node-undici (8.5.0+dfsg+~cs3.2.0-3) unstable; urgency=medium

  * Declare compliance with policy 4.7.4
  * Remove unused node-tap test dependency
  * Add node-ws to network autopkgtest deps (websocket tests need it)

 -- Xavier Guimard <yadd@debian.org>  Tue, 23 Jun 2026 12:55:08 +0200

node-undici (8.5.0+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Upload to unstable 

 -- Jérémy Lal <kapouer@melix.org>  Sat, 20 Jun 2026 22:54:52 +0200

node-undici (8.5.0+dfsg+~cs3.2.0-1) experimental; urgency=medium

  * New upstream version 8.5.0+dfsg+~cs3.2.0.
    Fixes the following vulnerabilities. Closes: #1140363.
    High severity:
    + CVE-2026-12151: WebSocket DoS via fragment count bypass
    + CVE-2026-9697: TLS certificate validation bypass in SOCKS5 ProxyAgent
    + CVE-2026-6734: Cross-origin request routing via SOCKS5 proxy pool reuse
    Medium severity:
    + CVE-2026-9678: Cross-user information disclosure via shared cache whitespace bypass
    + CVE-2026-9679: HTTP header injection via Set-Cookie percent-decoding
    Low severity:
    + CVE-2026-11525: Set-Cookie SameSite attribute downgrade
    + CVE-2026-6733: HTTP response queue poisoning via keep-alive socket reuse
  * Drop applied patch
  * Refresh patch
  * Drop another test (release.js)

 -- Jérémy Lal <kapouer@melix.org>  Sat, 20 Jun 2026 15:47:40 +0200

node-undici (7.24.6+dfsg+~cs3.2.0-3) unstable; urgency=medium

  * Use upstream patch to improve tls-cert-leak test.

 -- Jérémy Lal <kapouer@melix.org>  Sat, 23 May 2026 15:37:16 +0200

node-undici (7.24.6+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Add patch for @sinonjs/fake-timer 15 (node-sinon 21)

 -- Xavier Guimard <yadd@debian.org>  Tue, 31 Mar 2026 13:51:05 +0200

node-undici (7.24.6+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.24.6+dfsg+~cs3.2.0

 -- Xavier Guimard <yadd@debian.org>  Sun, 29 Mar 2026 20:41:59 +0200

node-undici (7.24.5+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * Declare compliance with policy 4.7.3
  * Drop "Rules-Requires-Root: no"
  * Drop "Priority: optional"
  * New upstream version 7.24.5+dfsg+~cs3.2.0
    Fixes: CVE-2026-2581, CVE-2026-2229, CVE-2026-1528, CVE-2026-1527,
    CVE-2026-1526, CVE-2026-1525, CVE-2025-47279.
    Closes: #1130885, #1130884, #1130883, #1130882, #1130880, #1130879,
    #1105860.

 -- Xavier Guimard <yadd@debian.org>  Mon, 23 Mar 2026 12:45:37 +0100

node-undici (7.18.2+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.18.2+dfsg+~cs3.2.0
    CVE-2026-22036: Unbounded decompression chain in HTTP responses
    via Content-Encoding leads to resource exhaustion. Closes: #1125679.
  * Switch to watch 5
  * Update salsa-ci.yml

 -- Jérémy Lal <kapouer@melix.org>  Thu, 15 Jan 2026 22:23:32 +0100

node-undici (7.16.0+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Tighten dependency on node-llhttp for ci
  * patch: skip tls-cert-leak on i386. Closes: #1117521.

 -- Jérémy Lal <kapouer@melix.org>  Thu, 09 Oct 2025 16:46:37 +0200

node-undici (7.16.0+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.16.0+dfsg+~cs3.2.0.
  * Refresh patch

 -- Jérémy Lal <kapouer@melix.org>  Tue, 07 Oct 2025 10:09:34 +0200

node-undici (7.15.0+dfsg+~cs3.2.0-3) unstable; urgency=medium

  * Fix substvar name in control. Closes: #1115737.

 -- Jérémy Lal <kapouer@melix.org>  Sat, 20 Sep 2025 18:03:56 +0200

node-undici (7.15.0+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Loosen dependency on node-llhttp

 -- Jérémy Lal <kapouer@melix.org>  Mon, 01 Sep 2025 01:59:16 +0200

node-undici (7.15.0+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.15.0+dfsg+~cs3.2.0
  * Unbundle and B-D node-llhttp, and use its wasm blobs
  * Add missing Expat license
  * patch: simplify build and install by using global llhttp
  * Update https-pem test module

 -- Jérémy Lal <kapouer@melix.org>  Fri, 29 Aug 2025 16:25:05 +0200

node-undici (7.3.0+dfsg1+~cs24.12.11-2) unstable; urgency=medium

  * Fix llhttp makefile (shuffle bug) (Closes: #1105523)

 -- Yadd <yadd@debian.org>  Tue, 13 May 2025 22:42:34 +0200

node-undici (7.3.0+dfsg1+~cs24.12.11-1) unstable; urgency=medium

  * New upstream version 7.3.0+dfsg1+~cs24.12.11

 -- Jérémy Lal <kapouer@melix.org>  Sun, 26 Jan 2025 16:18:40 +0100

node-undici (7.2.3+dfsg1+~cs24.12.11-2) experimental; urgency=medium

  * Breaks/Replaces libllhttp9.1. Closes: #1093828.

