squid (6.13-1ubuntu4) questing; urgency=medium

  * SECURITY UPDATE: ASN.1 encoding mishandling
    - debian/patches/CVE-2025-59362.patch: fix ASN.1 encoding of long SNMP
      OIDs in lib/snmplib/asn1.c.
    - CVE-2025-59362

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 03 Oct 2025 09:30:30 -0400

squid (6.13-1ubuntu3) questing; urgency=medium

  * lp-2125118-*: Fix FTBFS with GCC-15 (LP: #2125118)

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Thu, 18 Sep 2025 15:59:23 +0200

squid (6.13-1ubuntu2) questing; urgency=medium

  * No-change rebuild for libxml2 soname change.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 20 May 2025 12:24:33 +0200

squid (6.13-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2097411). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/rules: Add apport hook (LP #676141)
  * Dropped changes:
    - d/p/0011-Fix-uninitialized-end-variable.patch: Fix FTBFS on
      uninitialized variable by adding null ptr checking.
      (LP: #2093295)
      [ Fixed in 6.13 ]

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Mon, 17 Feb 2025 15:54:27 -0300

squid (6.13-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.13 (Closes: #956581)

    - update for new upstream release location

  * debian/squid{,-openssl}.alternatives
    - switch alternatives priority (Closes: #1086537)

  * debian/squid.tmpfile
    - fix warning: The name debian/squid.tmpfile is deprecated
      please use debian/squid.tmpfiles instead

  * debian/NEWS
    - fix lintian warning syntax-error-in-debian-news-file

 -- Luigi Gangitano <luigi@debian.org>  Tue, 11 Feb 2025 12:35:20 +0100

squid (6.12-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.12 (Closes: #1063877)

  * Disable ESI feature support
    Fixes: CVE-2024-45802. SQUID-2024:4

  * debian/{control,rules}
    - Migrate from lsb-release to os-release.
    - Remove deprecated lsb-base dependency. It has been
      replaced by sysvinit-utils in essential packages.
    - Polish user visible package descriptions.
    - Restructure rules special-cases for easier team maintenance.

  * Use alternatives system for squid binary

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/control
    - Add Rules-Requires-Root: binary-targets
    - Bumped Standards-Version to 4.7.0, no change needed

  * debian/patches/*
    - Refreshed patches
    - Added description to 0006-upstream-807ae4df2164defbb5f59b99282e24010b4a0b85.patch

  * debian/upstream/signing-key.asc
    - Added Francesco Chemolli's key to the authorized keys (Closes: #1084734)

  [ Sven Auhagen <sven.auhagen@voleatech.de> ]
  * debian/squid.postinst
    - Check if cache folder exists before using chown

 -- Luigi Gangitano <luigi@debian.org>  Mon, 28 Oct 2024 11:04:20 +0100

squid (6.10-1ubuntu2) plucky; urgency=medium

  * d/p/0011-Fix-uninitialized-end-variable.patch: Fix FTBFS on
    uninitialized variable by adding null ptr checking.
    (LP: #2093295)

 -- Bryce Harrington <bryce@canonical.com>  Wed, 08 Jan 2025 15:41:11 -0800

squid (6.10-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2073322). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/rules: Add apport hook (LP #676141)
  * Dropped changes:
    - d/t/upstream-test-suite: adjust autopkgtests following dpkg
      changes enabling ELF metadata. (LP #2071468)
      [ LP bug fixed in dpkg,binutils ]
    - SECURITY UPDATE: DoS in ESI processing using multi-byte characters
      + debian/patches/CVE-2024-37894.patch: fix variable datatype to handle
        variables names outside standard ASCII characters
      + CVE-2024-37894
      [ Fixed in 6.10 ]

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Thu, 12 Sep 2024 16:23:16 -0300

squid (6.10-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.10
    Fixes: CVE-2024-37894. SQUID-2024:3 (Closes: #1074284)

 -- Luigi Gangitano <luigi@debian.org>  Mon,  1 Jul 2024 12:04:20 +0200

squid (6.9-1ubuntu2) oracular; urgency=medium

  * SECURITY UPDATE: DoS in ESI processing using multi-byte characters
    - debian/patches/CVE-2024-37894.patch: fix variable datatype to handle
      variables names outside standard ASCII characters
    - CVE-2024-37894  

 -- Vyom Yadav <vyom.yadav@canonical.com>  Tue, 09 Jul 2024 23:17:30 +0530

squid (6.9-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064466). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/squid-common.install: Add apport hook
      (LP #676141)
  * Dropped changes:
    - SECURITY UPDATE: DoS via chunked decoder uncontrolled recursion bug
      + debian/patches/CVE-2024-25111.patch: fix infinite recursion in
        src/http.cc, src/http.h.
      + CVE-2024-25111
      [ Fixed in 6.8 ]
  * New changes:
    - d/t/upstream-test-suite: adjust autopkgtests following dpkg
      changes enabling ELF metadata. (LP: #2071468)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 02 Jul 2024 14:21:39 -0300

squid (6.9-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.9

 -- Luigi Gangitano <luigi@debian.org>  Tue,  9 Apr 2024 15:04:20 +0200

squid (6.8-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.8
    Fixes: CVE-2024-25111. SQUID-2024:1

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/control
    - Migrate from pkg-config to pkgconf

 -- Luigi Gangitano <luigi@debian.org>  Mon,  4 Mar 2024 18:04:20 +0100

squid (6.6-1ubuntu5) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 19:03:50 +1100

squid (6.6-1ubuntu4) noble; urgency=medium

  * SECURITY UPDATE: DoS via chunked decoder uncontrolled recursion bug
    - debian/patches/CVE-2024-25111.patch: fix infinite recursion in
      src/http.cc, src/http.h.
    - CVE-2024-25111

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 14 Mar 2024 10:36:04 -0400

squid (6.6-1ubuntu3) noble; urgency=medium

  * No-change rebuild against libcom-err2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 Mar 2024 20:34:17 +0000

squid (6.6-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 21:25:34 +0000

squid (6.6-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2055179). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/squid-common.install: Add apport hook
      (LP #676141)
  * Dropped changes:
    - SECURITY UPDATE: denial of service in HTTP request parsing
      - debian/patches/CVE-2023-50269.patch: limit x-forwarded-for hops and log
        limit as error when exceeded in src/ClientRequestContext.h,
        src/client_side_request.cc.
      - CVE-2023-50269
      [ Fixed upstream in 6.6 ]

