dulwich (1.2.12-1) unstable; urgency=medium

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Tue, 21 Jul 2026 11:55:05 +0100

dulwich (1.2.11-1) unstable; urgency=medium

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Thu, 16 Jul 2026 15:52:48 +0100

dulwich (1.2.8-1) unstable; urgency=high

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Sun, 05 Jul 2026 22:39:40 +0100

dulwich (1.2.7-2) unstable; urgency=medium

  * Team Upload
  * Salsa CI: test the <!nocheck> profile
  * Mark python3-fastimport & python3-gpg as <!nocheck>
  * Use dh-sequence-python3
  * Drop "Rules-Requires-Root: no": it is the default now
  * Remove redundant Priority: optional from source stanza.

 -- Alexandre Detiste <tchet@debian.org>  Mon, 29 Jun 2026 21:11:03 +0200

dulwich (1.2.7-1) unstable; urgency=medium

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Fri, 12 Jun 2026 12:02:59 +0100

dulwich (1.2.5-1) unstable; urgency=medium

  * New upstream release, fixing several security issues:
    - Validate submodule paths in porcelain.submodule_update (and thus
      porcelain.clone with recurse_submodules=True). The dulwich analogue
      of git's CVE-2024-32002 / CVE-2024-32004 (GHSA-gfhv-vqv2-4544).
    - CVE-2026-42305: Harden tree path validation against entry names that
      are harmless on POSIX but dangerous when checked out on Windows.
    - CVE-2026-42563: Shell-quote values substituted into
      ProcessMergeDriver commands.
    - CVE-2026-47712: Sanitize commit subjects used in
      porcelain.format_patch filenames to prevent path traversal.
    - CVE-2026-47734: Honour receive.maxInputSize in ReceivePackHandler to
      bound memory allocation from crafted packs over git-receive-pack.
  * Add patch older-similar: Downgrade similar crate to version 2.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Thu, 28 May 2026 22:58:58 +0100

dulwich (1.2.1-1) unstable; urgency=medium

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Wed, 06 May 2026 16:48:17 +0100

dulwich (1.2.0-1) unstable; urgency=low

  * Update watch file format version to 5.
  * Use PyPI template in watch file instead of explicit Source/Matching-Pattern.
  * Set upstream metadata fields: Repository.
  * Update standards version to 4.7.4, no changes needed.
  * New upstream release.
  * Drop patches 03_fix_gpg_signature_verification_test and
    04_support_pyo3_0.28: applied upstream.
  * Refresh patch 02_skip_flappy_test.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Tue, 21 Apr 2026 17:55:40 +0100

dulwich (1.1.0-3) unstable; urgency=medium

  * Update patch 03_fix_gpg_signature_verification_test: also handle the
    case where ctx.verify() returns without raising an exception but
    with no signatures. Closes: #1131202
  * Remove use of nonexistent build profile norust.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Tue, 24 Mar 2026 20:39:43 +0000

dulwich (1.1.0-2) unstable; urgency=medium

  * Update patch 03_fix_gpg_signature_verification_test:
    another attempt to fix test failures. Closes: #1131202

 -- Jelmer Vernooĳ <jelmer@debian.org>  Thu, 19 Mar 2026 12:14:36 +0000

dulwich (1.1.0-1) unstable; urgency=medium

  [ Colin Watson ]
  * Breaks: python3-poetry (<< 2.3.0).

  [ Jelmer Vernooĳ ]
  * New upstream release.
  * Add patch 04_support_pyo3_0.28: add support for PyO3 0.28.
  * Fix patch 03_fix_gpg_signature_verification_test to also catch
    non-BadSignatures GPGMEError exceptions. Closes: #1127667

 -- Jelmer Vernooĳ <jelmer@debian.org>  Tue, 17 Mar 2026 09:56:52 +0000

dulwich (1.0.0-2) unstable; urgency=medium

  * Add Build-Depends and Recommends on python3-sshsig and openssh-client.
  * Add patch 03_fix_gpg_signature_verification_test: fix FTBFS.
    Closes: #1126635
  * Run ``update-rust-deps`` to update dependencies on rust crates.
    Closes: #1126635

 -- Jelmer Vernooĳ <jelmer@debian.org>  Sun, 01 Feb 2026 16:25:14 +0000

dulwich (1.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Mon, 26 Jan 2026 21:10:47 +0000

dulwich (0.24.10-1) unstable; urgency=medium

  * Add a norust profile to allow building without optional rust
    extensions.
  * debian/gbp.conf: Set upstream-vcs-tag
  * New upstream release.
   + Drop obsolete patch relax-pyo3.patch.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Tue, 11 Nov 2025 02:22:30 +0000

dulwich (0.24.2-2) unstable; urgency=medium

  * Team upload.
  * Accept pyo3 0.26.

 -- Colin Watson <cjwatson@debian.org>  Sun, 12 Oct 2025 21:42:14 +0100

dulwich (0.24.2-1) unstable; urgency=medium

  * Team upload.
  * d/gbp.conf: Update debian-branch to debian/main.
  * d/gbp.conf: Remove upstream-vcs-tag
  * New upstream version.
  * d/patches/03_fix_protocol_v2_deepen_flush.patch: Remove patch.
    It was already in new upstream release.
  * d/patches/older-pyo3: No need to relax rust-pyo3 vesion for now.
  * d/control: Add python3-merge3 as Build Dependency. It is needed
    in tests.
  * d/patches/02_skip_flappy_test: Update patch to skip
    test_add_symlink_absolute_to_system. It's failling.
  * d/tests/control. Add python3-merge3 to autopkgtest as Depends.

 -- Emmanuel Arias <eamanu@debian.org>  Thu, 02 Oct 2025 00:25:02 -0300

dulwich (0.22.7-2) unstable; urgency=medium

  * Add patch to fix protocol v2 deepen command flush packet handling.
    Prevents server implementations from stopping reading and missing
    the 'done' command, which fixes flaky autopkgtest failures.
    (Closes: #1104209)

 -- Jelmer Vernooĳ <jelmer@debian.org>  Thu, 09 Jan 2025 00:00:00 +0000

dulwich (0.22.7-1) unstable; urgency=low

  * New upstream release.
    + Fixes compatibility with newer versions of Python. Closes: #1089759

 -- Jelmer Vernooĳ <jelmer@debian.org>  Thu, 19 Dec 2024 17:48:40 +0000

dulwich (0.22.5-1) unstable; urgency=medium

  * Drop signing-key; no longer supported by pypi
  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Thu, 07 Nov 2024 20:02:44 +0000

dulwich (0.21.6-1) unstable; urgency=medium

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Sat, 02 Sep 2023 14:12:56 +0100

dulwich (0.21.5-1) unstable; urgency=low

  * New upstream release.

 -- Jelmer Vernooĳ <jelmer@debian.org>  Tue, 13 Jun 2023 18:25:12 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python3-dulwich`.
