request-tracker5 (5.0.10+dfsg-3) unstable; urgency=medium

  * Update patch to fix test that has a floating point issue to handle an
    edge case.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 21 Jun 2026 12:37:08 +1200

request-tracker5 (5.0.10+dfsg-2) unstable; urgency=medium

  * Add a patch to fix test that has a floating point issue (Closes: #1136929). 
  * Bump Standards-Version to 4.7.4 (no changes)

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sat, 20 Jun 2026 22:03:48 +1200

request-tracker5 (5.0.10+dfsg-1) unstable; urgency=medium

  * New upstream release.
    - [CVE-2026-41075] Fix SQL injection via the entry_aggregator parameter in
      JSON search. An authenticated user can craft input that is incorporated
      into database queries without proper validation, potentially allowing
      them to read or modify data in the RT database.
    - [CVE-2026-41076] Fix an LDAP authentication bypass when RT is configured
      to authenticate users against an LDAP or Active Directory server. Under
      certain LDAP server configurations, an attacker may be able to
      authenticate as any LDAP-backed RT user without supplying valid
      credentials.
    - [CVE-2026-6841] Fix a reflected cross-site scripting via the search "Page"
      URL parameter.
    - [CVE-2026-44227] Fix a reflected cross-site scripting via additional URL
      parameters on search pages.
    - [CVE-2026-44230] Fix a reflected cross-site scripting on search-results
      chart pages.
    - [CVE-2026-44229] Fix a cross-site scripting via uploaded content that is
      served inline rather than as an attachment.
    - [CVE-2026-41073] Fix a spreadsheet (CSV/formula) injection via ticket
      values that are exported to a spreadsheet from search results.
      User-controlled data is not sanitized before being written to the output
      file, which can cause spreadsheet applications such as Microsoft Excel to
      interpret crafted values as formulas or macros when the file is opened.
  * Drop patches no longer needed:
    - fix-WWW::Mechanize_v2.20_in_tests.diff
    - add-missing-rt-base-require.diff
    - fix-gnupg-2.4.9.diff
  * Drop redundant lintian overrides for rt5-doc-html.
  * Add missing ".service" to ordering lines in request-tracker5.service
    (Closes: #1109102).

 -- Andrew Ruthven <andrew@etc.gen.nz>  Thu, 21 May 2026 20:44:52 +1200

request-tracker5 (5.0.9+dfsg-4) unstable; urgency=medium

  * Replace add-missing-rt-base-require.diff patch with upstream version
    which fixes a lot more modules.
  * Fix test that fails with GnuPG 2.4.9 (Closes: #1130943).

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sat, 21 Mar 2026 00:08:06 +1300

request-tracker5 (5.0.9+dfsg-3) unstable; urgency=medium

  * Add patch to add a missing "requires RT::Base". This fixes autopkgtests
    in RT extensions.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Tue, 03 Mar 2026 22:37:16 +1300

request-tracker5 (5.0.9+dfsg-2) unstable; urgency=medium

  * Set a version for ckeditor when we build it to allow Firefox v148 to
    correctly detect that it needs a work around, see:
    https://bugzilla.mozilla.org/show_bug.cgi?id=2002481
    (Closes: #1129090)

 -- Andrew Ruthven <andrew@etc.gen.nz>  Mon, 02 Mar 2026 22:17:44 +1300

request-tracker5 (5.0.9+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Drop patch no longer needed:
    - upstream_5.0.7_cve:_patchset_2025-10-07.diff
  * RT has switched from File::Dropbox to WebService::Dropbox, update
    recommends.
  * Refresh d/copyright.
  * Drop "Priority: optional" from d/control as this is now the default.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sat, 14 Feb 2026 00:37:53 +1300

request-tracker5 (5.0.7+dfsg-6) unstable; urgency=high

  * Lintian overrides for Download-URL-Mangle required due to change to d/watch
    v5.
  * Apply patch to tests to handle WWW::Mechanize behaviour change.
  * Cut down on the upstream tests we run with autopkgtest as the full set
    takes a long time to run and time out on the slower test boxes.
  * Fix saving of the test files.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Mon, 27 Oct 2025 16:14:07 +1300

request-tracker5 (5.0.7+dfsg-5) unstable; urgency=high

  * Apply upstream patch which fixes several security vulnerabilities:
    - [CVE-2025-61873] Fix CSV injection via ticket values with special
      characters that are exported to a TSV from search results.
    - [CVE-2025-9158] Fix XSS via calendar invitations added to a ticket.
  * Update d/watch to v5.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Thu, 23 Oct 2025 11:48:52 +1300

request-tracker5 (5.0.7+dfsg-4) unstable; urgency=high

  * Update d/watch to only look for versions that match 5.x.y as version 6 will
    be handled by request-tracker6.
  * Debianize the UPGRADING-4.4 and UPGRADING-5.0 instructions to use paths
    etc that are used on Debian.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Wed, 21 May 2025 20:43:14 +1200

