jackson-databind (2.14.0+ds-2) unstable; urgency=medium

  [ Otto Kekäläinen ]
  * Enable Salsa CI to help avoid testable regressions before upload to Debian
  * Fix broken Homepage link and add current upstream metadata.  The site
    wiki.fasterxml.com no longer exists. Replace it with link to the current
    wiki location. Also add a metadata file following DEP-12, so it is easier
    for both maintainers to find the correct upstream websites, as well as for
    `git-buildpackage --add-upstreamvcs` feature to work.
  * Define Debian packaging repository conventions in gbp.conf.
    Add a git-buildpackage config file to show explicitly what conventions this
    Debian source package repository uses. This way it is easier for current
    maintainer to do e.g. new upstream version imports, as there are less
    arguments that need to be passed to `gbp` commands, and also for any future
    maintainer/contributor there is less guesswork.

  [ Markus Koschany ]
  * Add CVE-2025-52999.patch and fix a FBTFS due to changes in jackson-core.
    (Closes: #1135410)

 -- Markus Koschany <apo@debian.org>  Sat, 06 Jun 2026 14:07:23 +0200

jackson-databind (2.14.0+ds-1) unstable; urgency=medium

  * Team upload.
  * Use java_compat_level from /usr/share/java/java_defaults.mk to set the
    target compiled classes version. (Closes: #1088270)
  * Promote Standards-Version to 4.7.0 without changes.
  * Repack sources without newly excluded files and update configuration for
    importing new releases.

 -- Julien Plissonneau Duquène <sre4ever@free.fr>  Tue, 26 Nov 2024 17:34:44 +0000

jackson-databind (2.14.0-1) unstable; urgency=medium

  * New upstream version 2.14.0.
    - Fix CVE-2022-42003:
      Resource exhaustion can occur because of a lack of a check in primitive
      value deserializers to avoid deep wrapper array nesting, when the
      UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
    - Fix CVE-2022-42004:
      Resource exhaustion can occur because of a lack of a check in
      BeanDeserializer._deserializeFromArray to prevent use of deeply nested
      arrays. An application is vulnerable only with certain customized choices
      for deserialization.
  * Declare compliance with Debian Policy 4.6.1.

 -- Markus Koschany <apo@debian.org>  Fri, 11 Nov 2022 23:19:39 +0100

jackson-databind (2.13.2.2-1) unstable; urgency=medium

  * New upstream version 2.13.2.2.
    - Fix CVE-2020-36518: Java StackOverflow exception and denial of service
      via a large depth of nested objects. (Closes: #1007109)
      Thanks to Neil Williams for the report.

 -- Markus Koschany <apo@debian.org>  Sat, 30 Apr 2022 14:05:08 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libjackson2-databind-java`.
