 20:04:48 +0200

python-urllib3 (2.0.7-1) experimental; urgency=medium

  [ Stefano Rivera ]
  * New upstream release.
  * Drop six patch and dependency on python3-six, superseded upstream.
    (Closes: #1025218, LP: #1897633)
  * Drop bundled backports.makefile from copyright, removed upstream.
  * Build with pybuild pyproject plugin.
  * Mark Build-Depends with nocheck.
  * Re-enable the full test suite.
  * Patch: Handle ConnectionRefusedError in test.requires_network()
  * Patch: Mark tests that require network
  * Patch: Don't make requests to evil.com in tests.
  * Export CI=1 in tests, to increase timeouts.
  * Allow stderr in the autopkgtest.
  * Patch: Skip expensive integration tests, that often cause timeouts.

 -- Daniele Tricoli <eriol@debian.org>  Sun, 12 Nov 2023 23:57:09 +0100

python-urllib3 (1.26.18-2) unstable; urgency=medium

  * Team upload.
  * Patch: Fix tests under Python 3.12. (Closes: #1056511)

 -- Stefano Rivera <stefanor@debian.org>  Sun, 21 Jan 2024 15:46:13 -0400

python-urllib3 (1.26.18-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - Fix CVE-2023-45803 (Closes: #1054226)
  * Drop patch 02_require-cert-verification.patch, no longer needed.
    (Closes: #1054212)
  * Refresh patches.

 -- Stefano Rivera <stefanor@debian.org>  Sat, 21 Oct 2023 17:05:33 +0200

python-urllib3 (1.26.17-1) unstable; urgency=medium

  * New upstream version 1.26.17
    - Fix CVE-2023-43804 (Closes: #1053626).
  * Refresh patches.

 -- Daniele Tricoli <eriol@debian.org>  Tue, 10 Oct 2023 02:32:39 +0200

python-urllib3 (1.26.16-1) unstable; urgency=medium

  * New upstream version 1.26.16
  * Refresh patches.
  * debian/control
    - Update standards version to 4.6.2, no changes needed.
  * debian/copyright
    - Update copyright years.

 -- Daniele Tricoli <eriol@debian.org>  Fri, 30 Jun 2023 01:10:18 +0200

python-urllib3 (1.26.12-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.26.12
  * Bump Standards-Version to 4.6.1 (no change)
  * Refresh patches

 -- Anthony Fok <foka@debian.org>  Thu, 22 Sep 2022 15:14:17 -0600

python-urllib3 (1.26.9-1) unstable; urgency=medium

  * New upstream version 1.26.9
  * Refresh patches.
  * Add python3-brotli to B-D, Suggests and autopkgtest's Depends.

 -- Daniele Tricoli <eriol@debian.org>  Sat, 19 Mar 2022 01:35:39 +0100

python-urllib3 (1.26.8-1) unstable; urgency=medium

  [ Jenkins ]
  * Remove constraints unnecessary since stretch

  [ Daniele Tricoli ]
  * New upstream release.
  * Refresh patches.
  * Enable salsa pipelines.
  * Enable autopkgtest tests.
  * debian/control
    - Update standards version to 4.6.0, no changes needed.
  * debian/copyright
    - Update copyright years.

 -- Daniele Tricoli <eriol@debian.org>  Mon, 14 Mar 2022 01:12:18 +0100

python-urllib3 (1.26.5-1~exp1) unstable; urgency=medium

  * New upstream version 1.26.5
    - CVE-2021-33503: Catastrophic backtracking in URL authority parser when
      passed URL containing many @ characters. (Closes: #989848)
  * Refresh patches.

 -- Daniele Tricoli <eriol@debian.org>  Sun, 27 Jun 2021 17:02:18 +0200

python-urllib3 (1.26.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - Enforces certificate validation in some cases involving HTTPS to HTTPS
      proxies CVE-2021-28363.

