python-urllib3 (2.7.0-3) unstable; urgency=medium

  * Team upload.
  * Replace deprecated pyOpenSSL X509.get_subject and Context.set_passwd_cb
    methods (closes: #1142214).

 -- Colin Watson <cjwatson@debian.org>  Tue, 21 Jul 2026 10:09:40 +0100

python-urllib3 (2.7.0-2) unstable; urgency=medium

  * Team upload.
  * Salsa CI: test nocheck profile
  * Mark python3-h2 build-dep as <!nocheck>
  * Rewrite d/watch in v5 format
  * Update standards version to 4.7.4, no changes needed.
  * Set upstream metadata fields: Documentation.

 -- Alexandre Detiste <tchet@debian.org>  Sun, 12 Jul 2026 17:23:46 +0200

python-urllib3 (2.7.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream release:
    - CVE-2026-44432, CVE-2026-9375: Decompression-bomb safeguards bypassed
      in parts of the streaming API (closes: #1136654, #1140427).
    - GHSA-qccp-gfcp-xxvc: Sensitive headers forwarded across origins in
      proxied low-level redirects.
  * Don't parameterize tests using non-Collection iterables
    (Closes: #1140932).

 -- Colin Watson <cjwatson@debian.org>  Sun, 28 Jun 2026 17:48:21 +0100

python-urllib3 (2.6.3-2) unstable; urgency=medium

  * Team upload.
  * Add python3-supported-min alternative for backports.zstd (see #1130913).

 -- Colin Watson <cjwatson@debian.org>  Wed, 18 Mar 2026 12:38:29 +0000

python-urllib3 (2.6.3-1) unstable; urgency=medium

  * Team upload.
  * New upstream release:
    - CVE-2025-66471: Fixed a security issue where streaming API could
      improperly handle highly compressed HTTP content ("decompression
      bombs") leading to excessive resource consumption even when a small
      amount of data was requested.  Reading small chunks of compressed data
      is safer and much more efficient now (closes: #1122029).
    - Fixed HTTPResponse.read_chunked() to properly handle leftover data in
      the decoder's buffer when reading compressed chunked responses
      (closes: #1122743).
  * Bump Build-Depends/Suggests on python3-brotli to >= 1.2.0 to improve the
    fix for CVE-2025-66418.

 -- Colin Watson <cjwatson@debian.org>  Fri, 06 Feb 2026 00:37:49 +0000

python-urllib3 (2.5.0-2) unstable; urgency=medium

  * Team upload.

  [ Salvatore Bonaccorso ]
  * Fix security issue where decompression-bomb safeguards of the
    streaming API were bypassed when HTTP redirects were followed.
    (CVE-2026-21441) (Closes: #1125062)

  [ Santiago Vila ]
  * Drop debian/.gitignore, dpkg-buildpackage dislikes it.
  * d/control: Drop "Rules-Requires-Root: no" (default).
  * d/control: Drop "Priority: optional" (default).
  * d/control: Update standards-version.

 -- Santiago Vila <sanvila@debian.org>  Sat, 10 Jan 2026 18:20:00 +0100

python-urllib3 (2.5.0-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Unbounded number of links in the decompression chain (CVE-2025-66418)
    (Closes: #1122030)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 03 Jan 2026 20:00:44 +0100

python-urllib3 (2.5.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.

 -- Colin Watson <cjwatson@debian.org>  Mon, 18 Aug 2025 11:19:44 +0100

python-urllib3 (2.3.0-3) unstable; urgency=medium

  * Team upload.
  * CVE-2025-50181: Fix a security issue where restricting the maximum
    number of followed redirects at the `urllib3.PoolManager` level via the
    `retries` parameter did not work (closes: #1108076).
  * CVE-2025-50182: Make the Node.js runtime respect redirect parameters
    such as `retries` and `redirects` (closes: #1108077).

 -- Colin Watson <cjwatson@debian.org>  Sun, 13 Jul 2025 14:09:35 +0200

python-urllib3 (2.3.0-2) unstable; urgency=medium

  * Team upload.
  * Ensure compatibility with httpx>=0.28 (closes: #1099277).

 -- Colin Watson <cjwatson@debian.org>  Wed, 12 Mar 2025 11:20:41 +0000

python-urllib3 (2.3.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
  * SingleTLSLayerTestCase: Catch BrokenPipeError.

