request-tracker5 (5.0.7+dfsg-4) unstable; urgency=high

  * Update d/watch to only look for versions that match 5.x.y as version 6 will
    be handled by request-tracker6.
  * Debianize the UPGRADING-4.4 and UPGRADING-5.0 instructions to use paths
    etc that are used on Debian. 

 -- Andrew Ruthven <andrew@etc.gen.nz>  Wed, 21 May 2025 20:43:14 +1200

request-tracker5 (5.0.7+dfsg-3) unstable; urgency=high

  * Update Standards-Version to 4.7.2 (no changes).
  * Refresh d/copyright.
  * Add Catalan translation, thank you Carles Pina i Estany!
  * Apply upstream patches which fix several security vulnerabilities
    (Closes: #1104422).
    - [CVE-2025-30087] Vulnerable to Cross Site Scripting via injection of
      malicious parameters in a search URL.
    - [CVE-2025-2545] RT uses the default OpenSSL cipher, 3DES (des3), for
      encrypting SMIME email. This is an outdated cipher algorithm, so the
      default is changed to aes-128-cbc. In addition, this is now configurable
      so you can pick an alternate cipher now or in the future, or revert to
      des3 if needed for compatibility.
    - [CVE-2025-31501] Vulnerable to Cross Site Scripting via JavaScript
      injection in an Asset name.
    - [CVE-2025-31500] Vulnerable to Cross Site Scripting via JavaScript
      injection in an RT permalink. 

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 04 May 2025 17:51:52 +1200

request-tracker5 (5.0.7+dfsg-2) unstable; urgency=medium

  * Create RT-Shredder SQL log directory.
  * Enable verbose logging for autopkgtests to ease CI debugging.
  * Add patch so free port detection for test suite matches how PSGI binds
    (this may fix 1074781).
  * Flag tests as flaky until we know if they work reliably (this will stop
    1074781 from annoying others).

 -- Andrew Ruthven <andrew@etc.gen.nz>  Fri, 27 Sep 2024 23:37:30 +1200

request-tracker5 (5.0.7+dfsg-1) unstable; urgency=medium

  * New upstream release (Closes: #1068453).
    - [CVE-2024-3262] Information exposure vulnerability due to browser
      cache usage. If you have sensitive information enable the
      $WebStrictBrowserCache option.
  * Refresh d/copyright.
  * Drop patch no longer needed:
    - remove_exclude_Test::WWW::Mechanize.diff
  * Update Standards-Version to 4.7.0 (no changes).
  * Drop dependency on rsyslog | system-log-daemon (Closes: 1072030).
  * Cherry pick upstream commit (Closes: #1078046).

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 11 Aug 2024 18:20:58 +1200

request-tracker5 (5.0.5+dfsg-2) unstable; urgency=medium

  * Correct CVE numbers for CVE-2023-41259 and CVE-2023-41260 in previous
    entry (Closes: #1055128).
  * Remove alternative for rt-clean-attributes in prerm (Closes: #1057684).
  * Remove alternative for rt-serializer in prerm.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 10 Dec 2023 01:49:01 +1300

request-tracker5 (5.0.5+dfsg-1) unstable; urgency=high

  * New upstream release (Closes: #1054517).
    - [CVE-2023-41259] Vulnerablility to unvalidated email headers in
      incoming email and the mail-gateway REST interface.
    - [CVE-2023-41260] Information leakage via response messages returned
      from requests sent via the mail-gateway REST interface.
    - [CVE-2023-45024] Information leakage via transaction searches made by
      authenticated users in the transaction query builder.
    - Reveal information about data on various RT objects in errors and other
      response messages to REST 2 requests.
  * Drop patches no longer needed:
    - Update-expired-certificates.diff
    - Update-legacy-timezones.diff
    - install_rt-clean-shorteners.diff
  * Drop patches merged upstream:
    - fcgi_client_sigpipe.diff
    - fix_pod_rt_munge_attachments.diff
  * Add autopkgtests.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 29 Oct 2023 13:42:33 +1300

request-tracker5 (5.0.4+dfsg-2) unstable; urgency=medium

  * Add patches from upstream:
    - debian/patches/Update-expired-certificates.diff
    - debian/patches/Update-legacy-timezones.diff
  * Drop Build-Depend on tzdata-legacy as Update-legacy-timezones.diff patch
    negates the need for it.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Mon, 04 Sep 2023 23:56:23 +1200

request-tracker5 (5.0.4+dfsg-1) unstable; urgency=medium

  [ Andrew Ruthven ]
  * New upstream release.
  * Drop patch no longer needed:
    - Update-tests-for-EN-datetime-locale-change-to-space.diff
  * Drop patch merged upstream:
    - libdatetime-format-natural-perl-v0.14.diff
  * Refresh d/copyright
  * Bump debhelper from old 10 to 13.
  * Recommend libcss-inliner-perl and enable $EmailDashboardInlineCSS if
    it is installed.
  * Ensure we can build source after successful build.
  * Add disable_dirmngr_in_tests.diff which should make this package able
    to pass the reproducible build tests.
  * Depend on fonts-noto-core instead of the obsolete fonts-noto-hinted
    (Closes: #1050048)
  * Build-Depend on tzdata-legacy as a number of the tests use timezone names
    that have been moved from tzdata to tzdata-legacy.

  [ Ángel Gonzále ]
  * Fetch timezone from /etc/localtime symlink (Closes: #1038847)

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sat, 19 Aug 2023 14:31:11 +1200

request-tracker5 (5.0.3+dfsg-3) unstable; urgency=medium

  * Strip Debian version suffix from generated hyperlinks to upstream docs
    (Closes: #1033304).
  * Fix the changelog date entry for the 5.0.3+dfsg-2 release.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 11 Jun 2023 14:19:13 +1200

request-tracker5 (5.0.3+dfsg-2) unstable; urgency=medium

  * Add more fields to d/upstream/metadata 
  * Update the ckeditor licenses in d/copyright.
  * Use java instead of jexec to build ckeditor (Closes: #1026669).
  * Update Standards-Version to 4.6.2 (no changes)
  * Set rt5-doc-html to be Multi-Arch: foreign as suggested by the Multiarch
    hinter.
  * Add Update-tests-for-EN-datetime-locale-change-to-space.diff from upstream
    which handles libdatetime-perl >= 2:1.59-1.
  * Add libdatetime-format-natural-perl-v0.14.diff which handles
    libdatetime-format-natural-perl >= 0.14.
  * Remove dependency on lsb-base as it is an obsolete package.
  * Refresh d/copyright

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sat, 04 Feb 2023 12:30:17 +1300

# For older changelog entries, run 'apt-get changelog rt5-standalone'