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 27 Feb 2024 12:25:05 -0300

squid (6.6-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.6
    Fixes: CVE-2023-50269. SQUID-2023:10 (Closes: #1058721)
    Fixes: CVE-2024-23638. SQUID-2023:11

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/patches/
    - Refreshed patches

  * debian/squid-openssl.dirs
    - Stop creating empty /lib/systemd/system directory (Closes: #1058860)

  * debian/changelog
    - Fixed typo in CVE reference

 -- Luigi Gangitano <luigi@debian.org>  Thu, 18 Jan 2024 13:04:20 +0100

squid (6.5-1ubuntu3) noble; urgency=medium

  * SECURITY UPDATE: denial of service in HTTP request parsing
    - debian/patches/CVE-2023-50269.patch: limit x-forwarded-for hops and log
      limit as error when exceeded in src/ClientRequestContext.h,
      src/client_side_request.cc.
    - CVE-2023-50269

 -- Evan Caville <evan.caville@canonical.com>  Thu, 25 Jan 2024 15:41:32 +1000

squid (6.5-1ubuntu2) noble; urgency=medium

  * d/source_squid.py, d/rules: Add apport hook
    (LP: #676141)

 -- Bryce Harrington <bryce@canonical.com>  Thu, 18 Jan 2024 15:13:36 -0800

squid (6.5-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040426). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
  * Dropped changes:
    - d/t/upstream-test-suite: make missing targets for squid 6.
      [ Fixed in Debian in 6.5-1 ]
    - d/p/0011-Fix-ftp-support.patch: Fix pure virtual call in
      Ftp::Client constructor leading to problems in FTP support.
      [ Fixed upstream in 6.2 ]
    - SECURITY UPDATE: DoS against certificate validation
      + debian/patches/CVE-2023-46724.patch: fix validation of certificates
        with CN=* in src/anyp/Uri.cc.
      + CVE-2023-46724
      [ Fixed in Debian in 6.5-1 ]
    - SECURITY UPDATE: HTTP request smuggling, caused by chunked decoder
      lenience
      + debian/patches/CVE-2023-46846.patch: improve HTTP chunked encoding
        compliance in src/http/one/Parser.cc, src/http/one/Parser.h,
        src/http/one/TeChunkedParser.cc, src/parser/Tokenizer.cc,
        src/parser/Tokenizer.h.
      + CVE-2023-46846
      [ Fixed in Debian in 6.5-1 ]
    - SECURITY UPDATE: DoS via HTTP Digest Authentication
      + debian/patches/CVE-2023-46847.patch: fix stack buffer overflow when
        parsing Digest Authorization in src/auth/digest/Config.cc.
      + CVE-2023-46847
      [ Fixed in Debian in 6.5-1 ]
    - SECURITY UPDATE: DoS via ftp:// URLs
      + debian/patches/CVE-2023-46848.patch: fix userinfo percent-encoding in
        src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc,
        src/anyp/Uri.cc.
      + CVE-2023-46848
      [ Fixed in Debian in 6.5-1 ]

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 12 Dec 2023 12:05:40 -0300

squid (6.5-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.5
    Fixes: CVE-2023-46846. SQUID-2023:1 (Closes: #1054537)
    Fixes: CVE-2023-5824. SQUID-2023:2 (Closes: #1055249)
    Fixes: CVE-2023-46847. SQUID-2023:3 (Closes: #1055250)
    Fixes: CVE-2023-46724. SQUID-2023:4 (Closes: #1055252)
    Fixes: CVE-2023-46848. SQUID-2023:5 (Closes: #1055251)
    Fixes: CVE-2019-18860. SQUID-2023:6
    Fixes: CVE-2023-49285. SQUID-2023:7
    Fixes: CVE-2023-49286. SQUID-2023:8
    Fixes: CVE-2024-25617. SQUID-2024:2

  * Update debian/tests/upstream-test-suite for new version (Closes: #1053557)

 -- Luigi Gangitano <luigi@debian.org>  Thu,  9 Nov 2023 15:04:20 +0100

squid (6.3-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream version 6.3 (Closes: #1049926, #1043505)

  * debian/patches/
    - remove 0007-ftbfs-gnu-hurd.patch integrated upstream

 -- Luigi Gangitano <luigi@debian.org>  Thu, 28 Sep 2023 16:04:20 +0200

squid (6.1-2ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: DoS against certificate validation
    - debian/patches/CVE-2023-46724.patch: fix validation of certificates
      with CN=* in src/anyp/Uri.cc.
    - CVE-2023-46724
  * SECURITY UPDATE: HTTP request smuggling, caused by chunked decoder
    lenience
    - debian/patches/CVE-2023-46846.patch: improve HTTP chunked encoding
      compliance in src/http/one/Parser.cc, src/http/one/Parser.h,
      src/http/one/TeChunkedParser.cc, src/parser/Tokenizer.cc,
      src/parser/Tokenizer.h.
    - CVE-2023-46846
  * SECURITY UPDATE: DoS via HTTP Digest Authentication
    - debian/patches/CVE-2023-46847.patch: fix stack buffer overflow when
      parsing Digest Authorization in src/auth/digest/Config.cc.
    - CVE-2023-46847
  * SECURITY UPDATE: DoS via ftp:// URLs
    - debian/patches/CVE-2023-46848.patch: fix userinfo percent-encoding in
      src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc,
      src/anyp/Uri.cc.
    - CVE-2023-46848

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 13 Nov 2023 08:41:30 -0500

squid (6.1-2ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018110). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules, d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
  * Drop changes:
    - d/p/fix-max-pkt-sz-for-icmpEchoData-padding.patch: Adjust
      MAX_PKT{4,6}_SZ to account for icmpEchoData padding, fixing FTBFS
      with GCC 11 (LP #1939352).
      [ Applied upstream in 6.0.1 ]
    - d/p/series: do not rely on installed binaries for build time tests.
      [ Applied in 6.1-1 ]
    - d/rules: disable LTO related compilation errors for s390x builds.
      [ Fixed in 6.1-1 ]
  * New changes:
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/p/0011-Fix-ftp-support.patch: Fix pure virtual call in
      Ftp::Client constructor leading to problems in FTP support.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/t/upstream-test-suite: make missing targets for squid 6.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 15 Aug 2023 21:51:44 -0300

squid (6.1-2) unstable; urgency=low

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * debian/patches/
   - add 0007-ftbfs-gnu-hurd.patch to fix GNU/Hurd build

