libxml2 (2.15.3+dfsg-1) unstable; urgency=medium

  * New upstream bug fix release. Closes: #1134866, CVE-2026-6732.
  * d/copyright: refresh contents, drop reference to removed trio files,
    update upstream source URL and copyright years.
  * d/libxml2-16.symbols: stamp xmlRelaxParserSetIncLImit with the
    upstream 2.15.2 introduction version.

 -- Aron Xu <aron@debian.org>  Fri, 05 Jun 2026 20:59:42 +0800

libxml2 (2.15.2+dfsg-0.1) unstable; urgency=high

  * Non-maintainer upload.
  * New upstream bug fix release.
    Security issues:
    - CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
    - CVE-2026-0990 fix: Prevent infinite recursion in
      xmlCatalogListXMLResolve. Closes: #1125695.
    - CVE-2026-0992 fix: Exponential behavior when handling
      parser: Fix infinite loop in xmlCtxtParseContent. Closes: #1125696.
    - CVE-2025-10911 libxslt related: Ignore next/prev of documents when
      traversing XPath
    - CVE-2026-0989 fix: Add RelaxNG include limit. Closes: #1125691.
    - xmlIO: use size_t for buffer size reallocation
    - uri: fix signed integer overflow in xmlBuildRelativeURISafe
    - schematron: fix memory leaks on error paths in xmlSchematronParseRule
    - catalog: fix stack overflow from self-referencing SGML CATALOG entries
    Improvements
    - fuzz: Make fuzzy encoding match more lenient
    - Fix C14N type confusion
    - meson: Fix build with Meson < 1.3
    - xmllint: Use zlib directly
    - xmllint: New option to separate xpath results using null, --xpath0
    - autotools: Make valgrind actually check for leaks
    - meson: Add valgrind test setup
    - Fix xmlOutputBufferGetContent output when encoder is set
    - threads: don't force _WIN32_WINNT to Vista if it's set to a higher value
    - dist: Add generated documentation to the dist as "dist-doc" folder
      to simplify downstream packaging of doc
    - Fix xmlRemoveEntity removing from wrong hash table
    - use duplicating variant in relaxng to mitigate UAF
    - Fix memory leak in xmlTextWriterStartAttributeNS on OOM
    - meson: remove hardcoded buildtype=debug default
    - Fix memory leak of prefix in xmlTextWriterStartElementNS()
    - writer: Add a few extra NULL checks to avoid memory leaks on corrupt
      writer path.
  * Update symbols file.
  * Don't include the sources twice in the libxml2-source package.
  * Bump standards version.

 -- Matthias Klose <doko@debian.org>  Wed, 25 Mar 2026 14:30:48 +0100

libxml2 (2.15.1+dfsg-2ubuntu2) resolute; urgency=medium

  * No-change rebuild to drop Python 3.13 bits.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 20 Mar 2026 12:02:28 +0100

libxml2 (2.15.1+dfsg-2ubuntu1) resolute; urgency=medium

  * SECURITY UPDATE: Infinite recursion with SGML catalogs.
    - debian/patches/CVE-2025-8732.patch: Add catalog depth and checks in
      catalog.c. Add test files in result/catalogs/recursive and
      test/catalogs/recursive.sgml.
    - CVE-2025-8732
  * SECURITY UPDATE: Infinite recursion when resolving include directives in
    RelaxNG parser.
    - debian/patches/CVE-2026-0989.patch: Add xmlRelaxParserSetIncLImit in
      include/libxml/relaxng.h. Add include limit and checks in relaxng.c. Add
      test and test files in runtest.c,
      test/relaxng/include/include-limit.rng,
      test/relaxng/include/include-limit_1.rng,
      test/relaxng/include/include-limit_2.rng, and
      test/relaxng/include/include-limit_3.rng.
    - debian/libxml2-16.symbols: Add new xmlRelaxParserSetIncLImit symbol.
    - CVE-2026-0989
  * SECURITY UPDATE: Infinite recursion in URI dereferencing.
    - debian/patches/CVE-2026-0990.patch: Add MAX_CATAL_DEPTH and other checks
      in catalog.c.
    - CVE-2026-0990
  * SECURITY UPDATE: Uncontrolled resource consumption in catalogs.
    - debian/patches/CVE-2026-0992.patch: Add catalog duplication checks in
      catalog.c.
    - CVE-2026-0992

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 22 Jan 2026 10:26:27 -0330

libxml2 (2.15.1+dfsg-2) unstable; urgency=medium

  * Merges changes from concurrent NMU upload.

