pgbouncer (1.25.2-1) unstable; urgency=medium

  [ Bradford D. Boyle ]
  * New upstream version 1.25.2.
    - Security
      * Fix CVE-2026-6664: An integer overflow in network packet parsing code
        in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a
        crash. An unauthenticated remote attacker can crash PgBouncer with a
        malformed SCRAM authentication packet.
      * Fix CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not
        check the return value of strlcat() correctly when building the
        contents of the SCRAM client-final-message. A malicious backend that
        sends a SCRAM server-final-message with a long nonce can trigger a
        stack overflow.
      * Fix CVE-2026-6666: A possible null pointer reference in PgBouncer
        before 1.25.2 could lead to a crash, if a server sends an error
        response without SQLSTATE field.
      * Fix CVE-2026-6667: PgBouncer before 1.25.2 did not perform an
        appropriate authorization check for the KILL_CLIENT admin command. All
        users with access to the administration console (which itself requires
        authorization) could run this command. It would have been correct to
        allow only users listed in the admin_users parameter.
    - Fixes
      * Clarify documentation of default_pool_size parameter.
      * Correct documentation regarding client_tls13_ciphers and
        server_tls13_ciphers.

 -- Christoph Berg <myon@debian.org>  Sat, 09 May 2026 14:09:02 +0200

pgbouncer (1.25.1-1) unstable; urgency=medium

  * New upstream version 1.25.1.
  * Run tests in C.UTF-8.

 -- Christoph Berg <myon@debian.org>  Wed, 03 Dec 2025 19:20:51 +0100

pgbouncer (1.25.0-2) unstable; urgency=medium

  * Run tests with psql -X.
  * Mark test/test_misc.py::test_notify_queue as xfail on big-endian archs.

 -- Christoph Berg <myon@debian.org>  Fri, 21 Nov 2025 14:14:22 +0000

pgbouncer (1.25.0-1) unstable; urgency=medium

  [ Bradford D. Boyle ]
  * New upstream version. (Closes: #1120176)

  [ Christoph Berg ]
  * Cherry-pick: Add missing typedefs for architectures with SIMD support.

 -- Christoph Berg <myon@debian.org>  Wed, 12 Nov 2025 22:39:50 +0100

pgbouncer (1.24.1-1) unstable; urgency=medium

  [ Christoph Berg ]
  * B-D on libsystemd-dev on Linux only.

  [ Bradford D. Boyle ]
  * New upstream version 1.24.1.
    - Security
      * Fix CVE-2025-2291: Account for VALID UNTIL in auth_query.
        (Closes: #1103394)
    - Fixes
      * Fix PAM support by reverting pam authentication support in HBA file.
      * Fix bug when decrementing user connection count. This was included in
        the tag of 1.24.0 on GitHub, but the release tarball did not contain
        this fix.
      * Add test_load_balance_hosts.py to the tarball.
      * Fix issues with tests to allow them to be run by Debian packagers.
    - Docs
      * Update auth_query example to set a safe search_path.

 -- Christoph Berg <myon@debian.org>  Thu, 17 Apr 2025 10:21:09 +0200

pgbouncer (1.24.0-3) unstable; urgency=medium

  * Limit to 64-bit architectures.

 -- Christoph Berg <myon@debian.org>  Wed, 12 Mar 2025 17:19:10 +0100

pgbouncer (1.24.0-2) unstable; urgency=medium

  [ Bradford D. Boyle ]
  * Skip tests for Close messages on psycopg < 3.2

  [ Christoph Berg ]
  * Mark test dependencies with <!nocheck>.

 -- Christoph Berg <myon@debian.org>  Wed, 12 Mar 2025 15:40:12 +0100

pgbouncer (1.24.0-1) unstable; urgency=medium

  [Bradford D. Boyle]
  * Team upload.
  * New upstream version 1.24.0.

  [Brian Cosgrove]
  * Ensure that the main test suite does in fact run during debbuild (Closes:
    #1085109)

 -- Bradford D. Boyle <bradford.d.boyle@gmail.com>  Tue, 04 Feb 2025 14:37:23 +0100

pgbouncer (1.23.1-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.23.1.
    - Fixes:
      * Fix a possible segmentation fault after PgBouncer reloads its
        configuration.
      * Fix all known put_in_order crashes.
      * Add missing files to release tarball that are required for testing.

 -- Bradford D. Boyle <bradford.d.boyle@gmail.com>  Sat, 03 Aug 2024 10:27:34 +0300

pgbouncer (1.23.0-1) unstable; urgency=medium

  * Team upload.
  * New Upstream Release

 -- Bradford D. Boyle <bradford.d.boyle@gmail.com>  Thu, 04 Jul 2024 12:45:59 +0200

pgbouncer (1.22.1-1) unstable; urgency=medium

  * New upstream version 1.22.1.
  * B-D on pkgconf.

 -- Christoph Berg <myon@debian.org>  Wed, 17 Apr 2024 23:23:56 +0200

pgbouncer (1.22.0-1) unstable; urgency=medium

  * New upstream version 1.22.0.
  * Remove lsb-base dependency.

 -- Christoph Berg <myon@debian.org>  Fri, 09 Feb 2024 12:18:10 +0100

pgbouncer (1.21.0-1) unstable; urgency=medium

  * New upstream version 1.21.0.

 -- Christoph Berg <myon@debian.org>  Tue, 17 Oct 2023 15:33:06 +0200

pgbouncer (1.20.1-1) unstable; urgency=medium

  * New Upstream Release
    - Fixes:
      * Fix regression where putting options inside ignore_startup_parameters
        would not ignore unknown parameters inside the options startup
        parameter anymore.
      * Fix confusing typo in the docs.

 -- Bradford D. Boyle <bradford.d.boyle@gmail.com>  Wed, 27 Sep 2023 08:22:41 +0200

pgbouncer (1.20.0-1) unstable; urgency=medium

  * New upstream version.
    + Deprecates online restart, give up on fixing the service file for it.
      (Closes: #813487)

 -- Christoph Berg <myon@debian.org>  Tue, 25 Jul 2023 16:53:22 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog pgbouncer`.