 -- Stefano Rivera <stefanor@debian.org>  Tue, 11 May 2021 20:30:00 -0400

python-urllib3 (1.26.2-1) unstable; urgency=medium

  * New upstream version 1.26.2
  * Refresh patches.
  * debian/control
    - Bump debhelper compatibility level to 13.
    - Bump Standards-Version to 4.5.1 (no changes needed).
  * debian/copyright
    - Update copyright years.
  * debian/rules
    - Ignore test_ssltransport.py.
  * debian/watch
    - Bump version to 4.

 -- Daniele Tricoli <eriol@debian.org>  Thu, 31 Dec 2020 02:22:32 +0100

python-urllib3 (1.25.11-1) unstable; urgency=medium

  * Team upload.

  [ Ondřej Nový ]
  * d/control: Update Maintainer field with new Debian Python Team
    contact address.
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Dmitry Shachnev ]
  * New upstream release.
  * Refresh patches for the new release.
  * Skip test_respect_retry_after_header_sleep test.
    It needs pytest-freezegun module which is not packaged in Debian yet.

 -- Dmitry Shachnev <mitya57@debian.org>  Sat, 14 Nov 2020 15:40:30 +0300

python-urllib3 (1.25.9-1) unstable; urgency=medium

  * Team upload
  * New upstream release
    - Refresh patches

 -- Scott Kitterman <scott@kitterman.com>  Sat, 02 May 2020 13:14:11 -0400

python-urllib3 (1.25.8-2) unstable; urgency=medium

  * Drop python2 support; Closes: #938244
  * debian/control
    - bump versioned b-d on six to >= 1.12.0 (the same version of the embedded
      module); Closes: #950738

 -- Sandro Tosi <morph@debian.org>  Wed, 01 Apr 2020 11:35:50 -0400

python-urllib3 (1.25.8-1) unstable; urgency=medium

  * Team upload.

  [ Debian Janitor ]
  * Use secure URI in Homepage field.
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Håvard Flaget Aasen ]
  * New upstream version 1.25.8
  * Rebase patches.
  * Update Standards-Version to 4.5.0
  * Remove python-nose and python3-nose from build-dependency.
  * Add Rules-Requires-Root: no
  * Remove test/conftest.py during build.

 -- Håvard Flaget Aasen <haavard_aasen@yahoo.no>  Sat, 25 Jan 2020 15:56:27 +0100

python-urllib3 (1.25.6-5) unstable; urgency=medium

  * Team upload.
  * debian/control
    - remove psutil from b-d, nothing in urllib3 uses that module

 -- Sandro Tosi <morph@debian.org>  Thu, 09 Jan 2020 20:45:05 -0500

python-urllib3 (1.25.6-4) unstable; urgency=medium

  * Upload to unstable (Closes: #945883)

 -- Daniele Tricoli <eriol@debian.org>  Thu, 05 Dec 2019 01:11:15 +0100

python-urllib3 (1.25.6-3) experimental; urgency=medium

  * debian/rules
    - Export LC_ALL=C.UTF-8 to build tests also using pbuilder.
      Thanks to Andreas Beckmann for the report and suggestion.
      (Closes: #945450)

 -- Daniele Tricoli <eriol@debian.org>  Mon, 02 Dec 2019 23:20:06 +0100

python-urllib3 (1.25.6-2) experimental; urgency=medium

  * debian/control
    - Add python{,3}-idna to B-D. (Closes: #943510)

 -- Daniele Tricoli <eriol@debian.org>  Sun, 27 Oct 2019 14:28:10 +0100

python-urllib3 (1.25.6-1) experimental; urgency=medium

  * Team upload.

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.
  * Bump Standards-Version to 4.4.0.

  [ Drew Parsons ]
  * New upstream release.
    - fixes CVE-2019-11236 CRLF injection vulnerability.
      Closes: #927172.
  * Standards-Version: 4.4.1
  * debhelper compatibility level 12

 -- Drew Parsons <dparsons@debian.org>  Sat, 12 Oct 2019 11:50:26 +0800

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python3-urllib3`.
