golang-github-jackc-pgx (4.18.3-2) unstable; urgency=medium

  * Team upload
  * Enable (limited) autopkgtest/debci test suite
  * New upstream (Closes: #1126470)

 -- Simon Josefsson <simon@josefsson.org>  Sat, 21 Mar 2026 22:21:33 +0100

golang-github-jackc-pgx (4.18.3-1) unstable; urgency=medium

  * Team upload
  * Upload to unstable

 -- Simon Josefsson <simon@josefsson.org>  Fri, 20 Mar 2026 08:43:55 +0100

golang-github-jackc-pgx (4.18.3-1~exp0) experimental; urgency=medium

  * Team upload.
  * New upstream release
  * Drop CVE patches fixed upstreamed
  * Need jackc/pgconn>=1.14.3
  * Drop Priority: optional
  * Drop Rules-Requires-Root: no
  * Standards-Version: 4.7.3
  * Bump debian/* copyright years
  * Switch to gbp debian-branch debian/latest
  * Use gbp sign-tags and upstream-vcs-tag
  * Use watch v5 and pin to v4.x branch

 -- Simon Josefsson <simon@josefsson.org>  Wed, 18 Mar 2026 10:14:13 +0100

golang-github-jackc-pgx (4.18.1-2) unstable; urgency=medium

  * Team upload.
  * Create a new git branch to fix CVEs during soft freeze.
  * Add two patches from upstream
    - CVE-2024-27289
      pgx is a PostgreSQL driver and toolkit for Go. Prior to version
      4.18.2, SQL injection can occur when all of the following
      conditions are met: the non-default simple protocol is used; a
      placeholder for a numeric value must be immediately preceded by a
      minus; there must be a second placeholder for a string value
      after the first placeholder; both must be on the same line; and
      both parameter values must be user-controlled. The problem is
      resolved in v4.18.2. As a workaround, do not use the simple
      protocol or do not place a minus directly before a placeholder.
      Closes: #1065686
    - CVE-2024-27304
      pgx is a PostgreSQL driver and toolkit for Go. SQL injection can
      occur if an attacker can cause a single query or bind message to
      exceed 4 GB in size. An integer overflow in the calculated
      message size can cause the one large message to be sent as
      multiple messages under the attacker's control. The problem is
      resolved in v4.18.2 and v5.5.4. As a workaround, reject user
      input large enough to cause a single query or bind message to
      exceed 4 GB in size.
      Closes: #1065687

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 23 Apr 2025 11:04:24 +0200

golang-github-jackc-pgx (4.18.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 4.18.1
  * Reorder fields in debian/control and debian/copyright
  * Change Section from devel to golang
  * Use dh-sequence-golang instead of dh-golang and --with=golang
  * Update versioned dependencies as per go.mod
  * Remove unused "DH_GOLANG_INSTALL_EXTRA := $(wildcard *.example)"
    as upstream no longer comes with *.example files
  * Set debian-branch to debian/sid for DEP-14 conformance

 -- Anthony Fok <foka@debian.org>  Mon, 26 Feb 2024 19:29:39 -0700

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog golang-github-jackc-pgx-v4-dev`.