  [ Helmut Grohne ]
  * Fix FTBFS with nopython build profile (Closes: #1120104)

  [ Matthias Klose ]
  * d/rules: Add some explicit dependencies for custom build targets
    (Closes: #1105428)

 -- Aron Xu <aron@debian.org>  Wed, 26 Nov 2025 17:25:09 +0800

libxml2 (2.15.1+dfsg-1) unstable; urgency=medium

  * d/patches: drop CVE-2025012863.diff, rejected upstream
    (Closes: #1120364)
  * tests/control: replace pkg-config with pkgconf
  * d/control: remove empty Suggests from libxml2-source

 -- Aron Xu <aron@debian.org>  Sun, 23 Nov 2025 17:13:22 +0800

libxml2 (2.15.1+dfsg-0.4) unstable; urgency=medium

  * Non-maintainer upload.
  * Build a libxml2-source package, to be used to build the libgcobol
    cross runtime packages.
  * Fix a flaw in the xmlSetTreeDoc() function, proposed patch from
    https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012. CVE-2025-12863.

 -- Matthias Klose <doko@debian.org>  Wed, 12 Nov 2025 15:36:35 +0100

libxml2 (2.15.1+dfsg-0.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Disable the version check. Questionable by library handling of the
    distribution.  See https://bugs.debian.org/1072012 for the rationale.

 -- Matthias Klose <doko@debian.org>  Sat, 25 Oct 2025 07:56:14 +0200

libxml2 (2.15.1+dfsg-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Upload to unstable.

 -- Matthias Klose <doko@debian.org>  Fri, 24 Oct 2025 19:15:07 +0200

libxml2 (2.15.1+dfsg-0.1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Wed, 22 Oct 2025 00:23:08 +0200

libxml2 (2.15.0+dfsg-0.3) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.
    - Configure with --with-docs.
    - Add build dependencies for building the docs.
    - The devhelp documentation is not built anymore.
  * Update symbols file.
  * Update libxml2-doc doc-base file.

 -- Matthias Klose <doko@debian.org>  Sun, 05 Oct 2025 12:08:07 +0200

libxml2 (2.14.6+dfsg-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream release, drop git-updates patch.

 -- Matthias Klose <doko@debian.org>  Sun, 05 Oct 2025 09:52:40 +0200

libxml2 (2.14.5+dfsg-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Update to the 2.14 branch 20250826. Closes: #1111626, #1111803.
  * Fix nopython build profile (Helmut Grohne). Closes: #1078673.

 -- Matthias Klose <doko@debian.org>  Tue, 26 Aug 2025 09:31:15 +0200

libxml2 (2.14.5+dfsg-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Update to the 2.14 branch 20250812.
    - CVE-2025-7425: tree: Guard against atype corruption.

 -- Matthias Klose <doko@debian.org>  Wed, 13 Aug 2025 11:52:25 +0200

libxml2 (2.14.5+dfsg-0exp2) experimental; urgency=medium

  * Non-maintainer upload.
  * Explicity configure with --enable-static and install the static
    libxml2.a library. LP: #2118828.

 -- Matthias Klose <doko@debian.org>  Mon, 28 Jul 2025 13:55:39 +0200

libxml2 (2.14.5+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Sat, 19 Jul 2025 11:38:53 +0200

libxml2 (2.14.4+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Sat, 05 Jul 2025 20:59:44 +0200

libxml2 (2.14.3+dfsg-0exp3) experimental; urgency=medium

  * Non-maintainer upload.
  * parser: Fix custom SAX parsers without cdataBlock handler.
    Patch taken from the 2.14 branch. Closes: #1106645.

 -- Matthias Klose <doko@debian.org>  Tue, 03 Jun 2025 21:43:20 +0200

libxml2 (2.14.3+dfsg-0exp2) experimental; urgency=medium

  * Non-maintainer upload.
  * Explicity configure --with-http --with-lzma.
  * Update symbols file.

 -- Matthias Klose <doko@debian.org>  Mon, 02 Jun 2025 13:38:30 +0200

libxml2 (2.14.3+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Tue, 20 May 2025 07:13:43 +0200

libxml2 (2.14.2+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Wed, 23 Apr 2025 07:52:17 +0200

libxml2 (2.14.1+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release. Addresses: #1102294.
  * New package libxml2-16 with new soname.
  * No more conflicts/breaks replaces with libxml2.
  * Update symbols file.
  * Refresh patches.
  * Configure without ICU, see 2.12.7+dfsg+really2.9.14-0.4.
  * Configure --with-readline; --with-history requires it.