 -- Luigi Gangitano <luigi@debian.org>  Thu, 13 Jul 2023 13:04:20 +0200

squid (6.1-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * debian/{control,watch}
    - New Upstream Release

  * debian/patches/
    - refresh for new upstream version
    - add 0006-upstream-807ae4df2164defbb5f59b99282e24010b4a0b85.patch
    - remove 0003-installed-binary-for-debian-ci.patch integrated upstream
    - remove 1f13f721263a4cc75e4b798a230022561047899c.patch integrated upstream
    - remove edad3f150de8af0aeb2f629508be3219b83369b9.patch integrated upstream

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/patches/
    - add Fordwarded tag

  * debian/control
    - Bumped Standards-Version to 4.6.2, no change needed

 -- Luigi Gangitano <luigi@debian.org>  Mon, 10 Jul 2023 11:04:20 +0200

squid (5.7-2) unstable; urgency=medium

  * Add a couple of upstream picked patches to fix some issues on 5.7
    that upstream has fixed on 5.8.

 -- Santiago Garcia Mantinan <manty@debian.org>  Fri, 28 Apr 2023 08:35:27 +0200

squid (5.7-1ubuntu3) lunar; urgency=medium

  * d/rules:
    - Re-enable LTO for s390x builds. (LP: #2011494)
    - Disable LTO related compilation errors for s390x builds.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 13 Mar 2023 21:54:07 -0300

squid (5.7-1ubuntu2) lunar; urgency=medium

  * Make builds fail when upstream test suite fails (LP: #2004050):
    - d/p/series: do not rely on installed binaries for build time tests.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/rules: disable LTO for s390x builds.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 27 Jan 2023 11:06:05 -0300

squid (5.7-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993446). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules, d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/fix-max-pkt-sz-for-icmpEchoData-padding.patch: Adjust
      MAX_PKT{4,6}_SZ to account for icmpEchoData padding, fixing FTBFS
      with GCC 11 (LP #1939352).
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
  * Drop changes:
    - d/t/upstream-test-suite: Also export DEB_*_MAINT_APPEND variables
      here. (LP #1988217)
      [ Not necessary anymore. ]
    - SECURITY UPDATE: Exposure of Sensitive Information in Cache Manager
      - debian/patches/CVE-2022-41317.patch: fix typo in ACL in
        src/cf.data.pre.
      - CVE-2022-41317
      [ Incorporated upstream. ]
    - SECURITY UPDATE: Buffer Over Read in SSPI and SMB Authentication
      - debian/patches/CVE-2022-41318.patch: improve checks in
        lib/ntlmauth/ntlmauth.cc.
      [ Incorporated upstream. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 03 Jan 2023 17:39:52 -0500

squid (5.7-1) unstable; urgency=medium

  * Urgency high due to security fixes

  [ Luigi Gangitano <luigi@debian.org> ]
  * New upstream version 5.7

  * Exposure of Sensitive Information in Cache Manager (CVE-2022-41317)
    (Closes: #1020587)

  * Buffer Over Read in SSPI and SMB Authentication (CVE-2022-41318)
    (Closes: #1020586)

  * debian/patches/
    - Removed 0006-Fix-build-against-OpenSSL-3-0.patch integrated upstream

  * debian/control
    - Bumped Standards-Version to 4.6.1, no change needed

  * Using new DH level format. Consequently:
      - debian/compat: removed.
      - debian/control:
          - Changed from 'debhelper' to 'debhelper-compat' in Build-Depends
            field and bumped level to 13.
      - debian/rules:
          - Disable dh_missing
      - Dropped unnecessary dependencies in Build-Depends field.

  * debian/salsa-ci.yml
      - Added to provide CI tests for Salsa

  * debian/upstream/metadata
    - Created upstream metadata file

  * debian/upstream/signing-key.asc
    - Strip extra signatures from upstream key

 -- Luigi Gangitano <luigi@debian.org>  Tue,  4 Oct 2022 11:04:20 +0200

squid (5.6-1ubuntu4) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 15 Dec 2022 19:56:14 +0000

squid (5.6-1ubuntu3) kinetic; urgency=medium

  * SECURITY UPDATE: Exposure of Sensitive Information in Cache Manager
    - debian/patches/CVE-2022-41317.patch: fix typo in ACL in
      src/cf.data.pre.
    - CVE-2022-41317
  * SECURITY UPDATE: Buffer Over Read in SSPI and SMB Authentication
    - debian/patches/CVE-2022-41318.patch: improve checks in
      lib/ntlmauth/ntlmauth.cc.
    - CVE-2022-41318

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 23 Sep 2022 08:02:41 -0400

squid (5.6-1ubuntu2) kinetic; urgency=medium

  * d/t/upstream-test-suite: Also export DEB_*_MAINT_APPEND variables
    here. (LP: #1988217)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 30 Aug 2022 19:32:59 -0400

squid (5.6-1ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1971325). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules, d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - Fix FTBFS with GCC 11 (LP #1939352)
      + d/p/fix-max-pkt-sz-for-icmpEchoData-padding.patch: Fix
        MAX_PKT{4,6}_SZ to account for icmpEchoData padding.
  * Drop changes:
    - Fix FTBFS with OpenSSL 3.0 (LP #1946205).  The following new
      patches have been added:
      + d/p/openssl3-Declaration-of-CRYPTO_EX_dup-changed-again-in-3.0.patch.
      + d/p/openssl3-Detect-and-default-enable-OpenSSL-3.patch.
      + d/p/openssl3-Fix-EVP_PKEY_get0_RSA-is-deprecated.patch.
      + d/p/openssl3-Initial-DH-conversion-to-EVP_PKEY.patch.
      + d/p/openssl3-Refactor-Ssl-createSslPrivateKey.patch.
      + d/p/openssl3-Remove-stale-TODO-and-comment.patch.
      + d/p/openssl3-SSL_OP_-macro-definitions-changed-in-3.0.patch.
      + d/p/openssl3-Switch-to-BN_rand.patch.
      + d/p/openssl3-TODO-Upgrade-API-calls-verifying-loaded-DH-params-fi.patch.
      + d/p/openssl3-Tweak-RSA-key-generator.patch.
      + d/p/openssl3-Update-ECDH-key-settings.patch.
      + d/p/openssl3-Update-license-disclaimer.patch.
      [ Incorporated by Debian. ]
    - SECURITY UPDATE: Denial of Service in Gopher Processing
      + debian/patches/CVE-2021-46784.patch: improve handling of Gopher
        responses in src/gopher.cc.
      [ Incorporated by upstream. ]
    - Fix FTBFS with GCC 11 (LP #1939352)
      + d/p/workaround-gcc11-wstringop-overread-bug.patch: Workaround
        GCC 11 -Wstringop-overread bug.
      [ Not needed anymore. ]
  * Add changes:
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
      [ Forwarded upstream ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Thu, 11 Aug 2022 17:13:45 -0400

squid (5.6-1) unstable; urgency=high

  * Urgency high due to security fixes

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release
    Fixes: CVE-2021-46784. Denial of Service in Gopher Processing

 -- Luigi Gangitano <luigi@debian.org>  Sun, 19 Jun 2022 13:39:54 +0200

squid (5.5-1.1) unstable; urgency=medium

  * Non-maintainer upload.

