xz-utils (5.6.1+really5.4.5-1ubuntu0.3) noble-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2026-34743.patch: adds a check to
      lzma_index_prealloc() to default to a safe size when decoding empty
      indexes in src/liblzma/common/index.c.
    - CVE-2026-34743

 -- Ian Constantin <ian.constantin@canonical.com>  Thu, 28 May 2026 19:06:47 +0300

xz-utils (5.6.1+really5.4.5-1ubuntu0.2) noble-security; urgency=medium

  * SECURITY UPDATE: issue in threaded .xz decoder
    - debian/patches/CVE-2025-31115-1.patch: fix a comment in
      src/liblzma/common/stream_decoder_mt.c.
    - debian/patches/CVE-2025-31115-2.patch: simplify by removing the
      THR_STOP state in src/liblzma/common/stream_decoder_mt.c.
    - debian/patches/CVE-2025-31115-3.patch: don't free the input buffer
      too early in src/liblzma/common/stream_decoder_mt.c.
    - debian/patches/CVE-2025-31115-4.patch: don't modify thr->in_size in
      the worker thread in src/liblzma/common/stream_decoder_mt.c.
    - CVE-2025-31115

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 31 Mar 2025 14:22:22 -0400

xz-utils (5.6.1+really5.4.5-1build0.1) noble-proposed; urgency=medium

  * SRU: LP: #2076340: No-change rebuild to pick up changed build flags
    on ppc64 and s390x.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 09 Aug 2024 04:33:21 +0200

xz-utils (5.6.1+really5.4.5-1) unstable; urgency=critical

  * Non-maintainer upload by the Security Team.
  * Revert back to the 5.4.5-0.2 version 

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 28 Mar 2024 15:59:38 +0100

xz-utils (5.6.1-1) unstable; urgency=medium

  * Non-maintainer upload.
  * Import 5.6.1 (Closes: #1067708).
  * Takeover maintenance of the package.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 27 Mar 2024 22:53:21 +0100

xz-utils (5.6.0-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Move xz's output of reduced threads to debug output.
  * Add missing RISC-V on the filter list in the man page.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 28 Feb 2024 20:03:45 +0100

xz-utils (5.6.0-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Import 5.6.0
  * Add Breaks on pristine-tar because of the different default behaviour
    regarding the -T argument.
  * Upload to unstable.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Mon, 26 Feb 2024 07:47:01 +0100

xz-utils (5.5.2beta-1) experimental; urgency=medium

  * Non-maintainer upload.
  * Import 5.5.2beta
  * Mark liblzma-doc multi-arch foreign.
  * Update copyright file, most files are now under 0BSD.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Thu, 15 Feb 2024 21:42:23 +0100

xz-utils (5.5.1alpha-0.1) experimental; urgency=medium

  * Non-maintainer upload.
  * Import 5.5.1alpha.
  * Add new symbol.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 31 Jan 2024 21:44:23 +0100

xz-utils (5.4.5-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Add liblzma5-udeb, needed for kmod to gain support for compressed
    modules.

 -- Cyril Brulebois <kibi@debian.org>  Sat, 23 Dec 2023 19:05:39 +0100

xz-utils (5.4.5-0.1) unstable; urgency=medium

  [ Sebastian Andrzej Siewior ]
  * Non-maintainer upload.
  * Import 5.4.5.

  [ Helmut Grohne ]
  * Move liblzma.so.* to /usr. (Closes: #1055942).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Thu, 23 Nov 2023 20:54:59 +0100

xz-utils (5.4.4-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Import 5.4.4.
  * Don't redo translation, the patches are in the upstream release
    (Closes: #1047952).
  * Don't crc32 assembly on hurd-amd64. Patch by Samuel Thibault
    (Closes: #1035615).
  * Update doxygen generation for public API.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 30 Aug 2023 20:38:53 +0200

xz-utils (5.4.1-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Increase replaces/breaks relationship with manpages-{de|fr}
    (Closes: #1028375).
  * Add da.po translation translation from manpages-l10n (Closes: #1029349).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Sun, 12 Feb 2023 21:22:50 +0100

xz-utils (5.4.1-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Update pt_BR translations.
  * Add lintian overrides and an override for blhc.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 01 Feb 2023 17:41:36 +0100

xz-utils (5.4.1-0.0) unstable; urgency=medium

  * Non-maintainer upload.
  * Import 5.4.1.
  * Provide proper package relationship with manpages-{de|fr}
   (Closes: #1028375).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 11 Jan 2023 23:00:00 +0100

xz-utils (5.4.0-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Upload to unstable.
  * Add RRR = no to control file.
  * Point VCS tags to salsa.d.o.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Thu, 15 Dec 2022 18:14:49 +0100

xz-utils (5.4.0-0.0) experimental; urgency=medium

  * Non-maintainer upload.
  * Import 5.4.0.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Tue, 13 Dec 2022 23:49:25 +0100

xz-utils (5.3.5beta-0.0) experimental; urgency=medium

  * Non-maintainer upload.
  * Import 5.3.5beta.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Fri, 02 Dec 2022 22:10:13 +0100

xz-utils (5.3.4alpha-0.0) experimental; urgency=medium

  * Non-maintainer upload.
  * Import 5.3.4alpha.
  * Update upstream's GPG key.
  * Update standards to 4.6.1.
  * Add hardening=+all.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Fri, 18 Nov 2022 23:25:47 +0100

xz-utils (5.3.3alpha-0.0) experimental; urgency=medium

  * Non-maintainer upload.
  * Import 5.3.3alpha.
  * Add new symbols.
  * Upgrade to dh compat 13
    - Drop additional rules/ targets for the three flavours and use one.
    - Add indep targets to skip most of the build process for the indep only
      build.
    - Use autoreconf from dh
    - Update paths for installation and record not used files in not-installed
    - Update path in the docs package since newer dh detects liblzma-dev as
      the main package.
  * Provide de/fr man page (Closes: #988580, #995982).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Sun, 02 Oct 2022 22:04:04 +0200

xz-utils (5.2.5-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * xzgrep: Fix escaping of malicious filenames (ZDI-CAN-16587)
    (CVE-2022-1271) (Closes: #1009167)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 10 Apr 2022 13:31:29 +0200

xz-utils (5.2.5-2) unstable; urgency=medium

  * Non-maintainer upload (Closes: #983067).
  * Upload to unstable.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Mon, 08 Mar 2021 23:01:54 +0100

xz-utils (5.2.5-1.1) experimental; urgency=medium

  * Non-maintainer upload.
  * Update the patches for #844770 and #975981 to what upstream applied.
  * Add a SIGPIPE fix to xzgrep (similar to xzcmp in #844770).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Tue, 02 Mar 2021 21:50:25 +0100

xz-utils (5.2.5-1.0) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream release (Closes: #975984).
    - Increase GETTEXT version (Closes: #959999).
  * Add % target to the rules file to work with newer debhelper
    (Closes: #945961).
  * Enable threads for static builds (Closes: #907449).
  * Ignore SIGPIPE in xzdiff script (Closes: #844770).
  * Teach xzgrep about zstd (Closes: #970891).
  * Clean up the xz man page (Closes: #894454).
  * Ignore hard link count if input is not deleted (Closes: #975981).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Mon, 28 Dec 2020 11:25:06 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog liblzma-doc`.
