sogo (5.12.9-1) unstable; urgency=medium

  * New upstream release.
  * Add minimal salsa-ci.yml.
  * Drop update_nsstring_test.patch, included in new version.
  * Refresh patches.

 -- Jordi Mallach <jordi@debian.org>  Mon, 08 Jun 2026 17:04:51 +0200

sogo (5.12.8-2) unstable; urgency=medium

  * Workaround MIME address generation test failure.
  * Expect no test failures after the fixed test.
  * Only disable test_rendering patch on big endian architectures.
  * Add upstream patch to fix impersonation issues when importing events.

 -- Jordi Mallach <jordi@debian.org>  Tue, 26 May 2026 10:43:31 +0200

sogo (5.12.8-1) unstable; urgency=medium

  * New upstream release, with 4 security fixes:
    - require that a UID exists before adding it to a folder's ACL
    - XSS mitigations for mail Subject rendering
    - strip dangerous HTML event attributes from ICS invitations
    - OpenId: verify the user's email domain and ensure the account exists in
      the local source before granting access
  * Update test after XSS sanitization changes.

 -- Jordi Mallach <jordi@debian.org>  Tue, 12 May 2026 11:53:29 +0200

sogo (5.12.7-1) unstable; urgency=medium

  * New upstream release, with 2 security fixes:
    - use SQL adaptors for PostgreSQL to prevent injection in user searches
    - parameterize SQL queries to secure plaintext password verification
  * Remove Pgp-Sig-Url-Mangle from watch file; there are no sig files.
  * Update Standards-Version to 4.7.4, with no changes.

 -- Jordi Mallach <jordi@debian.org>  Wed, 01 Apr 2026 14:25:41 +0200

sogo (5.12.6-1) unstable; urgency=medium

  * New upstream release.
    - [CVE-2026-33550] Issues with OTP renewal and length (closes: #1131606)
    - [CVE-2025-71276] XSS in events, tasks and contacts (closes: #1131605)
    - [CVE-2026-3054] XSS in unknown components (closes: #1130878)
  * Drop CVE-2025-63499.patch, included in release.
  * Update watch file to version 5.
  * Update copyright years.
  * Update Standards-Version to 4.7.3, with no changes needed.

 -- Jordi Mallach <jordi@debian.org>  Wed, 25 Mar 2026 12:03:46 +0100

sogo (5.12.4-1.2) unstable; urgency=high

  * Non-maintainer upload.
  * CVE-2025-63499 - Cross Site Scripting (XSS) (Closes: #1121952)

 -- Tobias Frost <tobi@debian.org>  Wed, 24 Dec 2025 13:18:47 +0100

sogo (5.12.4-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Build-Depends: libcrypt-dev. (Closes: #1106968)

 -- Adrian Bunk <bunk@debian.org>  Tue, 02 Dec 2025 22:40:17 +0200

sogo (5.12.4-1) unstable; urgency=medium

  * New upstream release.
  * Update sources download URL in copyright file.
  * Drop cherry-picked patch now included in the release.

 -- Jordi Mallach <jordi@debian.org>  Sun, 19 Oct 2025 15:47:51 +0200

sogo (5.12.3-2) unstable; urgency=medium

  * Add upstream patch to fix condition where appointments would show
    up at the wrong time.
  * Use HTTPS URLs in copyright file.
  * Upload to unstable.

 -- Jordi Mallach <jordi@debian.org>  Tue, 23 Sep 2025 01:57:10 +0200

sogo (5.12.3-1) experimental; urgency=medium

  * New upstream release.
  * Drop cherry-picked patches from git, now included in the release.
  * Unvendor punycode.js using copy from node-punycode.
  * Install new SOGo API files.

 -- Jordi Mallach <jordi@debian.org>  Sun, 27 Jul 2025 16:03:08 +0200

sogo (5.12.1-3) unstable; urgency=medium

  * Add upstream patch to fix freebusy calculation.
  * Add upstream patch to use libcurl for OpenId HTTP requests.

 -- Jordi Mallach <jordi@debian.org>  Fri, 25 Jul 2025 11:26:33 +0200

sogo (5.12.1-2) unstable; urgency=medium

  * Replace vendoring of lodash, FileSaver and angularjs with packaged versions.
    (Closes: #1104813)
  * Cherry-pick post 5.12.1 fixes for OpenID and password management.

 -- Jordi Mallach <jordi@debian.org>  Fri, 06 Jun 2025 11:37:50 +0200

sogo (5.12.1-1) unstable; urgency=medium

  * New upstream release.

 -- Jordi Mallach <jordi@debian.org>  Sun, 04 May 2025 23:21:03 +0200

sogo (5.12.0-1) unstable; urgency=medium

  * New upstream release.
  * Update Standards-Version to 4.7.2 (no changes needed).
  * Add Alinto to copyright holders and update years.
  * Bump Build-Depends on libsope-dev to 5.12 for OpenID support.