  [ Nicholas Guriev ]
  * Fixing build against OpenSSL 3.0 (Closes: #1005650, LP: #1946205)

  * debian/rules
    - Do not fail on errors about deprecated declarations from OpenSSL.
    - Remove -Wall in CFLAGS from the debian/rules file since upstream build
      scripts already pass this flag.

  * debian/patches/
    - New 0006-Fix-build-against-OpenSSL-3-0.patch

  [ Simon Deziel ]
  * apparmor: allow reading /etc/ssl/openssl.cnf

 -- Nicholas Guriev <guriev-ns@ya.ru>  Tue, 31 May 2022 23:13:38 +0300

squid (5.5-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release

  * debian/patches/
    - remove upstreamed 0004-Change-default-Makefiles-for-debian.patch

 -- Luigi Gangitano <luigi@debian.org>  Fri, 15 Apr 2022 14:39:54 +0200

squid (5.2-1ubuntu5) kinetic; urgency=medium

  * SECURITY UPDATE: Denial of Service in Gopher Processing
    - debian/patches/CVE-2021-46784.patch: improve handling of Gopher
      responses in src/gopher.cc.
    - CVE-2021-46784

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 21 Jun 2022 13:38:17 -0400

squid (5.2-1ubuntu4) jammy; urgency=medium

  * Do not enable openssl as a default. This hinders packaging since we ship
    squid in two different flavours (gnutls and openssl). Drop
    d/p/openssl3-Detect-and-default-enable-OpenSSL-3.patch. (LP: #1968200)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 12 Apr 2022 23:41:41 -0300

squid (5.2-1ubuntu3) jammy; urgency=medium

  * Fix FTBFS with OpenSSL 3.0 (LP: #1946205).  The following new
    patches have been added:
    - d/p/openssl3-Declaration-of-CRYPTO_EX_dup-changed-again-in-3.0.patch.
    - d/p/openssl3-Detect-and-default-enable-OpenSSL-3.patch.
    - d/p/openssl3-Fix-EVP_PKEY_get0_RSA-is-deprecated.patch.
    - d/p/openssl3-Initial-DH-conversion-to-EVP_PKEY.patch.
    - d/p/openssl3-Refactor-Ssl-createSslPrivateKey.patch.
    - d/p/openssl3-Remove-stale-TODO-and-comment.patch.
    - d/p/openssl3-SSL_OP_-macro-definitions-changed-in-3.0.patch.
    - d/p/openssl3-Switch-to-BN_rand.patch.
    - d/p/openssl3-TODO-Upgrade-API-calls-verifying-loaded-DH-params-fi.patch.
    - d/p/openssl3-Tweak-RSA-key-generator.patch.
    - d/p/openssl3-Update-ECDH-key-settings.patch.
    - d/p/openssl3-Update-license-disclaimer.patch.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 08 Feb 2022 17:15:20 -0500

squid (5.2-1ubuntu2) jammy; urgency=medium

  * No-change rebuild against libssl3

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 09 Dec 2021 00:19:10 +0000

squid (5.2-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1946903). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules, d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - Fix FTBFS with GCC 11 (LP #1939352)
      + d/p/expand-max-pkt-sz-accomodate-icmphdr.patch: Expand
        MAX_PKT{4,6}_SZ to accomodate for icmp{,6_}hdr.
      + d/p/workaround-gcc11-wstringop-overread-bug.patch: Workaround
        GCC 11 -Wstringop-overread bug.
  * Dropped changes:
    - d/p/0008-Fix-free-nonheap-object-warning-error-on-snmp_core.c.patch:
      Fix call to free on nonheap-object in snmpCreateOidFromStr
      [ Incorporated by upstream. ]
    - Fix failure to build on RISC-V (LP #1934891)
      [ Incorporated by upstream. ]
    - SECURITY UPDATE: information disclosure via OOB read in WCCP protocol
      + debian/patches/CVE-2021-28116.patch: validate packets better in
        src/wccp2.cc.
      + CVE-2021-28116
      [ Incorporated by upstream. ]
    - Fix FTBFS with GCC 11 (LP #1939352)
      + d/p/replace-cbdata-offset-hack-with-offsetof.patch: Replace
        cbdata::Offset hack with offsetof().
      + d/p/add-missing-limits-include-connmark.patch: Add missing
        <limits> include to src/acl/ConnMark.cc.
      [ Incorporated by upstream.  This is a partial drop; the other
        two patches that compose this fix are still present in this
        release. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 01 Nov 2021 18:19:59 -0400

squid (5.2-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release (Closes: #986804, #976131)
    Fixes: CVE-2021-28116. Out-Of-Bounds memory access in WCCPv2
    Fixes: CVE-2021-41611. Improper Certificate Validation of TLS server
    certificates

  [ L.P.H. van Belle <belle@bazuin.nl> ]
  * debian/rules
    - polish override_dh_installsystemd action to match other sequences

  * debian/NEWS
    - bump version number to make Lintian happy

 -- Luigi Gangitano <luigi@debian.org>  Sat,  9 Oct 2021 17:03:54 +0200

squid (5.1-2) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release (Closes: #984351, #943692)

  * debian/control
    - switch build-dep to libtdb-dev. libdb is deprecated
    - Bumped Standards-Version to 4.6.0, no change needed

  * debian/patches/
    - refresh patches for new version
    - fix 0001-Default-configuration-file-for-debian.patch (Closes: #970025)
    - add 0004-Change-default-Makefiles-for-debian.patch
      to fix FTBFS 'cp: cannot create regular file tests/stub_*.cc'

  * debian/rules
    - remove basic_nis_auth helper

  * Drop squid3 upgrade compatibility. Debian has not contained
    a squid3 package for at least two full release cycles.

