graphite-web (1.1.8-1ubuntu0.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: XSS
    - debian/patches/CVE-2022-4728.patch: fixed XSS issues in Cookie Handler
      component (CVE-2022-4728), Template Name Handler component
      (CVE-2022-4729), and Absolute Time Range Handler component
      (CVE-2022-4730).
    - CVE-2022-4728
    - CVE-2022-4729
    - CVE-2022-4730

 -- Amir Naseredini <amir.naseredini@canonical.com>  Tue, 18 Jul 2023 13:13:35 +0100

graphite-web (1.1.8-1) unstable; urgency=medium

  * New upstream release:
    - Works with Python 3.9 (Closes: #962623).
  * Refresh local_settings.patch.
  * Rebase settings_debian.patch (taken from bug report).
  * Drop CVE-2017-18638.patch applied upstream.

 -- Thomas Goirand <zigo@debian.org>  Mon, 06 Sep 2021 13:33:05 +0200

graphite-web (1.1.4-5) unstable; urgency=high

  * Non-maintainer upload.
  * Add patch to remove the 'send_email' function to avoid SSRF attack.
    This was insecure, not used in the code, and was undocumented as well.
    (Fixes: CVE-2017-18638)

 -- Utkarsh Gupta <guptautkarsh2102@gmail.com>  Thu, 17 Oct 2019 05:47:35 +0530

graphite-web (1.1.4-4) unstable; urgency=medium

  * Avoid hourly error in cron with no whisper db (Closes: #940554). Thanks to
    Alexandre Rossi <niol@zincube.net> for the patch.
  * Removed use of Python 2 (Closes: #936651). Thanks to Alexander again for
    the patch.

 -- Thomas Goirand <zigo@debian.org>  Sat, 21 Sep 2019 21:38:06 +0200

graphite-web (1.1.4-3) unstable; urgency=medium

  * Fix shebang of /usr/bin/graphite-manage. (Closes: #925240)

 -- Thomas Goirand <zigo@debian.org>  Fri, 07 Jun 2019 09:39:24 +0200

graphite-web (1.1.4-2) unstable; urgency=medium

  * Fix README to suggest installation of libapache2-mod-wsgi-py3, and added
    NEWS about it (Closes: #917096).

 -- Thomas Goirand <zigo@debian.org>  Wed, 26 Dec 2018 08:35:26 +0100

graphite-web (1.1.4-1) unstable; urgency=medium

  * New upstream release.
  * Rebase patches.
  * Added myself as uploader (after contacting the current maintainers).
  * Ran wrap-and-sort -bast.
  * Removed obsolete X-Python-Version: >=2.6.
  * Switched to debhelper 10.
  * Switched the package to Python 3.

 -- Thomas Goirand <zigo@debian.org>  Mon, 10 Dec 2018 15:28:59 +0100

graphite-web (1.0.2+debian-2.1) unstable; urgency=medium

  * NMU
  * VCS move to salsa
  * change maintainer to tracker list (closes: #899808)

 -- Christoph Martin <martin@uni-mainz.de>  Tue, 23 Oct 2018 13:57:47 +0200

graphite-web (1.0.2+debian-2) unstable; urgency=medium

  * d/p/local_settings.patch: fixed typo (Closes: #876522)

 -- Jonas Genannt <genannt@debian.org>  Sat, 23 Sep 2017 13:56:38 +0200

graphite-web (1.0.2+debian-1) unstable; urgency=medium

  * Imported Upstream version 1.0.2+debian
    - Closes: #862084, #860195, #840516
  * d/README.source: update information
  * d/bin/graphite-build-search-index
    - fixed race condition [Michael Abmayer] (Closes: #849080)
  * d/p/remove_thirdparty_modules.patch: included by upstream
  * d/p/django19.patch: included by upstream
  * removed remove_internal_logrotate.patch upstream has add the setting
  * updated to new upstream version:
    - local_settings.patch
    - settings_debian.patch
  * d/copyright:
    - removed unused statement (upstream removed files)
    - updated copyright years
  * d/graphite-web.links: removed upstream no longer includes
    prototype and scriptaculous
  * d/graphite.wsgi: use upstream wsgi file (removed Debian version)
  * d/apache2-graphite.conf: changed content to static
  * d/control:
    - bumped depends version of python-whisper to 1.0.2
    - bumped standards version (no change needed)
    - removed libjs-scriptaculous, libjs-prototype from depends
    - added python-urllib3 as depends
    - added python-scandir as depends
  * debian/graphite-web.NEWS: added note about changed webserver configuration

 -- Jonas Genannt <genannt@debian.org>  Wed, 20 Sep 2017 16:45:11 +0200

# For older changelog entries, run 'apt-get changelog graphite-web'