 -- Colin Watson <cjwatson@debian.org>  Fri, 17 Jan 2025 13:54:06 +0000

python-urllib3 (2.2.3-4) unstable; urgency=medium

  * Team upload.
  * Mark package "Multi-Arch: foreign" (Closes: #1078034)

 -- Alexandre Detiste <tchet@debian.org>  Wed, 11 Dec 2024 13:16:51 +0100

python-urllib3 (2.2.3-3) unstable; urgency=medium

  * Team upload.
  * Upload to unstable.

 -- Colin Watson <cjwatson@debian.org>  Fri, 29 Nov 2024 16:38:06 +0000

python-urllib3 (2.2.3-2) experimental; urgency=medium

  * Team upload.
  * Mark test_http2_probe_blocked_per_thread with requires_network.

 -- Colin Watson <cjwatson@debian.org>  Tue, 12 Nov 2024 23:59:17 +0000

python-urllib3 (2.2.3-1) experimental; urgency=medium

  * Team upload.
  * New upstream release:
    - CVE-2024-37891: Added the Proxy-Authorization header to the list of
      headers to strip from requests when redirecting to a different host
      (closes: #1074149).
    - Added support for Python 3.13 (closes: #1082278).
  * Temporarily vendor hypercorn, since urllib3 needs a patched version for
    its tests (commit d1719f8c1570cbd8e6a3719ffdb14a4d72880abb; see
    https://github.com/urllib3/urllib3/issues/3334; closes: #1086794).

 -- Colin Watson <cjwatson@debian.org>  Sun, 10 Nov 2024 23:57:18 +0000

python-urllib3 (2.0.7-2) unstable; urgency=medium

  * Team upload.
  * Remove build & autopkgtest dependency on python3-mock
  * Disable a test that compare today's date against some "expiry date".
  * Patch: add a patch from upstream to handle new Exception strings.

 -- Alexandre Detiste <tchet@debian.org>  Wed, 12 Jun 2024 20:04:48 +0200

python-urllib3 (2.0.7-1) experimental; urgency=medium

  [ Stefano Rivera ]
  * New upstream release.
  * Drop six patch and dependency on python3-six, superseded upstream.
    (Closes: #1025218, LP: #1897633)
  * Drop bundled backports.makefile from copyright, removed upstream.
  * Build with pybuild pyproject plugin.
  * Mark Build-Depends with nocheck.
  * Re-enable the full test suite.
  * Patch: Handle ConnectionRefusedError in test.requires_network()
  * Patch: Mark tests that require network
  * Patch: Don't make requests to evil.com in tests.
  * Export CI=1 in tests, to increase timeouts.
  * Allow stderr in the autopkgtest.
  * Patch: Skip expensive integration tests, that often cause timeouts.

 -- Daniele Tricoli <eriol@debian.org>  Sun, 12 Nov 2023 23:57:09 +0100

python-urllib3 (1.26.18-2) unstable; urgency=medium

  * Team upload.
  * Patch: Fix tests under Python 3.12. (Closes: #1056511)

 -- Stefano Rivera <stefanor@debian.org>  Sun, 21 Jan 2024 15:46:13 -0400

python-urllib3 (1.26.18-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - Fix CVE-2023-45803 (Closes: #1054226)
  * Drop patch 02_require-cert-verification.patch, no longer needed.
    (Closes: #1054212)
  * Refresh patches.

 -- Stefano Rivera <stefanor@debian.org>  Sat, 21 Oct 2023 17:05:33 +0200

python-urllib3 (1.26.17-1) unstable; urgency=medium

  * New upstream version 1.26.17
    - Fix CVE-2023-43804 (Closes: #1053626).
  * Refresh patches.

 -- Daniele Tricoli <eriol@debian.org>  Tue, 10 Oct 2023 02:32:39 +0200

python-urllib3 (1.26.16-1) unstable; urgency=medium

  * New upstream version 1.26.16
  * Refresh patches.
  * debian/control
    - Update standards version to 4.6.2, no changes needed.
  * debian/copyright
    - Update copyright years.

 -- Daniele Tricoli <eriol@debian.org>  Fri, 30 Jun 2023 01:10:18 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python3-urllib3`.
