mediawiki (1:1.43.8+dfsg-2) unstable; urgency=medium

  * Cherry-pick upstream patch fixing CVE-2026-34095 mitigation
  * Refresh patches

 -- Taavi Väänänen <taavi@debian.org>  Wed, 08 Apr 2026 20:11:04 +0300

mediawiki (1:1.43.8+dfsg-1) unstable; urgency=medium

  * New upstream version 1.43.8, fixing CVE-2026-5266, CVE-2026-34086,
    CVE-2026-34087, CVE-2026-34088, CVE-2026-34091, CVE-2026-34092,
    CVE-2026-34093, CVE-2026-34094, CVE-2026-34095. This version is not
    affected by CVE-2026-34089, CVE-2026-34090.

 -- Taavi Väänänen <taavi@debian.org>  Thu, 02 Apr 2026 23:14:53 +0300

mediawiki (1:1.43.6+dfsg-2) unstable; urgency=medium

  * Update autopkgtest for new restrictions in apache2 sandboxing

 -- Taavi Väänänen <taavi@debian.org>  Thu, 11 Dec 2025 16:10:10 +0200

mediawiki (1:1.43.6+dfsg-1) unstable; urgency=medium

  * New upstream version 1.43.6, fixing CVE-2025-67475, CVE-2025-67477,
    CVE-2025-67478, CVE-2025-67479, CVE-2025-67480, CVE-2025-67481,
    CVE-2025-67482, CVE-2025-67483, CVE-2025-67484. This version is not
    affected by CVE-2025-67476.
    * Update copyright file for changes in vendor/.

 -- Taavi Väänänen <taavi@debian.org>  Thu, 11 Dec 2025 11:56:33 +0200

mediawiki (1:1.43.5+dfsg-1) unstable; urgency=medium

  * New upstream version 1.43.5, fixing CVE-2025-11173, CVE-2025-61634,
    CVE-2025-61635, CVE-2025-61636, CVE-2025-61637, CVE-2025-61638,
    CVE-2025-61639, CVE-2025-61640, CVE-2025-61641, CVE-2025-61642,
    CVE-2025-61643, CVE-2025-61646, CVE-2025-61652, CVE-2025-61653,
    CVE-2025-61654, CVE-2025-61655, CVE-2025-61656, CVE-2025-61657. This
    version is not affected by CVE-2025-61645.
    * Drop patches merged upstream.
  * Include the font required to render the two-factor authentication enabling
    interface.

 -- Taavi Väänänen <taavi@debian.org>  Fri, 24 Oct 2025 17:05:17 +0300

mediawiki (1:1.43.3+dfsg-1) unstable; urgency=medium

  [ Lucas Werkmeister ]
  * Update package description.

  [ Taavi Väänänen ]
  * New upstream version 1.43.3, fixing CVE-2025-6926, CVE-2025-6927,
    CVE-2025-6589, CVE-2025-6590, CVE-2025-6591, CVE-2025-6592, CVE-2025-6593,
    CVE-2025-6594, CVE-2025-6595, CVE-2025-6596, CVE-2025-6597.
    * Drop merged patches.
    * Drop exclusions for files no longer included in the upstream releases.
  * Use different $wgFooterIcons key to fix display issues on modern skins.

 -- Taavi Väänänen <taavi@debian.org>  Tue, 01 Jul 2025 19:08:37 +0300

mediawiki (1:1.43.1+dfsg-2) unstable; urgency=medium

  * Cherry-pick upstream patch for CVE-2025-32072

 -- Kunal Mehta <legoktm@debian.org>  Fri, 18 Apr 2025 01:10:38 -0400

mediawiki (1:1.43.1+dfsg-1) unstable; urgency=medium

  * New upstream version 1.43.1, fixing CVE-2025-3469, CVE-2025-32696,
    CVE-2025-32697, CVE-2025-32698, CVE-2025-32699 and CVE-2025-32700.
    * Stop fixing permissions during build time for files that no longer
      exist.

