ruby-rack (3.2.6-3) unstable; urgency=medium

  * Team upload.
  * Add minitest-must-raise-correctly.patch to cherry-pick upstream commit
    fixing test failure (Closes: #1143406).

 -- Simon Quigley <tsimonq2@debian.org>  Sun, 02 Aug 2026 10:01:43 -0500

ruby-rack (3.2.6-2) unstable; urgency=medium

  * Upload to unstable

 -- Antonio Terceiro <terceiro@debian.org>  Wed, 08 Apr 2026 18:22:53 -0300

ruby-rack (3.2.6-1) experimental; urgency=medium

  * Team upload.
  * New upstream version 3.2.6

 -- Antonio Terceiro <terceiro@debian.org>  Wed, 01 Apr 2026 16:21:57 -0300

ruby-rack (3.2.5-2) unstable; urgency=medium

  * Team upload.
  * Add breaks on version of ruby-actionpack that doesn't work with rack 3.2
    (Closes: #1131916).

 -- Antonio Terceiro <terceiro@debian.org>  Wed, 01 Apr 2026 15:46:47 -0300

ruby-rack (3.2.5-1) unstable; urgency=medium

  * New upstream version 3.2.5.
    - CVE-2026-25500: XSS injection via malicious filename
      in `Rack::Directory`. (Closes: #1128480)
    - CVE-2026-22860: Directory traversal via root prefix
      bypass in `Rack::Directory`. (Closes: #1128479)

 -- Utkarsh Gupta <utkarsh@debian.org>  Tue, 03 Mar 2026 18:15:24 +0530

ruby-rack (3.2.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
  * Update Standards-Version to 4.7.3, no changes needed.

 -- Simon Quigley <tsimonq2@debian.org>  Thu, 12 Feb 2026 11:36:06 -0600

ruby-rack (3.1.18-1) unstable; urgency=medium

  * New upstream version 3.1.18.
    - CVE-2025-61772: Multipart parser buffers unbounded per-part headers,
      enabling DoS (memory exhaustion).
    - CVE-2025-61771: Multipart parser buffers large non‑file fields
      entirely in memory, enabling DoS (memory exhaustion).
    - CVE-2025-61770: Unbounded multipart preamble buffering enables DoS
      (memory exhaustion).
    - CVE-2025-61780 Improper handling of headers in Rack::Sendfile may
      allow proxy bypass.
    - CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead
      to memory exhaustion.
    - Closes: #1117855, #1117856, #1117627, #1117628

 -- Utkarsh Gupta <utkarsh@debian.org>  Wed, 22 Oct 2025 08:52:58 +0100

ruby-rack (3.1.16-0.1) unstable; urgency=medium

  * Non-maintainer upload
  * New upstream version 3.1.16 (Closes: #1104927, #1107363),
    fixes CVE-2025-46727, CVE-2025-49007
  * Remove ruby-bacon from autopkgtests (Closes: #1109027)

 -- Bastian Germann <bage@debian.org>  Tue, 15 Jul 2025 18:00:20 +0200

ruby-rack (3.1.12-1) unstable; urgency=medium

  * Team upload
  * New upstream version 3.1.12
  * Drop obsolete B-Ds

 -- Blair Noctis <ncts@debian.org>  Wed, 19 Mar 2025 15:53:01 +0000

ruby-rack (3.1.9-2) unstable; urgency=medium

  * Re-upload to unstable.

 -- Utkarsh Gupta <utkarsh@debian.org>  Fri, 07 Mar 2025 14:13:53 +0530

ruby-rack (3.1.9-1~exp1) experimental; urgency=medium

  * New upstream version 3.1.9
  * Declare compliance with Debian Policy 4.7.0.

 -- Lucas Kanashiro <kanashiro@debian.org>  Tue, 11 Feb 2025 10:20:49 -0300

ruby-rack (3.0.8-4) unstable; urgency=medium

  * Add Breaks on pre-rack3 ruby-adsf

 -- Antonio Terceiro <terceiro@debian.org>  Wed, 05 Feb 2025 12:30:11 -0300

ruby-rack (3.0.8-3) unstable; urgency=medium

  * Add Breaks: against package versions that don't work with rack 3

 -- Antonio Terceiro <terceiro@debian.org>  Tue, 04 Feb 2025 20:35:02 -0300

ruby-rack (3.0.8-2) unstable; urgency=medium

  * Re-upload to unstable.

 -- Utkarsh Gupta <utkarsh@debian.org>  Tue, 28 Jan 2025 12:07:16 +0100

ruby-rack (3.0.8-1) experimental; urgency=medium

  * New upstream release.
  * Declare compliance with Debian Policy 4.6.2
  * d/p/skip-random-failure.patch: removed, it does not seem to be failing
    anymore.

 -- Lucas Kanashiro <kanashiro@debian.org>  Mon, 26 Jun 2023 17:35:11 -0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog ruby-rack`.
