smarty3 (3.1.48-2build1) resolute; urgency=medium

  * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)

 -- Sebastien Bacher <seb128@debian.org>  Thu, 29 Jan 2026 21:36:07 +0100

smarty3 (3.1.48-2) unstable; urgency=medium

  [ Tobias Frost ]
  * Team upload.
  * CVE-2024-35226 - PHP Code injection by untrusted template authors 
   (Closes: #1072530)
  * Add simple testsuite to check against some CVEs.
 
  [ Debian Janitor ]
  * Set upstream metadata fields: Security-Contact.
  * Remove unnecessary get-orig-source-target.

 -- Tobias Frost <tobi@debian.org>  Sun, 17 Nov 2024 11:03:04 +0100

smarty3 (3.1.48-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-28447: Fix cross site scripting vulnerability in Javascript
      escaping.
  * debian/control:
    + Bump Standards-Version: to 4.6.2. No changes needed.
  * debian/copyright:
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 15 Jun 2023 16:10:44 +0200

smarty3 (3.1.47-2) unstable; urgency=medium

  * debian/control:
    + Bump versioned B-D on smarty-lexer to (>= 3.1.32+dfsg1-5~).
  * debian/rules:
    + Re-enable configfile/template parser/lexer generation. (Closes: #1022737).

 -- Mike Gabriel <sunweaver@debian.org>  Tue, 25 Oct 2022 07:42:53 +0200

smarty3 (3.1.47-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2018-25047: Prohibit XSS in libs/plugins/function.mailto.php.
      (Closes: #1019897).
  * debian/rules:
    + Disable configparser and templateparser creation temporarily. Use
      the files generated/provided by upstream for now.(Closes: #1021571).

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 24 Oct 2022 20:52:45 +0200

smarty3 (3.1.45-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2021-21408: Prevent template authors from running restricted static
      php methods. (see smarty4 bug #1010375).
    - CVE-2021-29454: Prevent template authors from running arbitrary PHP code
      by crafting a malicious math string. (see smarty4 bug #1010375, as well).
    - CVE-2022-29221: Prevent template authors from injecting PHP code by
      choosing malicious filenames. (Closes: #1011758).
  * debian/watch:
    + Only watch 3.x versions of Smarty.
  * debian/control:
    + Bump Standards-Version: to 4.6.1. No changes needed.
  * debian/copyright:
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 30 May 2022 08:24:30 +0200

smarty3 (3.1.39-2) unstable; urgency=medium

  * debian/watch:
    + Fix Github watch URL.

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 29 Apr 2021 14:40:03 +0200

smarty3 (3.1.39-1) unstable; urgency=medium

  * New upstream release.
  * debian/copyright:
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Tue, 23 Feb 2021 11:41:59 +0100

smarty3 (3.1.38-1) unstable; urgency=medium

  * New upstream release.
  * debian/patches:
    + Drop 0001_bring-lexer-source-functionally-up-to-date.patch. Applied
      upstream.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 18 Jan 2021 17:20:40 +0100

smarty3 (3.1.36-2) unstable; urgency=medium

  * debian/control:
    + Update versioned B-D on smarty-lexer to (>= 3.1.32+dfsg1-3~).
  * debian/patches:
    + Add 0001_bring-lexer-source-functionally-up-to-date.patch. Bring
      lexer source functionally up-to-date with (manually edited) compiled
      version. (Closes: #977604).
  * debian/watch:
    + Switch to format version 4.

 -- Mike Gabriel <sunweaver@debian.org>  Fri, 18 Dec 2020 14:53:44 +0000

smarty3 (3.1.36-1) unstable; urgency=medium

  * New upstream release.
  * debian/rules:
    + Stop creating Git snapshots, use upstream orig tarballs (generated from
      Github tags) instead.
    + Upstream changelog has been renamed to CHANGELOG.md.
  * debian/copyright:
    + Update copyright attributions.
    + Drop global Comment: field. No tarball repacking anymore.
  * debian/control:
    + Bump Standards-Version: to 4.5.1. No changes needed.
    + Bump DH compat level to version 13.
  * debian/upstream/metadata:
    + Add file. Comply with DEP-12.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 07 Dec 2020 09:33:25 +0100

smarty3 (3.1.34+20190228.1.c9f0de05+selfpack1-1) unstable; urgency=medium

  * New upstream release.
  * debian/control:
    + Bump Standards-Version: to 4.4.1. No changes needed.
    + Add Rules-Requires-Root: field and set it to "no".
  * debian/{control,compat}:
    + Switch to debhelper-compat notation. Bump DH comat level to version 12.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 18 Nov 2019 10:49:54 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog smarty3`.
