mercurial (4.5.3-1ubuntu2.2) bionic-security; urgency=medium

  * SECURITY UPDATE: OOB reads
    - debian/patches/CVE-2018-17983.patch: fix OOB read of corrupted manifest
      entry in mercurial/cext/manifest.c.
    - CVE-2018-17983
  * SECURITY UPDATE: Write to arbitrary files outside a repository by using
    symlinks in subrepositories
    - debian/patches/CVE-2019-3902-pre.patch: subrepo: extend path auditing test
      to include more weird patterns (SEC)
    - debian/patches/CVE-2019-3902-1.patch: subrepo: prohibit variable
      expansion on creation of hg subrepo (SEC)
    - debian/patches/CVE-2019-3902-3.patch: subrepo: reject potentially unsafe
      subrepo paths (BC) (SEC)
    - CVE-2019-3902

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Fri, 01 Oct 2021 11:32:41 -0300

mercurial (4.5.3-1ubuntu2.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Integer underflow and overflow.
    - debian/patches/CVE-2018-13347.patch: Protect against underflow.
    - debian/patches/CVE-2018-13347-extras.patch: Protect against overflow.
    - CVE-2018-13347
  * SECURITY UPDATE: Able to start fragment past of the end of original data.
    - debian/patches/CVE-2018-13346.patch: Ensure fragment start is not past
      then end of orig.
    - CVE-2018-13346
  * SECURITY UPDATE: Data mishandling in certain situations.
    - debian/patches/CVE-2018-13348.patch: Be more careful about parsing
      binary patch data.
    - CVE-2018-13348

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 26 Nov 2018 17:38:17 -0200

mercurial (4.5.3-1ubuntu2) bionic; urgency=medium

  * Mark the test-convert-bzr-merges.t as failing (timeout arm64 autopkg test).
  * Correctly pass the test blacklist to the autopkg tests.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 07 Apr 2018 20:37:59 +0200

mercurial (4.5.3-1ubuntu1) bionic; urgency=medium

  * Merge with Debian; remaining changes:
    - Drop hgsubversion test, removed from bionic.
  * Pass the same TESTFLAGS to the autopkg tests, as done for the test
    during package build.
  * Mark the test-http-bad-server.t as failing (Ubuntu ppc64el autopkg test).

 -- Matthias Klose <doko@ubuntu.com>  Sat, 07 Apr 2018 14:48:43 +0200

mercurial (4.5.3-1) unstable; urgency=medium

  * Team upload.
  * New upstream bugfix release

 -- Julien Cristau <jcristau@debian.org>  Thu, 05 Apr 2018 14:25:18 +0200

mercurial (4.5.2-1ubuntu1) bionic; urgency=medium

  * Drop hgsubversion test, removed from bionic.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 28 Mar 2018 04:29:14 +0100

mercurial (4.5.2-1) unstable; urgency=medium

  * Team upload.

  [ Ondřej Nový ]
  * d/copyright: Use https protocol in Format field
  * d/changelog: Remove trailing whitespaces

  [ Julien Cristau ]
  * Add Kevin Bullock's key to debian/upstream/signing-key.asc
  * New upstream release

 -- Julien Cristau <jcristau@debian.org>  Wed, 21 Mar 2018 13:32:27 +0100

mercurial (4.5-1) unstable; urgency=medium

  * New upstream release.
    - Drop libjs-excanvas as no longer used by upstream.

 -- Tristan Seligmann <mithrandi@debian.org>  Sun, 11 Feb 2018 08:51:26 +0200

mercurial (4.4.1-1) unstable; urgency=medium

  * New upstream release.
    - Refresh patches, remove patches applied upstream.
  * Replace rename with file-rename as this is gone from perl.

 -- Tristan Seligmann <mithrandi@debian.org>  Mon, 13 Nov 2017 06:19:31 +0200

mercurial (4.3.1-3) unstable; urgency=high

  * Build with -mno-lra on mips64el to work around #871514.

 -- Tristan Seligmann <mithrandi@debian.org>  Sat, 26 Aug 2017 01:38:11 +0200

# For older changelog entries, run 'apt-get changelog mercurial-common'
