pypy3 (7.3.23+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.

 -- Stefano Rivera <stefanor@debian.org>  Wed, 27 May 2026 20:46:36 -0400

pypy3 (7.3.22+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.
  * Drop patch upstream/ppc-s390x-jit, superseded upstream.
  * Bump Standards-Version to 4.7.4, no changes needed.
  * Update copyright.
  * Patches for security issues:
    - CVE-2026-1502: Reject CR/LF in HTTP tunnel request headers
    - CVE-2026-2297: Ensure SourcelessFileLoader uses io.open_code
    - CVE-2026-4519: Reject leading dashes in webbrowser URLs
    - CVE-2026-4786: Fix webbrowser `%action` substitution bypass of
      dash-prefix check.

 -- Stefano Rivera <stefanor@debian.org>  Wed, 29 Apr 2026 00:11:49 -0400

pypy3 (7.3.21+dfsg-4) unstable; urgency=medium

  * Comedy of uploads.
  * Actually enable the JIT on ppc64el and s390x.

 -- Stefano Rivera <stefanor@debian.org>  Fri, 20 Mar 2026 16:58:35 -0400

pypy3 (7.3.21+dfsg-3) unstable; urgency=medium

  * Unbundle expat again.
  * Patch: Fix the JIT on ppc64el and s390x.

 -- Stefano Rivera <stefanor@debian.org>  Fri, 20 Mar 2026 16:57:04 -0400

pypy3 (7.3.21+dfsg-2) unstable; urgency=medium

  * Disable JIT on s390x, as it can't currently translate, either.

 -- Stefano Rivera <stefanor@debian.org>  Fri, 20 Mar 2026 07:44:38 -0400

pypy3 (7.3.21+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.
  * Drop patches superseded upstream:
    stdlib/CVE-2025-6069-htmlparser-quadratic-processing,
    stdlib/astcompiler-test, and stdlib/astcompiler-fix.
  * Bundle pycparser 2.23 as an extra orig component, for translation. Version
    3 is no longer compatible with Python 2.x.
  * Allow PyPy3 to bundle expat, our unbundling patch isn't working any more.
  * Disable JIT on ppc64el, as it can't currently translate.
  * Bump Standards-Version to 4.7.3, drop Priority: optional.
  * Drop Rules-Requires-Root, no longer needed.

 -- Stefano Rivera <stefanor@debian.org>  Thu, 19 Mar 2026 20:37:50 -0400

pypy3 (7.3.20+dfsg-4) unstable; urgency=medium

  * Patch: Fix AssertionError in AST Compiler (Closes: #1119266).

 -- Stefano Rivera <stefanor@debian.org>  Tue, 28 Oct 2025 17:14:54 +0200

pypy3 (7.3.20+dfsg-3) unstable; urgency=medium

  * Build cpython2.7 with --std=c17 (Closes: #1097670)

 -- Stefano Rivera <stefanor@debian.org>  Mon, 08 Sep 2025 18:28:00 +0200

pypy3 (7.3.20+dfsg-2) unstable; urgency=medium

  * Upload to unstable.

 -- Stefano Rivera <stefanor@debian.org>  Sat, 16 Aug 2025 18:43:53 +0200

pypy3 (7.3.20+dfsg-1) experimental; urgency=medium

  * New upstream release.
    - Fixes: CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517, and
      CVE-2024-12718.
    - Upload to experimental, due to the freeze.
  * Refresh patches.
  * Drop patch for CVE-2025-0938, superseded upstream.
  * Patch for CVE-2025-6069: Fix quadratic complexity in processing special
    input in HTMLParser.

 -- Stefano Rivera <stefanor@debian.org>  Sat, 05 Jul 2025 17:00:41 +0200

pypy3 (7.3.19+dfsg-2) unstable; urgency=medium

  * Drop test depends on python3-wheel-whl, setuptools has native bdist_wheel
    support.

 -- Stefano Rivera <stefanor@debian.org>  Thu, 10 Apr 2025 21:01:39 -0400

pypy3 (7.3.19+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.
  * Drop patches: upstream/path-max, upstream/gcc-14-vmprof,
    upstream/gcc-14-sqlite3, upstream/vimprof-riscv, all superseded upstream.
  * Revert the change for the missed rename from 3.10 to 3.11, upstream.
  * Update copyright.

 -- Stefano Rivera <stefanor@debian.org>  Wed, 26 Feb 2025 17:27:18 -0400

pypy3 (7.3.18+dfsg-2) unstable; urgency=medium

  * Patch: Fix vmprof build on riscv64.
  * Patch: Fix CVE-2025-0938: Disallow square brackets in domain names in
    urllib.parse.

