ubuntu-advantage-tools (37.1ubuntu0~16.04.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Information disclosure
    - Remove credentials out of argv into apt's own auth.conf.d facility.
    - CVE-2026-9494
  * SECURITY UPDATE: Improper input validation
    - enforce StrictStringDataValue to applicable fields in directives
    - reject newline, carriage return, spaces, and shell meta characters
      in StrictStringDataValue
    - CVE-2026-11386
  * SECURITY UPDATE: Symlink attack
    - reject symlink log files in user-controlled directory trees during
      pro collect-logs
    - restrict pro collect-logs generated support archive permission to
      root only
    - CVE-2026-12391

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Tue, 07 Jul 2026 17:01:07 +0200

ubuntu-advantage-tools (37.1ubuntu0~16.04) xenial; urgency=medium

  * Backport 37.1ubuntu0 to xenial (LP: #2129712)

 -- Renan Rodrigo <rr@ubuntu.com>  Mon, 27 Oct 2025 09:41:59 -0300

ubuntu-advantage-tools (37.1ubuntu0) resolute; urgency=medium

  * do-release-upgrade: immediately release the APT lock acquired to run the
    post-upgrade hook (LP: #2129712)

 -- Renan Rodrigo <rr@ubuntu.com>  Thu, 23 Oct 2025 16:30:36 -0300

ubuntu-advantage-tools (37ubuntu0) questing; urgency=medium

  * d/apparmor/ubuntu_pro_[apt_news|esm_cache].jinja2: update coreutils path
    Thanks to Georgia Garcia <georgia.garcia@canonical.com> (LP: #2123870)
  * New upstream release 37: (LP: #2125453)
    - attach: don't show a notice if attaching a one-time token set for a
      future release (GH: #3485)
    - enable: add the --auto option to enable all default services based on
      the contract
    - entitlements:
      + add esm-infra-legacy support
      + add esm-apps-legacy support
    - fips: show correct kernel versions when downgrading on clouds (GH: #3488)
    - upgrade-lts-contract: (LP: #2107604)
      + remove implicit dependency on lsof
      + fix the logic to hold the apt lock while performing operations

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Mon, 22 Sep 2025 21:51:46 -0300

ubuntu-advantage-tools (36ubuntu0) questing; urgency=medium

  * d/apparmor/ubuntu_pro_esm_cache.jinja2: use openssl abstraction in the
    apparmor profile
  * New upstream release 36: (LP: #2112382)
    - api: display all available valid CVEs
    - attach: relax the onlySeries directive, so users can attach onlySeries
      tokens to all releases older than the target release
    - cli:
      + anbox-cloud: update installation instructions
      + collect-logs: do not overwrite the output file if it exists
      + cve/cves:
        * return all affected packages for a cve (LP: #2111610)
        * handle the case where the vulnerability data doesn't exist for the
          Ubuntu release
    - fips:
      + enable --access-only for all fips related services (GH: #3441)
      + allow enablement even when the -updates pocket is not available in the
        system (GH: #3439)

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Fri, 06 Jun 2025 11:08:26 -0300

ubuntu-advantage-tools (35.1ubuntu0) plucky; urgency=medium

  * apt: support ESM snapshots by adding snapshot URLs for ESM repositories
    to the authentication file (released in version 35)
  * lxd: store the configuration in /var/lib/ubuntu-advantage instead of
    /var/lib/ubuntu-pro (LP: #2106660)

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Wed, 09 Apr 2025 13:19:50 -0300

ubuntu-advantage-tools (35) plucky; urgency=medium

  * d/tests/usage: add more scenarios to dep8 tests
  * d/control: drop strict dependency on python3-pkg-resources (LP: #2083665)
  * d/rules: add conditional python3-pkg-resources dependency up to noble
  * d/ubuntu-pro-client.postrm: remove /var/lib/ubuntu-pro cache dir on purge
  * New upstream release 35: (LP: #2083973)
    - api:
      + new endpoints:
        * u.pro.attach.guest.get_guest_token.v1: Get the Pro client guest
          token
        * u.pro.security.cves.v1: List the fixable CVEs that affect the system
      + u.pro.packages.updates.v1: create new package status:
        upgrade_available_not_preferred (GH: #3184)
      + fixes for u.unattended_upgrades.status.v1:
        * do not crash when a Unattended-Upgrade config is missing
        * do not report unattended-upgrade disabled if any config is false
        * report missing Unattended-Upgrade configs as turned off
    - apt:
      + always ensure the ESM cache is present (GH: #3132)
      + fix permission warning when fetching apt-news (GH: #3209, LP: #2070095)
      + update logging for apt errors (GH: #3299)
      + only run the apt upgrade hook when run as root (LP: #2084677)
    - auto-attach:
      + aws: skip operation if no product codes found
      + gcp: add minimal image license codes
    - cli:
      + add support for vulnerability commands:
        * pro cves: List cves in the machine
        * pro cve: Show information about a specific cve
      + deduplicate entries in 'pro help' output (LP: #2091327)
    - config: add option lxd_guest_attach to control LXD integration with Pro
    - contract:
      + check onlySeries on reboot (GH: #3189)
      + collect cpu type for activity info
    - landscape:
      + update message if service not available through Pro (GH: #3331)
    - livepatch: do not enable livepatch on wsl (GH: #3156)
    - lxd: allow pro auto-attach to work on a LXD container

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Thu, 20 Feb 2025 12:00:14 -0300

ubuntu-advantage-tools (34.1.3) plucky; urgency=medium

  * apt-hook: set C++ standards version to c++17 for APT 2.9.30 compatibility
    (LP: #2098862)
  * tests: remove argparse error tests from unit tests (LP: #2098862)

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Wed, 19 Feb 2025 11:53:40 -0300

ubuntu-advantage-tools (34.1.2build1) plucky; urgency=high

  * No change rebuild against libapt-pkg7.0.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 17 Feb 2025 22:47:04 +0100

ubuntu-advantage-tools (34.1.2) oracular; urgency=medium

  * check-versions-are-consistent.py: fix regexp to cope with X.Y.Z version
    formats
  * version.py: bump to 34.1.2

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 04 Oct 2024 17:06:07 -0300

# For older changelog entries, run 'apt-get changelog ubuntu-pro-client'