 -- Luigi Gangitano <luigi@debian.org>  Fri, 17 Sep 2021 09:27:54 +0200

squid (4.13-10ubuntu5) impish; urgency=medium

  * SECURITY UPDATE: information disclosure via OOB read in WCCP protocol
    - debian/patches/CVE-2021-28116.patch: validate packets better in
      src/wccp2.cc.
    - CVE-2021-28116

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 04 Oct 2021 08:20:07 -0400

squid (4.13-10ubuntu4) impish; urgency=medium

  * Fix FTBFS with GCC 11 (LP: #1939352)
    - d/p/add-missing-limits-include-connmark.patch: Add missing
      <limits> include to src/acl/ConnMark.cc.
    - d/p/fix-max-pkt-sz-for-icmpEchoData-padding.patch.patch: Expand
      MAX_PKT{4,6}_SZ to accomodate for icmp{,6_}hdr.
    - d/p/replace-cbdata-offset-hack-with-offsetof.patch: Replace
      cbdata::Offset hack with offsetof().
    - d/p/workaround-gcc11-wstringop-overread-bug.patch: Workaround
      GCC 11 -Wstringop-overread bug.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Fri, 20 Aug 2021 00:19:41 -0400

squid (4.13-10ubuntu3) impish; urgency=medium

  * Fix failure to build on RISC-V (LP: #1934891)

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Wed, 07 Jul 2021 14:11:51 +0200

squid (4.13-10ubuntu2) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 18:09:05 -0400

squid (4.13-10ubuntu1) impish; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules, d/NEWS: drop the NIS basic auth helper (LP: #1895694)
    - d/p/0008-Fix-free-nonheap-object-warning-error-on-snmp_core.c.patch:
      Fix call to free on nonheap-object in snmpCreateOidFromStr

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 04 Jun 2021 12:49:43 -0400

squid (4.13-10) unstable; urgency=medium

  [ Francisco Vilmar Cardoso Ruviaro ]
  * Add debian/patches/0007-CVE-2021-28651.patch to fix a Denial
    of Service in URN processing. (Closes: #988893, CVE-2021-28651)

  [ Santiago Garcia Mantinan ]
  * Add patch to fix a Denial of Service in HTTP Response Processing.
    Fixes: CVE-2021-28662. Closes: #988891.
  * Add patch to fix a Denial of Service issue in Cache Manager.
    Fixes: CVE-2021-28652. Closes: #988892.
  * Add patch to fix Multiple Issues in HTTP Range header.
    Fixes: CVE-2021-31806 CVE-2021-31807 CVE-2021-31808. Closes: #989043.
  * Add patch to fix a Denial of Service in HTTP Response processing.
    Fixes: GHSA-572g-rvwr-6c7f.

 -- Santiago Garcia Mantinan <manty@debian.org>  Fri, 28 May 2021 12:28:20 +0200

squid (4.13-9ubuntu1) impish; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules, d/NEWS: drop the NIS basic auth helper (LP: #1895694)
    - d/p/0008-Fix-free-nonheap-object-warning-error-on-snmp_core.c.patch:
      Fix call to free on nonheap-object in snmpCreateOidFromStr
  * Drop changes:
    - debian/patches/CVE-2020-25097.patch: Add slash prefix to path-
      rootless or path-noscheme URLs in src/anyp/Uri.cc.
      [Included in 4.13-8]
    - d/usr.sbin.squid: Add section for maas-proxy
      [maas-proxy is no longer shipped as a deb package]

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 18 May 2021 10:51:16 -0300

squid (4.13-9) unstable; urgency=medium

  * Clarify on NEWS and scripts that we no longer remove logs on purge.
  * Clarify on postrm script that the debhelper code was put manually.
  * Add README.Debian to squid-openssl.

 -- Santiago Garcia Mantinan <manty@debian.org>  Tue, 23 Mar 2021 00:18:11 +0100

squid (4.13-8) unstable; urgency=medium

  * Add SQUID-2020_11.patch to fix HTTP Request Smuggling.
    Fixes: CVE-2020-25097. Closes: #985068.

 -- Santiago Garcia Mantinan <manty@debian.org>  Sun, 21 Mar 2021 00:58:29 +0100

squid (4.13-7) unstable; urgency=medium

  * Add full postrm scripts while we don't solve #984897 on debhelper.
    Closes: #984880.

 -- Santiago Garcia Mantinan <manty@debian.org>  Wed, 10 Mar 2021 09:19:32 +0100

squid (4.13-6) unstable; urgency=medium

  * Stop removing cache and config file on postrm. Closes: #984510.
  * Increase debhelper build dependency to 12.8 as we need that from -5.
  * Add NEWS note on the problem with purge on previous versions.

 -- Santiago Garcia Mantinan <manty@debian.org>  Thu, 04 Mar 2021 14:45:00 +0100

squid (4.13-5) unstable; urgency=high

  * Have a deeper look and change all dpkg-buildpackage commands
    for similar dh ones. At least at home it works now.

 -- Santiago Garcia Mantinan <manty@debian.org>  Mon, 08 Feb 2021 21:35:48 +0100

squid (4.13-4) unstable; urgency=high

  * Remove pre-build from upstream-test-suite.

 -- Santiago Garcia Mantinan <manty@debian.org>  Mon, 08 Feb 2021 09:26:25 +0100

squid (4.13-3) unstable; urgency=high

  * Source only upload to allow migration to testing.
  * At 4.13-2 we also enabled --enable-ssl-crtd. (Closes: #898307)
  * Fix build dependencies.

 -- Santiago Garcia Mantinan <manty@debian.org>  Sun, 07 Feb 2021 21:58:30 +0100

squid (4.13-2) unstable; urgency=high

  * Add a new brand, the new squid-openssl package compiled
    with openssl. (Closes: #966395)
  * Change rules to allow double building the two brands.
  * Update Standandards-Version.

