protobuf (3.21.12-16) unstable; urgency=medium

  [ Adrian Bunk <bunk@debian.org> ]
  * Fix CVE-2026-0994: JSON recursion depth bypass (closes: #1126302).
  * Fix CVE-2026-6409: PHP Denial of Service (closes: #1134895).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 21 Jun 2026 15:36:07 +0200

protobuf (3.21.12-15) unstable; urgency=medium

  [ Adrian Bunk <bunk@debian.org> ]
  * Disable the Python C extension, falling back to pure Python code
    (closes: #1123248).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 11 Jan 2026 19:18:49 +0100

protobuf (3.21.12-14) unstable; urgency=high

  * Complete fix of CVE-2025-4565 (closes: #1115787):
    - make pure Python reject unmatched end-group tag in unknown fields,
    - internal pure python fixes.
  * Remove now redundant Rules-Requires-Root value.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Mon, 29 Sep 2025 14:11:47 +0200

protobuf (3.21.12-13) unstable; urgency=medium

  [ Adrian Bunk <bunk@debian.org> ]
  * Backport fix for FTBFS on multiple architectures with GCC 15
    (closes: #1115415).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 17 Sep 2025 07:10:32 +0200

protobuf (3.21.12-12) unstable; urgency=high

  [ Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> ]
  * Complete fix of CVE-2024-7254 (closes: #1082381):
    - add recursion checks and recursion limit,
    - add tests.

  [ Laszlo Boszormenyi (GCS) ]
  * Fix CVE-2025-4565: data containing an arbitrary number of recursive
    groups, recursive messages or a series of SGROUP tags can be corrupted
    by exceeding the Python recursion limit (closes: #1108057).
  * Update Standards-Version to 4.7.2 .

  [ zhangdandan <zhangdandan@loongson.cn> ]
  * Add loongarch64 support (closes: #1104293).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Tue, 16 Sep 2025 18:19:06 +0200

protobuf (3.21.12-11) unstable; urgency=high

  * Fix CVE-2024-7254: when parsing unknown fields in the Protobuf Java Lite
    and Full library, a maliciously crafted message can cause a StackOverflow
    error and lead to a program crash (closes: #1082381).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Tue, 29 Apr 2025 21:27:02 +0200

protobuf (3.21.12-10) unstable; urgency=medium

  * Disable Python self-testing for not being compatible with new setuptools
    versions (closes: #1058327, #1080225).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 13 Oct 2024 12:12:52 +0200

protobuf (3.21.12-9) unstable; urgency=medium

  * Rebuild against newer dh-elpa (closes: #1077116).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 26 Jul 2024 03:51:59 +0000

protobuf (3.21.12-8.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Move dh-elpa and pkg-php-tools to B-D-Indep (Closes: #1062840, #1062847).
  * Fix /usr/share/doc/{libprotoc,libprotobuf}-dev symlinks.

 -- Andrey Rakhmatullin <wrar@debian.org>  Tue, 19 Mar 2024 22:24:42 +0500

protobuf (3.21.12-8.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1063289

 -- Benjamin Drung <bdrung@debian.org>  Thu, 29 Feb 2024 21:15:00 +0000

protobuf (3.21.12-8) unstable; urgency=medium

  [ Meng Sang <sangmeng@loongson.cn> ]
  * Added 'loong64' to enable specific build options (closes: #1052384).

  [ Matthias Klose <doko@ubuntu.com> ]
  * Fix tests for Python 3.12 (closes: #1055549).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 08 Nov 2023 17:59:09 +0100

protobuf (3.21.12-7) unstable; urgency=medium

  [ Aurelien Jarno <aurelien@aurel32.net> ]
  * Python: stop using backward compatibility timezones (closes: #1050937).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 08 Sep 2023 02:21:34 +0000

protobuf (3.21.12-6) unstable; urgency=medium

  * Add dependency to libprotobuf-java package (closes: #1040260).
  * Use javahelper architecture independent way.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Tue, 04 Jul 2023 18:02:00 +0200

protobuf (3.21.12-5) unstable; urgency=medium

  * Move javahelper to Build-Depends (closes: #1039959).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 01 Jul 2023 08:38:59 +0200

protobuf (3.21.12-4) unstable; urgency=medium

  [ Pierre Gruet <pgt@debian.org> ]
  * Removing the dependency on j2objc in the pom.xml file of protobuf-util.jar
  * Having test scope for junit in the pom.xml file of protobuf-util.jar
  * Building with javahelper to fill in the classpath of the built jar
    (closes: #1039521).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 29 Jun 2023 21:47:51 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog elpa-protobuf-mode`.