 -- Stefano Rivera <stefanor@debian.org>  Mon, 10 Feb 2025 09:08:23 -0400

pypy3 (7.3.18+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Switch to the 3.11-compatible version.
  * Refresh patches.
  * Drop patches debian/prefer-static-sysconfigdata,
    stdlib/CVE-2023-27043-email-parseaddr,
    stdlib/CVE-2024-9287-venv-activation-templates, tests/test_email_kyiv, and
    tests/test_time_kyiv. Superseded upstream.
  * Patches: Avoid new compilation failures with GCC-14.
  * Handle a missed rename from 3.10 to 3.11, upstream.
  * Update copyright.

 -- Stefano Rivera <stefanor@debian.org>  Sat, 08 Feb 2025 16:37:47 -0400

pypy3 (7.3.17+dfsg-3) unstable; urgency=medium

  * Avoid writing build environment paths into _sysconfigdata.
  * Do a wide build of Python 2.7 for the translation.
  * Patch: CVE-2024-9287: Quote path names in venv activation scripts.
    (Closes: #1089117)
  * Patch: CVE-2023-27043: Parse email addresses with special characters,
    correctly. (Closes: #1072179)

 -- Stefano Rivera <stefanor@debian.org>  Thu, 05 Dec 2024 19:29:26 -0400

pypy3 (7.3.17+dfsg-2) unstable; urgency=medium

  * Patch, work-around FTBFS on 32-bit archs with GCC-14 by suppressing
    -Wincompatible-pointer-types.

 -- Stefano Rivera <stefanor@debian.org>  Sat, 31 Aug 2024 14:43:58 +0200

pypy3 (7.3.17+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.
  * Drop patches, superseded upstream: bdist-wininst-notfound,
    ensurepip-wheels, test_readline-invalidterminal,
    rlcompleter-invalidterminal, null-pointer-constfold.
  * Call dpkg with LC_ALL=C.UTF8 (LP: #2075337)
  * Switch to the 3.10-compatible version (Closes: #1072016)
    - graminit.h is no longer generated.
  * Drop bdist_wininst *.exe files from exclusion, they were dropped upstream.
  * Drop patch ctypes-arm, superseded upstream in 2.7.5.
  * Move ensurepip module into pypy3-venv.
  * New patch sysconfig-debian-schemes, taking over part of
    distutils-install-layout.
  * Drop plat-gnukfreebsd, Debian GNU/kFreeBSD is no longer being developed.
  * Enable continuation and JIT on RISC-V 64.
  * Handle site-packages/README.txt rename.
  * Bump Standards-Version to 4.7.0, no changes needed.
  * Build-Depend on pkgconf instead of pkg-config.
  * Patch: Simplify the sysconfigdata name when multiarch.
  * Build and install sysconfigdata.
  * Patch: Use static sysconfigdata.
  * Configure WHEEL_PKG_DIR in sysconfigdata.
  * Patches: Use Europe/Kyiv as a test timezone.
  * Build-Depend on tzdata.

 -- Stefano Rivera <stefanor@debian.org>  Fri, 30 Aug 2024 20:10:59 +0200

pypy3 (7.3.16+dfsg-2) unstable; urgency=medium

  * Patch: Fix a constant folding bug that caused FTBFS on s390x.

 -- Stefano Rivera <stefanor@debian.org>  Fri, 26 Apr 2024 09:12:11 -0400

pypy3 (7.3.16+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.
  * De-vendor expat (vendored upstream in 7.3.16)
  * Update copyright
  * Handle .devX cffi versions.
  * Upstream dropped pystone.py.

 -- Stefano Rivera <stefanor@debian.org>  Wed, 24 Apr 2024 15:35:11 -0400

pypy3 (7.3.15+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.
  * Update copyright.
  * Upstream migrated to GitHub, update metadata.
  * Migrate orig tarball building to uscan.
  * Drop Build-Depends on dh-autoreconf, no longer needed.
  * Bump Standards-Version to 4.6.2, no changes needed.

 -- Stefano Rivera <stefanor@debian.org>  Thu, 18 Jan 2024 13:13:42 -0400

pypy3 (7.3.14+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.
  * Update copyright.
  * Build-Depend on python3-sphinx-rtd-theme and python3-sphinx-issues.
  * Reorganize tests to run pypyjit tests that need pycparser earlier.
  * Clean another lextab and yacctab location.

 -- Stefano Rivera <stefanor@debian.org>  Mon, 25 Dec 2023 15:41:10 -0400

pypy3 (7.3.13+dfsg-1) unstable; urgency=medium

  * New upstream release.
    - Fixes CVE-2023-40217.
  * Refresh patches.
  * Patch: Support Sphinx 7.1 by specifying a substitutable caption for
    extlinks (Closes: #1042638)

 -- Stefano Rivera <stefanor@debian.org>  Fri, 29 Sep 2023 16:38:27 +0200

pypy3 (7.3.12+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.

 -- Stefano Rivera <stefanor@debian.org>  Fri, 16 Jun 2023 14:15:58 -0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog pypy3-lib`.
