redmine (3.4.4-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: persistent XSS exists due to textile formatting
    - debian/patches/0020-Fix-CVE-2019-17427.patch: improve the way
      that html tags are identified to be escaped. (LP: #1853063)
    - CVE-2019-17427
    - https://www.cvedetails.com/cve/CVE-2019-17427/
    - Redmine Defect #31520

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Mon, 25 Nov 2019 20:17:10 +0000

redmine (3.4.4-1) unstable; urgency=medium

  [ Marc Dequènes (Duck) ]
  * New upstream release:
    + refreshed patches.
    + fix CVE-2017-15568 (Closes: #882544)
    + fix CVE-2017-15569 (Closes: #882545)
    + fix CVE-2017-15570 (Closes: #882547)
    + fix CVE-2017-15571 (Closes: #882548)
    + fix CVE-2017-18026 (Closes: #887307)
  * Add missing dependency on 'libjs-raphael' (Closes: #857952).
  * Updated Russian translation of debconf template, thanks Lev Lamberov
    (Closes: #883919)
  * Updated VCS URLs (Alioth->Salsa).

  [ Lucas Kanashiro ]
  * Bump debhelper compatibility level to 10
  * Declare compliance with Debian Policy 4.1.3

 -- Marc Dequènes (Duck) <Duck@DuckCorp.org>  Mon, 02 Apr 2018 13:52:08 +0900

redmine (3.4.2-1) unstable; urgency=medium

  [ Antonio Terceiro ]
  * New upstream release
  * Refresh patches
    - drop 0006-Bulk-edit-show-fields-required-after-status-tracker-.patch,
      issue fixed upstream

  [ Marc Dequènes (Duck) ]
  * Thanks Antonio for the hard work. Lucas, the team, and myself are
    now taking over.
  * Use HTTPS URLs in Debian metadata.
  * Priority 'extra' is deprecated, switch to 'optional'.
  * Bumped Standards-Version.
  * Reload all Passenger instances (Closes: #879104).
  * Pass instance list to postrm to ensure removal works when things are
    broken (found in #868955).
  * Support dbconfig-no-thanks.
  * Do not fail if manual database installation is selected (Closes:
    #868955).
  * Fix executable-not-elf-or-script for 'mail_handler.rb'.

  [ Lucas Kanashiro ]
  * debian/copyright: fix path of redcloth3.rb file
  * Fix typo in Debian README
  * debian/rules: override dh_fixperms to change some files permission
  * debian/control: remove autopkgtest field, it is not necessary since the
    debian/tests/control file exists

 -- Marc Dequènes (Duck) <Duck@DuckCorp.org>  Mon, 20 Nov 2017 20:33:48 +0900

redmine (3.3.1-4) unstable; urgency=medium

  [ Antonio Terceiro ]
  * debian/tests/install-purge-install: let autopkgtest handle the first
    installation. This improves the reliability of the test because
    autopkgtest handles temporary download failures in APT for us

  [ Jonatan Nyberg ]
  * Swedish translation update (Closes: #855367)

  [ Helge Kreutzmann ]
  * German translation update (Closes: #857527)

 -- Antonio Terceiro <terceiro@debian.org>  Tue, 07 Mar 2017 15:54:28 +0100

redmine (3.3.1-3) unstable; urgency=medium

  [ Beatrice Torracca ]
  * Italian translation update (Closes: #846978)

  [ Antonio Terceiro ]
  * debian/postrm: restore purging of configuration files created by
    dbconfig-common (Closes: #852130)
    - add a autopkgtest for install/purge/install

  [ Thomas Klose ]
  * Backport upstream patch to fix Bulk Edit functionality when changing
    between statuses that have different sets of read-only/mandatory fields.
    (Closes: #852694)

 -- Antonio Terceiro <terceiro@debian.org>  Mon, 13 Feb 2017 14:19:50 -0200

redmine (3.3.1-2) unstable; urgency=medium

  [ Antonio Terceiro ]
  * debian/postinst: touch tmp/restart.txt, so that when running under
    passenger, redmine is automatically restarted on upgrades.
  * debian/README.source: removed (obsolete)
  * debian/README.Debian: revamp documentation
  * debian/source/lintian-overrides: override lintian false positive:
    public/javascripts/project_identifier.js is NOT minified Javascript.

  [ Joe Dalton ]
  * Danish translation update (Closes: #830593)

  [ Frans Spiesschaert ]
  * Dutch translation update (Closes: #837098)

 -- Antonio Terceiro <terceiro@debian.org>  Sat, 26 Nov 2016 00:21:19 -0200

redmine (3.3.1-1) unstable; urgency=medium

  * New upstream release
    + Refresh patches
  * debian/README.Debian: note that rake commands must be run from inside
    /usr/share/redmine
  * redmine-mysql: switch dependency from mysql-client to
    default-mysql-client, and suggestion from mysql-server to
    default-mysql-server.
  * debian/postinst: generate random secret with Ruby instead of OpenSSL
    directly. For some reason this fixes the autopkgtest tests under LXC.

 -- Antonio Terceiro <terceiro@debian.org>  Sat, 12 Nov 2016 20:50:38 -0200

redmine (3.2.3-2) unstable; urgency=medium

  * debian/postinst: handle dependency check failure when triggered, to avoid
    breaking in the middle of dist-upgrades.
  * 0004-Add-multi-tenancy-support.patch: don't try to load files that are not
    readable (Closes: #826663)
  * Drop dependency on ruby-awesome-nested-set, not actually used anymore

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 12 Jun 2016 20:55:01 -0300

redmine (3.2.3-1) unstable; urgency=medium

  * New upstream release
    - refresh patches
  * 0004-Add-multi-tenancy-support.patch: include support for plugin assets
    (Closes: #820875)
  * debian/postinst: always run plugin migrations
  * debian/doc/examples/apache2-*.conf: configure the plugin_assets directory
    to be accessible to HTTP clients.
  * debian/tests/control: add a test case for plugins, using
    redmine-plugin-custom-css as an example.
  * new dependency: ruby-mimemagic

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 05 Jun 2016 14:29:22 -0300

redmine (3.2.1-2) unstable; urgency=medium

  [ Jonatan Nyberg ]
  * Swedish translation update (Closes: #819743)

  [ Antonio Terceiro ]
  * 0004-Add-multi-tenancy-support.patch: load dependencies for all database
    drivers used by all Redmine instances (Closes: #819815)
  * 0005-Assume-default-instance.patch: remove change to Gemfile, not needed
    anymore.

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 03 Apr 2016 20:24:31 -0300

# For older changelog entries, run 'apt-get changelog redmine-sqlite'