 -- Santiago Garcia Mantinan <manty@debian.org>  Sun, 07 Feb 2021 01:39:45 +0100

squid (4.13-1ubuntu4) hirsute; urgency=medium

  * d/p/0008-Fix-free-nonheap-object-warning-error-on-snmp_core.c.patch:
    Fix FTBFS on Hirsute s390x when compiling with GCC 10.2.0.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 05 Apr 2021 12:00:02 -0400

squid (4.13-1ubuntu3) hirsute; urgency=medium

  * SECURITY UPDATE: HTTP Request Smuggling issue
    - debian/patches/CVE-2020-25097.patch: Add slash prefix to path-
      rootless or path-noscheme URLs in src/anyp/Uri.cc.
    - CVE-2020-25097

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 25 Mar 2021 12:38:06 -0400

squid (4.13-1ubuntu2) groovy; urgency=medium

  * d/rules, d/NEWS: drop the NIS basic auth helper (LP: #1895694)

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 17 Sep 2020 18:19:42 -0300

squid (4.13-1ubuntu1) groovy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern
      for debs.
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
  * Dropped changes:
    - d/p/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch:
      Fix GCC-10 build failure due to -Wstringop-truncation warning.
      [ Accepted upstream. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 25 Aug 2020 15:01:58 -0400

squid (4.13-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release
    - Fixes security issue SQUID-2020:8 (CVE-2020-15811) (Closes: #968932)
    - Fixes security issue SQUID-2020:9 (Closes: #968933)
    - Fixes security issue SQUID-2020:10 (CVE-2020-15810) (Closes: #968934)

  * debian/squid.rc: Fix several typos (Closes: #968101)

 -- Luigi Gangitano <luigi@debian.org>  Mon, 24 Aug 2020 17:27:54 +0200

squid (4.12-1ubuntu1) groovy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern
      for debs.
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
  * Dropped changes, not needed anymore:
    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround
      if building for ppc64el. On that arch, dpkg-buildflags sets -O3
      instead of -O2 and that triggers a format-truncation error on
      pcon.cc. See https://bugs.squid-cache.org/show_bug.cgi?id=4875.
      [ Dropped because the build now passes on ppc64el ]
  * Dropped changes, incorporated by Debian:
    - Don't restart squid by hand on postinst script
      + d/squid.postinst: When installing/upgrading squid, the service
        is being restarted manually in the postinst script, which can
        break installations that have the squid apparmor enabled because
        it will try to restart the service before reloading the apparmor
        profile.  There is no reason to restart squid manually, since the
        restart will be automatically performed later.
    - Drop conffile check for squid < 2.7
      + d/squid.postinst: squid 2.7 is long, long gone, so it should be
        safe to drop the postinst code to make sure that
        /etc/squid/squid.conf was properly upgraded.
    - d/tests/test-squid.py: Adjust 'pidfile' variable to reflect fact
      that we now store the pidfile under '/run/squid/'.
  * Added changes:
    - d/p/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch:
      Fix GCC-10 build failure due to -Wstringop-truncation warning.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 10 Aug 2020 11:20:46 -0400

squid (4.12-1) unstable; urgency=high

  [ Sergio Durigan Junior <sergiodj@debian.org> ]
  * Don't restart squid by hand on postinst script.
    When installing/upgrading squid, the service is being restarted
    manually in the postinst script, which can break installations that
    have the squid apparmor enabled because it will try to restart the
    service before reloading the apparmor profile.
    There is no reason to restart squid manually, since the restart will
    be automatically performed later.

  * Drop conffile check for squid < 2.7
    squid 2.7 is long, long gone, so it should be safe to drop the
    postinst code to make sure that /etc/squid/squid.conf was properly
    upgraded.

  * Fix 'pidfile' on d/t/tests-squid.py.
    The pidfile lives under '/run/squid/', not '/run/'. (Closes: #960327)

  [ Juri Grabowski <debian@jugra.de> ]
  * add gbp.conf for squid

  * New upstream version 4.12
    - Fixes security issue SQUID-2020:5 (CVE-2020-14059)
    - Fixes security issue SQUID-2020:6 (CVE-2020-14058)
    - Fixes security issue SQUID-2020:7 (CVE-2020-15049)

  * remove 0004-upstream-bug5041.patch - Fixed in upstream

  [ Luigi Gangitano <luigi@debian.org> ]

  * Move PID file to /run (Closes: #960819)

 -- Luigi Gangitano <luigi@debian.org>  Wed,  1 Jul 2020 10:52:54 +0200

squid (4.11-5ubuntu3) groovy; urgency=medium

  * No change rebuild against new libnettle8 and libhogweed6 ABI.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 29 Jun 2020 22:38:13 +0100

squid (4.11-5ubuntu2) groovy; urgency=medium

  * d/tests/test-squid.py: Adjust 'pidfile' variable to reflect fact
    that we now store the pidfile under '/run/squid/'.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 20 May 2020 10:32:32 -0400

squid (4.11-5ubuntu1) groovy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for
      debs.
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl to the
        default config file
    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead
      of -O2 and that triggers a format-truncation error on pcon.cc. See See
      https://bugs.squid-cache.org/show_bug.cgi?id=4875
  * Dropped:
    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
      deprecated in glibc 2.30 (LP #1843325)
      [ In 4.11-4 ]
    - SECURITY UPDATE: multiple ESI issues
      + debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
        into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
        src/esi/Esi.h, src/esi/Expression.cc.
      + CVE-2019-12519
      [ In 4.11-4 ]
    - SECURITY UPDATE: Digest Authentication nonce replay issue
      + debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
        overflow in src/auth/digest/Config.cc.
      [ In 4.11-4 ]
  * Added:
    - Don't restart squid by hand on postinst script
      + d/squid.postinst: When installing/upgrading squid, the service
        is being restarted manually in the postinst script, which can
        break installations that have the squid apparmor enabled because
        it will try to restart the service before reloading the apparmor
        profile.  There is no reason to restart squid manually, since the
        restart will be automatically performed later.
    - Drop conffile check for squid < 2.7
      + d/squid.postinst: squid 2.7 is long, long gone, so it should be
        safe to drop the postinst code to make sure that
        /etc/squid/squid.conf was properly upgraded.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 19 May 2020 14:43:04 -0400

squid (4.11-5) unstable; urgency=medium

  [ Sergio Durigan Junior <sergiodj@debian.org> ]
  * Don't install /run/squid (use systemd's RuntimeDirectory instead).
    Debian Policy states that /run is normally cleared at boot time, and
    therefore packages must not install files/directories under /run.
    Init scripts should be taught to dynamically handle /run instead.
    This change uses systemd's RuntimeDirectory and RuntimeDirectoryMode
    directives when starting the squid service in order to guarantee that
    /run/squid/ will be created with the correct permission.  This has the
    added benefit of deleting the directory when the service is stopped.
    (Closes: #960327)
  * Allow /run/system/notify to be accessed by squid.
    When apparmor is enabled and the squid profile is enforced, we must
    make sure that the daemon will be able to access the
    /run/system/notify file (because squid's systemd service file type is
    "notify").

