jackson-databind (2.14.0+ds-1build1) resolute; urgency=medium

  * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)

 -- Graham Inggs <ginggs@ubuntu.com>  Wed, 21 Jan 2026 19:57:09 +0000

jackson-databind (2.14.0+ds-1) unstable; urgency=medium

  * Team upload.
  * Use java_compat_level from /usr/share/java/java_defaults.mk to set the
    target compiled classes version. (Closes: #1088270)
  * Promote Standards-Version to 4.7.0 without changes.
  * Repack sources without newly excluded files and update configuration for
    importing new releases.

 -- Julien Plissonneau Duquène <sre4ever@free.fr>  Tue, 26 Nov 2024 17:34:44 +0000

jackson-databind (2.14.0-1) unstable; urgency=medium

  * New upstream version 2.14.0.
    - Fix CVE-2022-42003:
      Resource exhaustion can occur because of a lack of a check in primitive
      value deserializers to avoid deep wrapper array nesting, when the
      UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
    - Fix CVE-2022-42004:
      Resource exhaustion can occur because of a lack of a check in
      BeanDeserializer._deserializeFromArray to prevent use of deeply nested
      arrays. An application is vulnerable only with certain customized choices
      for deserialization.
  * Declare compliance with Debian Policy 4.6.1.

 -- Markus Koschany <apo@debian.org>  Fri, 11 Nov 2022 23:19:39 +0100

jackson-databind (2.13.2.2-1) unstable; urgency=medium

  * New upstream version 2.13.2.2.
    - Fix CVE-2020-36518: Java StackOverflow exception and denial of service
      via a large depth of nested objects. (Closes: #1007109)
      Thanks to Neil Williams for the report.

 -- Markus Koschany <apo@debian.org>  Sat, 30 Apr 2022 14:05:08 +0200

jackson-databind (2.13.0-2) unstable; urgency=medium

  * Drop all doc packages from Build-Depends.
  * Update debian/watch.

 -- Markus Koschany <apo@debian.org>  Thu, 04 Nov 2021 10:28:57 +0100

jackson-databind (2.13.0-1) unstable; urgency=medium

  * New upstream version 2.13.0.

 -- Markus Koschany <apo@debian.org>  Fri, 22 Oct 2021 12:58:08 +0200

jackson-databind (2.12.5-1) unstable; urgency=medium

  * New upstream version 2.12.5.
  * Declare compliance with Debian Policy 4.6.0.

 -- Markus Koschany <apo@debian.org>  Tue, 07 Sep 2021 10:09:57 +0200

jackson-databind (2.12.1-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patch
    - Depend on libjackson2-annotations-java (>= 2.12.1)
  * Standards-Version updated to 4.5.1

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 17 Jan 2021 23:46:32 +0100

jackson-databind (2.11.1-1) unstable; urgency=medium

  * New upstream version 2.11.1.
    - Exclude the javadocs from the source tarball because they require more
      than 500 MB disk space.
    - Fixes CVE-2020-9548, CVE-2020-9547, CVE-2020-9546, CVE-2020-8840,
      CVE-2020-14195, CVE-2020-14062, CVE-2020-14061, CVE-2020-14060,
      CVE-2020-11620, CVE-2020-11619, CVE-2020-11113, CVE-2020-11112,
      CVE-2020-11111, CVE-2020-10969, CVE-2020-10968, CVE-2020-10673,
      CVE-2020-10672.
  * Switch to debhelper-compat = 13.
  * Refresh base-pom.patch.
  * Remove README.source.

 -- Markus Koschany <apo@debian.org>  Thu, 09 Jul 2020 13:53:55 +0200

jackson-databind (2.10.2-1) unstable; urgency=medium

  * New upstream version 2.10.2.
  * Declare compliance with Debian Policy 4.5.0.

 -- Markus Koschany <apo@debian.org>  Sun, 16 Feb 2020 14:27:13 +0100

jackson-databind (2.10.1-1) unstable; urgency=medium

  * New upstream version 2.10.1.
  * Drop CVE-2019-16942-and-CVE-2019-16943.patch. Fixed upstream.

 -- Markus Koschany <apo@debian.org>  Sun, 15 Dec 2019 16:07:37 +0100

jackson-databind (2.10.0-2) unstable; urgency=high

  * Fix CVE-2019-16942 and CVE-2019-16943.
    Block two more gadget types (commons-dbcp, p6spy). (Closes: #941530)

 -- Markus Koschany <apo@debian.org>  Thu, 03 Oct 2019 15:48:58 +0200

jackson-databind (2.10.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 2.10.0.
    -Fix CVE-2019-14540 and CVE-2019-16335: Polymorphic Typing issues.
    (Closes: #940498) Thanks to Salvatore Bonaccorso for the report.
  * Declare compliance with Debian Policy 4.4.1.
  * Update base-pom.patch for new release.
  * Remove Wolodja Wentland from Uploaders. Add myself to it. (Closes: #898140)

 -- Markus Koschany <apo@debian.org>  Sun, 29 Sep 2019 21:51:57 +0200

jackson-databind (2.9.9.3-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 2.9.9.3.
    - Fix CVE-2019-14439 and CVE-2019-14379. Thanks to Salvatore Bonaccorso for
      the report. (Closes: #933393)
  * Drop all patches. These are all part of the latest upstream release.
  * Switch to debhelper-compat = 12.
  * Declare compliance with Debian Policy 4.4.0.

 -- Markus Koschany <apo@debian.org>  Tue, 13 Aug 2019 00:26:52 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libjackson2-databind-java`.