request-tracker5 (5.0.7+dfsg-3) unstable; urgency=high

  * Update Standards-Version to 4.7.2 (no changes).
  * Refresh d/copyright.
  * Add Catalan translation, thank you Carles Pina i Estany!
  * Apply upstream patches which fix several security vulnerabilities
    (Closes: #1104422).
    - [CVE-2025-30087] Vulnerable to Cross Site Scripting via injection of
      malicious parameters in a search URL.
    - [CVE-2025-2545] RT uses the default OpenSSL cipher, 3DES (des3), for
      encrypting SMIME email. This is an outdated cipher algorithm, so the
      default is changed to aes-128-cbc. In addition, this is now configurable
      so you can pick an alternate cipher now or in the future, or revert to
      des3 if needed for compatibility.
    - [CVE-2025-31501] Vulnerable to Cross Site Scripting via JavaScript
      injection in an Asset name.
    - [CVE-2025-31500] Vulnerable to Cross Site Scripting via JavaScript
      injection in an RT permalink.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 04 May 2025 17:51:52 +1200

request-tracker5 (5.0.7+dfsg-2) unstable; urgency=medium

  * Create RT-Shredder SQL log directory.
  * Enable verbose logging for autopkgtests to ease CI debugging.
  * Add patch so free port detection for test suite matches how PSGI binds
    (this may fix 1074781).
  * Flag tests as flaky until we know if they work reliably (this will stop
    1074781 from annoying others).

 -- Andrew Ruthven <andrew@etc.gen.nz>  Fri, 27 Sep 2024 23:37:30 +1200

request-tracker5 (5.0.7+dfsg-1) unstable; urgency=medium

  * New upstream release (Closes: #1068453).
    - [CVE-2024-3262] Information exposure vulnerability due to browser
      cache usage. If you have sensitive information enable the
      $WebStrictBrowserCache option.
  * Refresh d/copyright.
  * Drop patch no longer needed:
    - remove_exclude_Test::WWW::Mechanize.diff
  * Update Standards-Version to 4.7.0 (no changes).
  * Drop dependency on rsyslog | system-log-daemon (Closes: #1072030).
  * Cherry pick upstream commit (Closes: #1078046).

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 11 Aug 2024 18:20:58 +1200

request-tracker5 (5.0.5+dfsg-2) unstable; urgency=medium

  * Correct CVE numbers for CVE-2023-41259 and CVE-2023-41260 in previous
    entry (Closes: #1055128).
  * Remove alternative for rt-clean-attributes in prerm (Closes: #1057684).
  * Remove alternative for rt-serializer in prerm.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 10 Dec 2023 01:49:01 +1300

request-tracker5 (5.0.5+dfsg-1) unstable; urgency=high

  * New upstream release (Closes: #1054517).
    - [CVE-2023-41259] Vulnerablility to unvalidated email headers in
      incoming email and the mail-gateway REST interface.
    - [CVE-2023-41260] Information leakage via response messages returned
      from requests sent via the mail-gateway REST interface.
    - [CVE-2023-45024] Information leakage via transaction searches made by
      authenticated users in the transaction query builder.
    - Reveal information about data on various RT objects in errors and other
      response messages to REST 2 requests.
  * Drop patches no longer needed:
    - Update-expired-certificates.diff
    - Update-legacy-timezones.diff
    - install_rt-clean-shorteners.diff
  * Drop patches merged upstream:
    - fcgi_client_sigpipe.diff
    - fix_pod_rt_munge_attachments.diff
  * Add autopkgtests.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 29 Oct 2023 13:42:33 +1300

request-tracker5 (5.0.4+dfsg-2) unstable; urgency=medium

  * Add patches from upstream:
    - debian/patches/Update-expired-certificates.diff
    - debian/patches/Update-legacy-timezones.diff
  * Drop Build-Depend on tzdata-legacy as Update-legacy-timezones.diff patch
    negates the need for it.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Mon, 04 Sep 2023 23:56:23 +1200

request-tracker5 (5.0.4+dfsg-1) unstable; urgency=medium

  [ Andrew Ruthven ]
  * New upstream release.
  * Drop patch no longer needed:
    - Update-tests-for-EN-datetime-locale-change-to-space.diff
  * Drop patch merged upstream:
    - libdatetime-format-natural-perl-v0.14.diff
  * Refresh d/copyright
  * Bump debhelper from old 10 to 13.
  * Recommend libcss-inliner-perl and enable $EmailDashboardInlineCSS if
    it is installed.
  * Ensure we can build source after successful build.
  * Add disable_dirmngr_in_tests.diff which should make this package able
    to pass the reproducible build tests.
  * Depend on fonts-noto-core instead of the obsolete fonts-noto-hinted
    (Closes: #1050048)
  * Build-Depend on tzdata-legacy as a number of the tests use timezone names
    that have been moved from tzdata to tzdata-legacy.

  [ Ángel Gonzále ]
  * Fetch timezone from /etc/localtime symlink (Closes: #1038847)

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sat, 19 Aug 2023 14:31:11 +1200

request-tracker5 (5.0.3+dfsg-3) unstable; urgency=medium

  * Strip Debian version suffix from generated hyperlinks to upstream docs
    (Closes: #1033304).
  * Fix the changelog date entry for the 5.0.3+dfsg-2 release.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 11 Jun 2023 14:19:13 +1200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog rt5-clients`.
