ruby-rack (2.2.7-1ubuntu0.7) noble-security; urgency=medium

  * SECURITY UPDATE: Security bypass in multipart parser
    - debian/patches/CVE-2026-26961.patch: Disallow boundary whitespace in
      lib/rack/multipart/parser.rb
    - CVE-2026-26961
  * SECURITY UPDATE: Denial of service in select_best_encoding
    - debian/patches/CVE-2026-34230.patch: Disregard subsequent wildcards
      when an acceptable encoding has been selected in lib/rack/utils.rb
    - CVE-2026-34230
  * SECURITY UPDATE: Permissive regular expression in Directory
    - debian/patches/CVE-2026-34763.patch: Escape root before evaluating regex
      in lib/rack/directory.rb
    - CVE-2026-34763
  * SECURITY UPDATE: Information disclosure in Static
    - debian/patches/CVE-2026-34785.patch: Check that paths start with the
      static root prefix rather than merely containing them in
      lib/rack/static.rb
    - CVE-2026-34785
  * SECURITY UPDATE: Security bypass in applicable_rules
    - debian/patches/CVE-2026-34786.patch: Decode path before parsing to avoid
      bypassing header rules in lib/rack/static.rb
    - CVE-2026-34786
  * SECURITY UPDATE: Denial of service in byte_ranges
    - debian/patches/CVE-2026-34826.patch: Add a max_ranges argument to
      byte_ranges in lib/rack/utils.rb
    - CVE-2026-34826
  * SECURITY UPDATE: Denial of service in Parser
    - debian/patches/CVE-2026-34829.patch: Set maximum value for
      content-length in lib/rack/multipart/parser.rb
    - CVE-2026-34829
  * SECURITY UPDATE: Permissive regular expression in map_accel_path
    - debian/patches/CVE-2026-34830.patch: Escape X-Accel-Mapping before
      interpreting as regular expression in lib/rack/sendfile.rb
    - CVE-2026-34830
  * SECURITY UPDATE: Improper handling of length in fail
    - debian/patches/CVE-2026-34831.patch: Set content-length to byte size
      rather than UTF-8 length in lib/rack/files.rb
    - CVE-2026-34831

 -- Kyle Kernick <kyle.kernick@canonical.com>  Thu, 09 Apr 2026 09:57:37 -0600

ruby-rack (2.2.7-1ubuntu0.6) noble-security; urgency=medium

  * SECURITY UPDATE: Directory Traversal Attack
    - debian/patches/CVE-2026-22860.patch: Prevent directory traversal
      via root prefix bypass
    - CVE-2026-22860
  * SECURITY UPDATE: XSS Injection
    - debian/patches/CVE-2026-25500.patch: Stop XSS injection via malicious
      filename in `Rack::Directory`
    - CVE-2026-25500

 -- Bruce Cable <bruce.cable@canonical.com>  Mon, 23 Feb 2026 10:20:36 +1100

ruby-rack (2.2.7-1ubuntu0.5) noble-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - d/p/CVE-2025-61770-and-CVE-2025-61772.patch: Enforce a size limit for
      the preamble and multipart mime part header 
    - d/p/CVE-2025-61771.patch: Limit amount of retained data when parsing
      multipart requests
    - CVE-2025-61770
    - CVE-2025-61772
    - CVE-2025-61771

  * SECURITY UPDATE: Information discloure using proxy bypass
    - debian/patches/CVE-2025-61780.patch: Fix handling of proxy headers
      (`HTTP_X_SENDFILE_TYPE` and `HTTP_X_ACCEL_MAPPING`) in Rack::Sendfile
    - CVE-2025-61780 

  * SECURITY UPDATE: Denial of service through memory exhaustion
    - debian/patches/CVE-2025-61919.patch: Enforce form parameter limit
      using `query_parser.bytesize_limit` preventing unbounded read of 
      `application/x-www-form-urlencoded` bodies
    - CVE-2025-61919

 -- Shishir Subedi <shishir.subedi@canonical.com>  Mon, 01 Dec 2025 13:38:28 +0545

ruby-rack (2.2.7-1ubuntu0.4) noble-security; urgency=medium

  * SECURITY UPDATE: params_limit bypass using semicolon
    - debian/patches/CVE-2025-59830.patch: also count semicolons in
      lib/rack/query_parser.rb, test/spec_query_parser.rb.
    - CVE-2025-59830

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 26 Sep 2025 12:41:09 -0400

ruby-rack (2.2.7-1ubuntu0.3) noble-security; urgency=medium

  * SECURITY UPDATE: Race condition with authentication sessions.
    - debian/patches/CVE-2025-32441.patch: Add get_session_with_fallback()
      check and pool.store in ./lib/rack/session/pool.rb.
    - CVE-2025-32441
  * SECURITY UPDATE: Denial of service through large query parameters.
    - debian/patches/CVE-2025-46727.patch: Add query parameter limit and
      bytesize limit and corresponding checks in ./lib/rack/query_parser.rb.
    - CVE-2025-46727