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/NEWS
    - Fix unknown version of latest entry

 -- Luigi Gangitano <luigi@debian.org>  Sat, 16 May 2020 12:00:54 +0200

squid (4.11-4) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * Fix permissions on /run/squid

 -- Luigi Gangitano <luigi@debian.org>  Thu,  7 May 2020 15:30:54 +0200

squid (4.11-3) unstable; urgency=low

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * Move PID file into /run/squid (Closes: #932593)

  * Mark squid-common package Multi-Arch:foreign

 -- Luigi Gangitano <luigi@debian.org>  Sun,  4 May 2020 18:57:54 +0200

squid (4.11-2) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * Add libsystemd-dev dependency on Linux (Closes: 958708)
    - fixes systemd timeout failure during install

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/rules
    - Removed --as-needed flag

 -- Luigi Gangitano <luigi@debian.org>  Fri, 24 Apr 2020 20:49:54 +0200

squid (4.11-1) unstable; urgency=high

  * Urgency high due to security fixes

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release (Closes: #957840, #929574, #910337)
    - Fixes security issue SQUID-2019:12 (CVE-2019-12519, CVE-2019-12521)
    - Fixes security issue SQUID-2020:4 (CVE-2020-11945)

  * debian/squid3.{maintscript,postinst,postrm,preinst,rc}
    - Remove unused and obsolete scripts

  * debian/squid.{postrm,preinst}
    - Remove obsolete script logic

  * debian/squid-common.postinst
    - Remove obsolete script

  * debian/changelog
    - Add missing historic CVE references

  * debian/patches/
    - Add upstream fix for missing Debug::Extra in systemd builds

 -- Luigi Gangitano <luigi@debian.org>  Thu, 23 Apr 2020 19:34:54 +0200

squid (4.10-1ubuntu2) groovy; urgency=medium

  * SECURITY UPDATE: multiple ESI issues
    - debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
      into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
      src/esi/Esi.h, src/esi/Expression.cc.
    - CVE-2019-12519
    - CVE-2019-12521
  * SECURITY UPDATE: Digest Authentication nonce replay issue
    - debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
      overflow in src/auth/digest/Config.cc.
    - CVE-2020-11945

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 13 May 2020 09:51:10 -0400

squid (4.10-1ubuntu1) focal; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for debs.
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
      -O2 and that triggers a format-truncation error on pcon.cc. See
      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
      deprecated in glibc 2.30 (LP #1843325)
  * Dropped:
    - d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
      no longer available in Focal (LP: #1858827)
      [In 4.10-1, undocumented]
    - d/t/test-squid.py, d/t/squid: switch to python3
      [In 4.10-1, undocumented]
    - d/t/control: depend on python3-minimal
      [In 4.10-1, undocumented]
    - SECURITY UPDATE: info disclosure via FTP server
      + debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
        src/clients/FtpGateway.cc.
      + CVE-2019-12528
      [Fixed upstream]
    - SECURITY UPDATE: incorrect input validation and buffer management
      + debian/patches/CVE-2020-84xx.patch: fix request URL generation in
        reverse proxy configurations in src/client_side.cc.
      + CVE-2020-8449
      + CVE-2020-8450
      [Fixed upstream]
    - SECURITY UPDATE: DoS in NTLM authentication
      + debian/patches/CVE-2020-8517.patch: improved username handling in
        src/acl/external/LM_group/ext_lm_group_acl.cc.
      + CVE-2020-8517
      [Fixed upstream]

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 25 Feb 2020 15:37:55 -0300

squid (4.10-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release (Closes: #950641)
    - Fixes security issue SQUID-2020:1 (CVE-2020-8449) (CVE-2020-8450)
      (Closes: #950802)
    - Fixes security issue SQUID-2020:2 (CVE-2019-12528) (Closes: #950925)
    - Fixes security issue SQUID-2020:3 (CVE-2020-8517)

  * debian/NEWS
    - Fix syntax to make lintian happier

  * debian/control
    - Bumped Standards-Version to 4.5.0, no change needed

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/control
    - Drop squid3 transitional package (Closes: #940785)

 -- Luigi Gangitano <luigi@debian.org>  Tue, 10 Feb 2020 14:12:54 +0100

squid (4.9-2ubuntu4) focal; urgency=medium

  * SECURITY UPDATE: info disclosure via FTP server
    - debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
      src/clients/FtpGateway.cc.
    - CVE-2019-12528
  * SECURITY UPDATE: incorrect input validation and buffer management
    - debian/patches/CVE-2020-84xx.patch: fix request URL generation in
      reverse proxy configurations in src/client_side.cc.
    - CVE-2020-8449
    - CVE-2020-8450
  * SECURITY UPDATE: DoS in NTLM authentication
    - debian/patches/CVE-2020-8517.patch: improved username handling in
      src/acl/external/LM_group/ext_lm_group_acl.cc.
    - CVE-2020-8517

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 19 Feb 2020 12:43:05 -0500

squid (4.9-2ubuntu3) focal; urgency=medium

  * No-change rebuild with fixed binutils on arm64.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 08 Feb 2020 11:20:19 +0000

squid (4.9-2ubuntu2) focal; urgency=medium

  * d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
    no longer available in Focal (LP: #1858827)
  * d/t/test-squid.py, d/t/squid: switch to python3
  * d/t/control: depend on python3-minimal

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 08 Jan 2020 15:52:32 -0300

squid (4.9-2ubuntu1) focal; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Use snakeoil certificates.
    - Add an example refresh pattern for debs.
    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
      squidguard
    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
      -O2 and that triggers a format-truncation error on pcon.cc. See
      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
      deprecated in glibc 2.30 (LP #1843325)
  * Dropped:
    - d/rules: Only use -latomic with the intended architectures, instead of
      all of them. This matches what was suggested in
      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
      [Fixed upstream]
    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
      dh_installchangelogs can pick it up. dh_installchangelogs handles
      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
      [Fixed upstream]
    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
      lib/smblib/smblib-util.c. (LP #1835831)
      [Fixed upstream]
    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
      mounted
      [Fixed upstream]