 -- Taavi Väänänen <taavi@debian.org>  Thu, 10 Apr 2025 21:48:49 +0300

mediawiki (1:1.43.0+dfsg-2) unstable; urgency=medium

  * Make php-gmp a dependency.

 -- Taavi Väänänen <taavi@debian.org>  Sat, 05 Apr 2025 16:00:04 +0300

mediawiki (1:1.43.0+dfsg-1) unstable; urgency=medium

  [ Kunal Mehta ]
  * New upstream version 1.43.0 (Closes: #1089725)
  * Synchronize upstream/signing-key.asc with
    <https://www.mediawiki.org/keys/keys.txt>

  [ наб ]
  * d/control: Build-Depends: remove dh-buildinfo (see #1068809)

  [ Taavi Väänänen ]
  * Disable MathJax and Special:RestSandbox support due to DSFG issues.
  * Update embedded DomPurify to 2.5.7. (Closes: #1085453)
  * Update policy version to 4.7.2, no changes needed.

 -- Taavi Väänänen <taavi@debian.org>  Fri, 04 Apr 2025 21:11:28 +0300

mediawiki (1:1.39.10-1) unstable; urgency=medium

  * New upstream version 1.39.10

 -- Taavi Väänänen <taavi@debian.org>  Tue, 01 Oct 2024 18:45:38 +0300

mediawiki (1:1.39.8-1) unstable; urgency=medium

  [ Taavi Väänänen ]
  * Update my email address

  [ Kunal Mehta ]
  * New upstream version 1.39.8

 -- Kunal Mehta <legoktm@debian.org>  Sun, 30 Jun 2024 00:01:52 -0400

mediawiki (1:1.39.7-1) unstable; urgency=medium

  * New upstream version 1.39.7, fixing CVE-2024-34506
    and CVE-2024-34507. (Closes: #1064797)
  * Drop obsolete Lintian override for
    package-supports-alternative-init-but-no-init.d-script.
  * Fix ordering in debian/changelog to fix the
    globbing-patterns-out-of-order lintian warning.

 -- Taavi Väänänen <hi@taavi.wtf>  Fri, 29 Mar 2024 13:30:00 +0200

mediawiki (1:1.39.6-1) unstable; urgency=medium

  * New upstream version 1.39.6, fixing CVE-2023-51704.

 -- Taavi Väänänen <hi@taavi.wtf>  Wed, 27 Dec 2023 22:39:20 +0200

mediawiki (1:1.39.5-1) unstable; urgency=medium

  * New upstream version 1.39.5, fixing CVE-2023-3550,
    CVE-2023-45359, CVE-2023-45360, CVE-2023-45361, CVE-2023-45362,
    CVE-2023-45363, CVE-2023-45364.

 -- Kunal Mehta <legoktm@debian.org>  Mon, 09 Oct 2023 15:00:33 -0400

mediawiki (1:1.39.4-2) unstable; urgency=medium

  * Set Breaks/Replaces for mediawiki-extensions-math (Closes: #1039075)

 -- Kunal Mehta <legoktm@debian.org>  Tue, 04 Jul 2023 02:42:01 -0400

mediawiki (1:1.39.4-1) unstable; urgency=medium

  [ Kunal Mehta ]
  * Update apache2 config for PHP 8
  * Set "X-Content-Type-Options: nosniff" header for image directories
  * Remove pre-Apache 2.3 support

  [ Taavi Väänänen ]
  * New upstream version 1.39.4, fixing CVE-2023-29141, CVE-2023-36674
    and CVE-2023-36675.
    * The bundled guzzlehttp/guzzle library was updated to 2.4.5 to fix
      CVE-2023-29197.

 -- Taavi Väänänen <hi@taavi.wtf>  Fri, 30 Jun 2023 19:44:00 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog mediawiki-classes`.