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 08 May 2025 15:58:56 -0230

ruby-rack (2.2.7-1ubuntu0.2) noble-security; urgency=medium

  * SECURITY UPDATE: injection vulnerabilities
    - debian/patches/CVE-2025-25184.patch: Escape non-printable
      characters when logging.
    - debian/patches/CVE-2025-27111.patch: Use `#inspect` to prevent log
      injection.
    - CVE-2025-25184
    - CVE-2025-27111
  * SECURITY UPDATE: path traversal vulnerability
    - debian/patches/CVE-2025-27610.patch: Use a fully resolved file
      path when confirming if a file can be served by `Rack::Static`.
    - CVE-2025-27610

 -- Shishir Subedi <shishir.subedi@canonical.com>  Fri, 14 Mar 2025 11:30:30 +0545

ruby-rack (2.2.7-1ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: DoS via crafted content type headers
    - debian/patches/CVE-2024-25126.patch: avoid 2nd degree polynomial
      regexp in MediaType in lib/rack/media_type.rb.
    - CVE-2024-25126
  * SECURITY UPDATE: DoS via crafted Range headers
    - debian/patches/CVE-2024-26141.patch: return an empty array when
      ranges are too large in lib/rack/utils.rb, test/spec_utils.rb.
    - CVE-2024-26141
  * SECURITY UPDATE: Dos via crafted headers
    - debian/patches/CVE-2024-26146.patch: fix ReDoS in header parsing in
      lib/rack/utils.rb.
    - CVE-2024-26146

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 14 Jun 2024 13:15:36 -0400

ruby-rack (2.2.7-1) unstable; urgency=medium

  * Team Upload
  * New upstream version 2.2.7

 -- Pirate Praveen <praveen@debian.org>  Mon, 10 Jul 2023 20:02:41 +0530

ruby-rack (2.2.6.4-1) unstable; urgency=medium

  * Team Upload
  * New upstream version 2.2.6.4 (Fixes: CVE-2023-27530, CVE-2023-27539)
  * Refresh patches (remove patches applied upstream)

 -- Pirate Praveen <praveen@debian.org>  Fri, 24 Mar 2023 01:32:43 +0530

ruby-rack (2.2.4-3) unstable; urgency=high

  * Team upload
  * Fix test failures (Closes:  #1030442)
  * Fix CVE-2022-44570 CVE-2022-44571 CVE-2022-44572 (Closes:  #1029832)
  * Add Breaks for ruby-sinatra

 -- Sruthi Chandran <srud@debian.org>  Thu, 09 Feb 2023 11:47:17 +0100

ruby-rack (2.2.4-2) unstable; urgency=medium

  * Team Upload
  * eliminate lintian warning: ruby-interpreter-is-deprecated
  * eliminate lintian warning: update-debian-copyright

 -- HIGUCHI Daisuke (VDR dai) <dai@debian.org>  Tue, 09 Aug 2022 11:57:23 +0900

ruby-rack (2.2.4-1) unstable; urgency=medium

  * Team Upload
  * New upstream version 2.2.4 (Fixes: CVE-2022-30122, CVE-2022-30123)
  * Bump Standards-Version to 4.6.1 (no changes needed)

 -- Pirate Praveen <praveen@debian.org>  Fri, 01 Jul 2022 11:59:23 +0530

ruby-rack (2.2.3-4) unstable; urgency=medium

  * Add ruby-webrick as an explicit dependency.
    - it's not embedded as of ruby3.0. (:

 -- Utkarsh Gupta <utkarsh@debian.org>  Mon, 24 Jan 2022 18:45:39 +0530

ruby-rack (2.2.3-3) unstable; urgency=medium

  * Reupload to unstable

 -- Pirate Praveen <praveen@debian.org>  Mon, 24 Jan 2022 16:37:33 +0530

ruby-rack (2.2.3-2) experimental; urgency=medium

  * Team Upload
  * Merge changes from master branch
  * Refresh patches
  * Update watch file standard to 4

 -- Pirate Praveen <praveen@debian.org>  Mon, 24 Jan 2022 14:00:19 +0530

ruby-rack (2.1.4-5) unstable; urgency=medium

  * Team upload
  * Switch to gem-install layout for bundle --local compatibility

 -- Pirate Praveen <praveen@debian.org>  Mon, 24 Jan 2022 00:48:23 +0530

ruby-rack (2.1.4-4) unstable; urgency=medium

  * Team upload

  [ Debian Janitor ]
  * Remove constraints unnecessary since buster

  [ Cédric Boutillier ]
  * Build-depend on ruby-webrick (Closes: #996353)
  * Bump debhelper compatibility level to 13
  * Bump Standards-Version to 4.6.0 (no changes needed)