 -- Lucas Kanashiro <lucas.kanashiro@canonical.com>  Thu, 14 Nov 2019 16:33:10 -0300

squid (4.9-2) unstable; urgency=medium

  [ Andreas Hasenack <andreas@canonical.com> ]
  * debian/rules
    - Only use -latomic with the intended architectures, instead of all of them

  * debian/NEWS
    - Rename d/NEWS.debian to d/NEWS so that dh_installchangelogs can pick it

  * debian/{watch,signing-key.asc}
    - Check upstream gpg signature

  * debian/test/test-squid.py
    - Re-enable apparmor test

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/squid.rc
    - Change to --foreground while creating cache dirs to avoid SMP bug

  * debian/squid.resolvconf
    - Merge previous check for /usr being mounted before restart

 -- Luigi Gangitano <luigi@debian.org>  Thu, 14 Nov 2019 10:12:54 +0100

squid (4.9-1) unstable; urgency=high

  * Urgency high due to security fixes

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release (Closes: #943692)
    - Fixes security issue SQUID-2019:7 (CVE-2019-12526)
    - Fixes security issue SQUID-2019:8 (CVE-2019-18676) (CVE-2019-12523)
    - Fixes security issue SQUID-2019:9 (CVE-2019-18677)
    - Fixes security issue SQUID-2019:10 (CVE-2019-18678)
    - Fixes security issue SQUID-2019:11 (CVE-2019-18679)
    - Updates fix for security issue SQUID-2019:6 (CVE-2019-13345)

  * debian/control
    - Bumped Standards-Version to 4.4.1, no change needed

  * debian/tests/test-squid.py
    - Disable Apparmor tests

  [ Luigi Gangitano <luigi@debian.org> ]
  * Source only upload (Closes: #943911)

  * debian/squid.resolvconf
    - Avoid reload before squid.pid is available (Closes: #911325)
      thanks to Michael Biebl and Wolfgang Schweer

  * debian/squid.rc
    - Make squid.rc wait for directory creation (Closes: #933295),
      thanks to Daniel Reichelt

 -- Luigi Gangitano <luigi@debian.org>  Sun, 10 Nov 2019 20:28:15 +0100

squid (4.8-1ubuntu3) focal; urgency=medium

  * No-change rebuild against libnettle7

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 31 Oct 2019 22:15:39 +0000

squid (4.8-1ubuntu2) eoan; urgency=medium

  * d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
    deprecated in glibc 2.30 (LP: #1843325)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 09 Sep 2019 17:31:45 -0300

squid (4.8-1ubuntu1) eoan; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Use snakeoil certificates.
    - Add an example refresh pattern for debs.
    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
      squidguard
    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
      -O2 and that triggers a format-truncation error on pcon.cc. See
      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
    - d/rules: Only use -latomic with the intended architectures, instead of
      all of them. This matches what was suggested in
      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
      dh_installchangelogs can pick it up. dh_installchangelogs handles
      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
      lib/smblib/smblib-util.c. (LP #1835831)
  * Dropped:
    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
      Thanks to Vitaly Lavrov <vel21ripn@gmail.com>. (LP #1794553)
      [Fixed upstream]
    - debian/patches/413.patch: Fix gcc-9 build issues with upstream merged
      patch
      [Fixed upstream]
    - SECURITY UPDATE: incorrect digest auth parameter parsing
      + debian/patches/CVE-2019-12525.patch: check length in
        src/auth/digest/Config.cc.
      + CVE-2019-12525
      [Fixed upstream]
    - SECURITY UPDATE: buffer overflow in basic auth decoding
      + debian/patches/CVE-2019-12527.patch: switch to SBuf in
        src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
        src/clients/FtpGateway.cc.
      + CVE-2019-12527
      [Fixed upstream]
    - SECURITY UPDATE: basic auth uudecode length issue
      + debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
        base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
        include/uudecode.h, lib/uudecode.c.
      + CVE-2019-12529
      [Fixed upstream]
    - SECURITY UPDATE: XSS issues in cachemgr.cgi
      + debian/patches/CVE-2019-13345.patch: properly escape values in
        tools/cachemgr.cc.
      + CVE-2019-13345
      [Fixed upstream]
  * Added:
    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
      mounted

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 24 Jul 2019 16:38:59 -0300

squid (4.8-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release
    - Fixes security issue SQUID-2019:1 (CVE-2019-12824)
    - Fixes security issue SQUID-2019:2 (CVE-2019-12529)
    - Fixes security issue SQUID-2019:3 (CVE-2019-12525)
    - Fixes security issue SQUID-2019:5 (CVE-2019-12527)
    - Fixes security issue SQUID-2019:6 (CVE-2019-13345) (Closes: #931478)

  * debian/control
    - Bumped Standards-Version to 4.4.0, no change needed

  * debian/tests/test-squid.py
    - Skip Apparmor tests when profile not installed

 -- Luigi Gangitano <luigi@debian.org>  Thu, 18 Jul 2019 22:28:15 +0200

squid (4.6-2ubuntu4) eoan; urgency=medium

  * Fix gcc-9 issues (LP: #1835831)
    - Remove -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
      lib/smblib/smblib-util.c.
  * SECURITY UPDATE: incorrect digest auth parameter parsing
    - debian/patches/CVE-2019-12525.patch: check length in
      src/auth/digest/Config.cc.
    - CVE-2019-12525
  * SECURITY UPDATE: buffer overflow in basic auth decoding
    - debian/patches/CVE-2019-12527.patch: switch to SBuf in
      src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
      src/clients/FtpGateway.cc.
    - CVE-2019-12527
  * SECURITY UPDATE: basic auth uudecode length issue
    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
      include/uudecode.h, lib/uudecode.c.
    - CVE-2019-12529
  * SECURITY UPDATE: XSS issues in cachemgr.cgi
    - debian/patches/CVE-2019-13345.patch: properly escape values in
      tools/cachemgr.cc.
    - CVE-2019-13345

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 19 Jul 2019 08:01:58 -0400

squid (4.6-2ubuntu3) eoan; urgency=medium

  * Override newly added gcc-9 flags:
    -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
    NOTE: Overriding those flags is a possible security
    asked for info on the gcc-9 issue bug tracker:
    https://github.com/squid-cache/squid/pull/413#issuecomment-511314076

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 15 Jul 2019 10:21:47 +0200

squid (4.6-2ubuntu2) eoan; urgency=medium

  * Fix gcc-9 build issues with upstream merged patch

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sun, 14 Jul 2019 14:41:16 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog squid`.