 -- Jérémy Lal <kapouer@melix.org>  Sat, 25 Jan 2025 12:59:34 +0100

node-undici (7.2.3+dfsg1+~cs24.12.11-1) experimental; urgency=medium

  * New upstream version 7.2.3+dfsg1+~cs24.12.11
  * CVE-2025-22150: Uses Insufficiently Random Values
  * Standards-Version 4.7.0
  * Bump libllhttp soname to 9.2
  * copyright: update paths
  * rules: remove extra LICENSE
  * lintian-overrides: fix paths
  * patches: remove unapplied
  * rules: clean

 -- Jérémy Lal <kapouer@melix.org>  Tue, 21 Jan 2025 19:53:51 +0100

node-undici (7.1.0+dfsg1+~cs24.12.10-1) experimental; urgency=medium

  * New upstream version 7.1.0+dfsg1+~cs24.12.10
  * watch: use llhttp tag
  * node-undici.docs: fix path
  * rules: set WASM_* env vars for Makefile
  * copyright: add cache-tests and dfsg-exclude parts of it
  * Add missing test module @matteo.collina/tspl
  * B-D libclang-rt-dev-wasm32
  * Update fix-llhttp-version.patch
  * Build wasm with simd flag too
  * pkgjs tests:
    + use node --test, reenable many tests
    + bundle @matteo.collina/tspl
    + update selfsigned module, default to 2048 key
    + control: proxyquire becomes proxy-agent

 -- Jérémy Lal <kapouer@melix.org>  Tue, 10 Dec 2024 16:04:19 +0100

node-undici (5.28.4+dfsg1+~cs23.12.11-2) unstable; urgency=medium

  * Team upload
  * Fix fix-wasm-build.patch
  * Clean obj-* directory
  * Build with upstream script. Closes: #1068842
  * Drop fix_perms llhttp.wasm, not installed

 -- Jérémy Lal <kapouer@melix.org>  Fri, 12 Apr 2024 12:05:59 +0200

node-undici (5.28.4+dfsg1+~cs23.12.11-1) unstable; urgency=medium

  * New upstream version (Closes: CVE-2024-30261)
  * Refresh patches

 -- Yadd <yadd@debian.org>  Fri, 05 Apr 2024 15:26:06 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-6) unstable; urgency=medium

  * Update homepages
  * Drop test/connect-timeout.js from network test (unstable test in debci env)
  * Clean build links

 -- Yadd <yadd@debian.org>  Mon, 22 Jan 2024 14:45:20 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-5) unstable; urgency=medium

  * Drop dependency to node-busboy

 -- Yadd <yadd@debian.org>  Sun, 21 Jan 2024 06:57:54 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-4) unstable; urgency=medium

  * Build libllhttp (Closes: #977716)
    + add patch to export SONAME
    + add libllhttp9 and libllthhp-dev
    + update lintian overrides
    + add build dependency to cmake
  * Fix permissions

 -- Yadd <yadd@debian.org>  Sat, 20 Jan 2024 08:50:46 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-3) unstable; urgency=medium

  * Source-only upload

 -- Yadd <yadd@debian.org>  Sun, 03 Dec 2023 07:07:30 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-2) unstable; urgency=medium

  * Build and publish undici-types, needed by new @types/node
  * Binary upload

 -- Yadd <yadd@debian.org>  Sat, 02 Dec 2023 22:34:40 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-1) unstable; urgency=medium

  * New upstream version 5.28.2+dfsg1+~cs23.11.12.3
  * Refresh patches

 -- Yadd <yadd@debian.org>  Sat, 02 Dec 2023 22:01:17 +0400

node-undici (5.28.0+dfsg1+~cs23.11.12.3-2) unstable; urgency=medium

  * Update lintian overrides
  * Add patch to workaround nodejs bug
    (fixes nodejs build, thanks to Jérémy Lal)

 -- Yadd <yadd@debian.org>  Mon, 27 Nov 2023 15:45:33 +0400

node-undici (5.28.0+dfsg1+~cs23.11.12.3-1) unstable; urgency=medium

  * New upstream version 5.28.0+dfsg1+~cs23.11.12.3
  * Drop workaround-node-bug.patch
  * Update build
  * Drop some failing test

 -- Yadd <yadd@debian.org>  Sun, 26 Nov 2023 08:07:47 +0400

node-undici (5.26.3+dfsg1+~cs23.10.12-3) unstable; urgency=medium

  * Add fix for node-proxy >= 2

 -- Yadd <yadd@debian.org>  Thu, 23 Nov 2023 11:38:43 +0400

node-undici (5.26.3+dfsg1+~cs23.10.12-2) unstable; urgency=medium

  * Add wokaround to nodejs bug (unable to require node:*)

 -- Yadd <yadd@debian.org>  Sat, 14 Oct 2023 14:49:40 +0400

node-undici (5.26.3+dfsg1+~cs23.10.12-1) unstable; urgency=medium

  * Embed @fastify/busboy
  * New upstream version (Closes: #1053879, CVE-2023-45143)
  * Unfuzz patches
  * Fix for clang 16 (Closes: #1052723)
  * Update copyright
  * Update lintian overrides
  * Update test

 -- Yadd <yadd@debian.org>  Fri, 13 Oct 2023 22:03:31 +0400

node-undici (5.22.1+dfsg1+~cs20.10.10.2-1) unstable; urgency=medium

  [ Michael R. Crusoe ]
  * Drop unused libsimde-dev from build dependencies

  [ Yadd ]
  * Update wasm exclusion
  * New upstream version 5.22.1+dfsg1+~cs20.10.10.2
  * Update test
  * Refresh patches
  * Update lintian overrides

 -- Yadd <yadd@debian.org>  Sun, 09 Jul 2023 15:08:57 +0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog node-undici`.
