phpseclib (1.0.30-1) unstable; urgency=medium

  [ terrafrost ]
  * CHANGELOG: add CVE
  * X509: add setURLFetchCallback() method (GHSA-m557-wrgg-6rp4)
  * CHANGELOG: add new release

  [ David Prévot ]
  * Update CVE ID in previous changelog entry

 -- David Prévot <taffit@debian.org>  Tue, 16 Jun 2026 00:12:15 +0200

phpseclib (1.0.29-1) unstable; urgency=medium

  [ terrafrost ]
  * ASN1: reduce length of supported OIDs from 4096 bytes to 128 bytes
    [CVE-2026-44167] (GHSA-3qpq-r242-jqj7)
  * CHANGELOG: add new entry

 -- David Prévot <taffit@debian.org>  Tue, 28 Apr 2026 13:29:16 +0200

phpseclib (1.0.28-1) unstable; urgency=medium

  [ terrafrost ]
  * SSH2: use constant time string comparison in get_binary_packet()
    [CVE-2026-40194]
  * CHANGELOG: add new release

 -- David Prévot <taffit@debian.org>  Fri, 17 Apr 2026 08:09:52 +0200

phpseclib (1.0.27-1) unstable; urgency=medium

  [ terrafrost ]
  * SCP: fix some longstanding issues
  * BigInteger: fix for PHP 8.5 deprecations for BCMath / toBytes()
  * RSA: add support for OpenSSH pub keys with multiple spaces / tabs
  * RSA: fix for PHP 8.5 deprecations for RSA / PSS
  * BigInteger: another PHP 8.5 deprecation fix
  * fix for PHP 8.5 BC breaking changes on 32-bit machines
  * make unpadding constant time [CVE-2026-32935] (Closes: #1131484)
  * X509: add support for organizationIdentifier
  * CHANGELOG: add 1.0.27 release

 -- David Prévot <taffit@debian.org>  Sun, 22 Mar 2026 13:20:40 +0100

phpseclib (1.0.24-1) unstable; urgency=medium

  [ terrafrost ]
  * SFTP: try without path canonicalization if initial realpath() fails
  * SSH2: fix possible infinite loop on packet timeout
  * X509: CRL fixes
  * X509: make the attributes section of new CSRs be blank
  * SSH2: update setPreferredAlgorithms() to accept csv's
  * SSH2: ignore kex-strict-s-v00@openssh.com in key re-exchanges
  * SFTP: convert filenames to strings
  * CHANGELOG: add new release

  [ Jakub Trmota ]
  * Agent: reset supported_private_key_algorithms for every key

  [ Tingsong Xu ]
  * SSH2: handle SSH2_MSG_EXT_INFO out of login.

  [ David Prévot ]
  * Remove Rules-Requires-Root
  * Update Standards-Version to 4.7.2

 -- David Prévot <taffit@debian.org>  Tue, 07 Oct 2025 07:35:02 +0200

phpseclib (1.0.23-6) unstable; urgency=medium

  * Modernize PHPUnit syntax

 -- David Prévot <taffit@debian.org>  Sun, 16 Feb 2025 12:43:15 +0100

phpseclib (1.0.23-5) unstable; urgency=medium

  * Drop php-codesniffer usage for tests

 -- David Prévot <taffit@debian.org>  Tue, 21 Jan 2025 17:03:56 +0100

phpseclib (1.0.23-4) unstable; urgency=medium

  * Group nophpunit11 for tests failing with PHPUnit 11

 -- David Prévot <taffit@debian.org>  Sun, 05 Jan 2025 09:50:49 +0100

phpseclib (1.0.23-3) unstable; urgency=medium

  * Make provider classes static (PHPUnit 11 fix) (Closes: #1070624)

 -- David Prévot <taffit@debian.org>  Thu, 10 Oct 2024 16:52:59 +0100

phpseclib (1.0.23-2) unstable; urgency=medium

  * Fix override
  * Use --require-file for phpabtl (Closes: #1073568)
  * Update Standards-Version to 4.7.0

 -- David Prévot <taffit@debian.org>  Wed, 19 Jun 2024 13:30:24 +0200

phpseclib (1.0.23-1) unstable; urgency=medium

  [ terrafrost ]
  * BigInteger: put guardrails on isPrime() and randomPrime() [CVE-2024-27354]
  * ASN1: limit OID length [CVE-2024-27355] (GHSA-2528-jw5q-ww88)
  * BigInteger: fix getLength()
  * CHANGELOG: add 1.0.23 release

  [ David Prévot ]
  * Mention CVE-2023-48795 in previous changelog entry
  * Force system dependencies loading

 -- David Prévot <taffit@debian.org>  Mon, 26 Feb 2024 22:32:20 +0100

phpseclib (1.0.22-1) unstable; urgency=medium

  [ terrafrost ]
  * ASN1: fix string conversion code for 32-bit PHP installs
  * SFTP: fix SFTPv2 errors when logging errors
  * SFTP: fix issue with get() downloading to files / streams
  * Rijndael: fix for PHP 8.3+ compatability
  * X509: fix for weird characters in subjaltname
  * Crypt/Base: improve ARM detection code
  * SSH2: add support for RFC8308
  * SSH2: only capture login info once
  * SSH2: implement terrapin attack countermeasures [CVE-2023-48795]
  * CHANGELOG: add 1.0.22 release

 -- David Prévot <taffit@debian.org>  Fri, 29 Dec 2023 15:18:58 +0100

phpseclib (1.0.21-2) unstable; urgency=medium

  * Drop failing test on s390x architecture

 -- David Prévot <taffit@debian.org>  Mon, 17 Jul 2023 08:15:00 +0200

phpseclib (1.0.21-1) unstable; urgency=medium

  [ terrafrost ]
  * Tests: add test for connecting to non-existant host
  * Crypt/Base: fix CTR mode with continuous buffer with non-eval PHP
  * RSA: add support for loading PuTTY v3 keys
  * SFTP: try to delete dir even if it can't be opened
  * SFTP: try without path canonicalization if initial realpath() fails
  * Crypt/RSA: add support for loading OpenSSH encrypted keys
  * SSH2: if logging in with rsa-sha2-256/512 fails, try ssh-rsa
  * SFTP: make it so SFTP::RESUME also sets offset of local file
  * SFTP: RESUME_START didn't work as described
  * CHANGELOG: add 1.0.21 release

  [ PetrP ]
  * SFTP: fix chgrp() for version < 4

  [ David Prévot ]
  * Mark package as Multi-Arch: foreign
  * Adapt to recent version of PHPUnit (10)
  * Drop test failing on PHPUnit 10 (Closes: #1039832)
  * Use secure URI in Homepage field.
  * Update standards version to 4.6.2, no changes needed.

 -- David Prévot <taffit@debian.org>  Tue, 11 Jul 2023 13:26:19 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog php-seclib`.