 -- Cédric Boutillier <boutil@debian.org>  Wed, 17 Nov 2021 11:49:13 +0100

ruby-rack (2.1.4-3) unstable; urgency=medium

  * Team upload.
  * Fix tests when run on ipv6-only hosts (Closes: #979432)

 -- Antonio Terceiro <terceiro@debian.org>  Sat, 27 Feb 2021 09:30:57 -0300

ruby-rack (2.2.3-1) experimental; urgency=medium

  * Team upload
  * New upstream version 2.2.3
  * Refresh patches

 -- Pirate Praveen <praveen@debian.org>  Sat, 30 Jan 2021 15:29:45 +0530

ruby-rack (2.1.4-2) unstable; urgency=medium

  * Revert "Drop all patches"
    - Rack::Builder::parse_file#test_0006_strips
      leading unicode byte order mark when present still
      fails in i386 and stuff. Meh, I'll take a look later.

 -- Utkarsh Gupta <utkarsh@debian.org>  Sun, 03 Jan 2021 17:49:29 +0530

ruby-rack (2.1.4-1) unstable; urgency=medium

  [ Pirate Praveen ]
  * New upstream version 2.1.4
  * Bump Standards-Version to 4.5.1 (no changes needed)
  * Drop patches applied upstream

  [ Utkarsh Gupta ]
  * Drop all patches

 -- Utkarsh Gupta <utkarsh@debian.org>  Sun, 03 Jan 2021 17:25:43 +0530

ruby-rack (2.1.1-6) unstable; urgency=medium

  [ Cédric Boutillier ]
  * [ci skip] Update team name
  * [ci skip] Add .gitattributes to keep unwanted files out
    of the source package

  [ Debian Janitor ]
  * Apply multi-arch hints. + ruby-rack: Add :all qualifier
    for ruby dependency.

  [ Utkarsh Gupta ]
  * When parsing cookies, only decode the values.
    Patch utils to fix cookie parsing. (Fixes: CVE-2020-8184)
    (Closes: #963477)

 -- Utkarsh Gupta <utkarsh@debian.org>  Sat, 02 Jan 2021 17:42:02 +0530

ruby-rack (2.1.1-5) unstable; urgency=medium

  * Add patch to use Dir.entries instead of Dir[glob] to prevent
    user-specified glob metacharacters (Fixes: CVE-2020-8161)

 -- Utkarsh Gupta <utkarsh@debian.org>  Thu, 21 May 2020 17:06:27 +0530

ruby-rack (2.1.1-4) unstable; urgency=medium

  * Remove ruby-minitest-global-expectations from Depends
  * Add ruby-minitest-global-expectations for tests

 -- Utkarsh Gupta <utkarsh@debian.org>  Fri, 10 Apr 2020 18:37:00 +0530

ruby-rack (2.1.1-3) unstable; urgency=medium

  * Add patch to skip random failure
    (probably fixed in later upstream version)

 -- Utkarsh Gupta <utkarsh@debian.org>  Fri, 10 Apr 2020 04:21:09 +0530

ruby-rack (2.1.1-2) unstable; urgency=medium

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Utkarsh Gupta ]
  * Shoot to unstable
  * Enable tests :D
  * Add BD on ruby-minitest-global-expectations
  * Add runtime dependency on ruby-minitest-global-expectations
  * Fix package wrt cme
  * Use AUTOPKGTEST_TMP in tests as ADTTMP is deprecated
  * Add myself as an uploader
  * Add Rules-Requires-Root: no
  * Add Breaks for ruby-rack-oauth2

 -- Utkarsh Gupta <utkarsh@debian.org>  Fri, 10 Apr 2020 03:43:38 +0530

ruby-rack (2.1.1-1) experimental; urgency=medium

  * Team upload
  * New upstream version 2.1.1
  * Bump Standards-Version to 4.4.1 (no changes needed)
  * Switch test to minitest (but disable tests because build deps not packaged)
  * Switch to github tarballs for tests
  * Upload to experimental because autopkgtest for berkshelf-api coquelicot
    nanoc rails redmine ruby-acts-as-api ruby-faye ruby-grape ruby-moneta
    ruby-omniauth ruby-rack-attack ruby-rack-oauth2 ruby-rack-openid
    ruby-voight-kampff failed and rebuilds of berkshelf-api coquelicot nanoc
    redmine ruby-grape ruby-omniauth ruby-rack-oauth2 ruby-warden failed

 -- Pirate Praveen <praveen@debian.org>  Sun, 12 Jan 2020 20:00:24 +0530

ruby-rack (2.0.7-2) unstable; urgency=medium

  * Team upload
  * Re-upload to unstable
  * Add salsa-ci.yml
  * Bump Standards-Version to 4.4.0
  * Bump debhelper-compat to 12

 -- Utkarsh Gupta <guptautkarsh2102@gmail.com>  Tue, 03 Sep 2019 00:22:18 +0530

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog ruby-rack`.