 -- Matthias Klose <doko@debian.org>  Mon, 07 Apr 2025 13:48:29 +0200

libxml2 (2.13.3+dfsg-0exp2) experimental; urgency=medium

  * d/control: add Provides: libxml2 (= ${source:Version})
    temporarily to reduce breakage during transition

 -- Aron Xu <aron@debian.org>  Sat, 24 Aug 2024 18:13:02 +0800

libxml2 (2.13.3+dfsg-0exp1) experimental; urgency=medium

  * New upstream release
  * Rename binary package libxml2 to libxml2n for new ABI without
    bumping the actual library SONAME

 -- Aron Xu <aron@debian.org>  Fri, 16 Aug 2024 22:13:37 +0800

libxml2 (2.13.1+dfsg-0exp1) experimental; urgency=medium

  * New upstream release
  * d/libxml2.symbols: update symbols

 -- Aron Xu <aron@debian.org>  Sat, 29 Jun 2024 14:45:40 +0800

libxml2 (2.12.7+dfsg-3) unstable; urgency=medium

  * d/control: replace pkg-config with pkgconf
  * source: override invalid-profile-name-in-source-relation noi18n
  * d/control: versioned Breaks at libxml-libxml-perl

 -- Aron Xu <aron@debian.org>  Wed, 29 May 2024 21:25:11 +0800

libxml2 (2.12.7+dfsg-2) unstable; urgency=medium

  * d/control: Depends on liblzma-dev and zlib1g-dev explicitly
    (Closes: #1071834)

 -- Aron Xu <aron@debian.org>  Sat, 25 May 2024 22:51:40 +0800

libxml2 (2.12.7+dfsg-1) unstable; urgency=medium

  * New upstream version 2.12.7+dfsg
  * CVE-2024-34459: buffer over-read in xmlHTMLPrintFileContext
    (Closes: 1071162).

 -- Aron Xu <aron@debian.org>  Sat, 25 May 2024 11:38:42 +0800

libxml2 (2.12.6+dfsg-0exp2) experimental; urgency=medium

  * Really fix libxml2mod import problem

 -- Aron Xu <aron@debian.org>  Tue, 19 Mar 2024 01:26:06 +0800

libxml2 (2.12.6+dfsg-0exp1) experimental; urgency=medium

  * New upstream version 2.12.6+dfsg
  * d/patches: add python-libadd-fix.patch (Closes: #1059094)
  * d/control: add python3-setuptools to B-D
  * d/rules: disable config.cache caching to make it happy to switch among Python versions
  * d/rules: build extensions for all supported Python3 versions

 -- Aron Xu <aron@debian.org>  Tue, 19 Mar 2024 01:09:12 +0800

libxml2 (2.12.5+dfsg-0exp1) experimental; urgency=medium

  * New upstream version 2.12.5+dfsg
  * d/rules: configure with --with-legacy --with-ftp --with-xptr-locs
    (Closes: #1059040)
  * d/libxml2.symbols: update
  * d/libxml2-doc.doc-base: update html path
  * d/control: remove M-A: same from python3-libxml2

 -- Aron Xu <aron@debian.org>  Thu, 15 Feb 2024 17:44:46 +0800

libxml2 (2.12.3+dfsg-0exp1) experimental; urgency=medium

  [ Mattia Rizzolo ]
  * simplify list of html to install

  [ Bastian Germann ]
  * No icu dependency with noi18n build profile (Closes: #962464)

  [ Aron Xu ]
  * New upstream version 2.12.3+dfsg
  * Remove not needed patches
  * Refresh xml2-config-fix.patch
  * Update d/libxml2-dev.{install,manpages}
  * d/rules: update * remove __pycache__ directory from d/tmp *
    no need to remove files from dh_auto_install-indep
  * d/libxml2.symbols: update symbols
  * Update std-ver to 3.6.2, no change required
  * add source lintian override for documentation HTMLs
  * Update doc-base file to current location
  * Remove links that are not needed anymore
  * Remove lintian overrides that are not needed
  * d/rules: add a dfsg-source-tree target to clean up upstream tree

 -- Aron Xu <aron@debian.org>  Thu, 14 Dec 2023 11:55:58 +0800

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libxml2-source`.