 -- Jordi Mallach <jordi@debian.org>  Mon, 24 Mar 2025 14:34:40 +0100

sogo (5.11.2-4) unstable; urgency=high

  [ Yavor Doganov ]
  * debian/rules (override_dh_auto_install): Patch the Apache
    configuration file to cope with multiarch (Closes: #1098311).
    Thanks Timo van Roermund for the report.
  * debian/sogo-common.install: Replace usr/share/* with usr/share/GNUstep
    because apache.conf must be in the sogo package.
  * debian/sogo.docs: Add apache.conf.
  * debian/clean: New file.
  * debian/control: Add necessary Breaks+Replaces.

 -- Jordi Mallach <jordi@debian.org>  Wed, 19 Feb 2025 17:09:40 +0100

sogo (5.11.2-3) unstable; urgency=medium

  [ Yavor Doganov ]
  * debian/rules (execute_before_dh_link): Fix piuparts regression
    (Closes: #1095275).
  * debian/control (sogo-activesync): Add necessary Breaks/Replaces.
  * debian/sogo-activesync.maintscript: New file; handle the symlink to
    directory conversion.

 -- Jordi Mallach <jordi@debian.org>  Tue, 11 Feb 2025 16:49:11 +0100

sogo (5.11.2-2) unstable; urgency=medium

  [ Yavor Doganov ]
  * debian/control (Build-Depends): Bump libsbjson-dev and libsope-dev to
    ensure the package is rebuilt for the multiarch layout. Closes: #1094304.
    Remove unnecessary gobjc; annotate python3 with :any.
  * debian/rules: Include gnustep-make's config.mk.
    (override_dh_auto_install): Fix paths when moving files.
    Delete statements handled by dh_gnustep.
    (execute_before_dh_link): Run dh_gnustep --bundle-dir to create
    symlinks and move files to sogo-common.
  * debian/sogo.install: Update for multiarch.
  * debain/sogo-activesync.install: Likewise.
  * debian/sogo-common.links: Delete.
  * debian/sogo-common.install: Add usr/lib/*/GNUstep/Libraries.
  * debian/sogo.links: New file.
  * debian/patches/libxml2.patch: Dont' hard code pkg-config.
  * debian/patches/cross.patch: New; fix FTCBFS. Closes: #1094306.

 -- Jordi Mallach <jordi@debian.org>  Sat, 01 Feb 2025 23:20:29 +0100

sogo (5.11.2-1) unstable; urgency=medium

  * New upstream release, with two important fixes introduced in 5.11.1:
    - fix a security issue with parameter SOGoForbidUnknownDomainsAuth
    - modify the message-id to avoid triggering a native spamassassin rule

 -- Jordi Mallach <jordi@debian.org>  Wed, 16 Oct 2024 17:22:54 +0200

sogo (5.11.1-1) unstable; urgency=medium

  * New upstream release.
  * Drop libwbxml2 include dir patch, applied upstream.
  * Update Standards-Version to 4.7.0, with no changes needed.

 -- Jordi Mallach <jordi@debian.org>  Tue, 15 Oct 2024 16:36:37 +0200

sogo (5.11.0-2) unstable; urgency=medium

  * Add patch to obtain libwbxml2 cflags using pkgconf (closes: #1080139).

 -- Jordi Mallach <jordi@debian.org>  Thu, 05 Sep 2024 08:04:37 +0200

sogo (5.11.0-1) unstable; urgency=medium

  * New upstream release.
  * Switch Build-Depend on pkg-config to pkgconf.

 -- Jordi Mallach <jordi@debian.org>  Mon, 12 Aug 2024 14:15:07 +0200

sogo (5.10.0-3) unstable; urgency=medium

  * Only expect 1 test to fail (test is documented to be broken upstream).
  * Instead, disable the isIPv4 check in the test suite, as that one fails
    on certain scenarios (closes: #1073428).

 -- Jordi Mallach <jordi@debian.org>  Wed, 19 Jun 2024 22:54:50 +0200

sogo (5.10.0-2) unstable; urgency=medium

  * Revert number of expected test failures to 2 (closes #1063617).
  * Add bug closer to previous changelog entry.
  * Do not run testsuite if `nocheck` is part of DEB_BUILD_OPTIONS.

 -- Jordi Mallach <jordi@debian.org>  Tue, 26 Mar 2024 22:47:37 +0100

sogo (5.10.0-1) unstable; urgency=medium

  * New upstream release.
  * Fix watch to allow for double digit components of a version.
  * Update copyright years and download URL.
  * Refresh patches.

 -- Jordi Mallach <jordi@debian.org>  Mon, 25 Mar 2024 23:57:51 +0100

sogo (5.9.1-1) unstable; urgency=medium

  * New upstream release.
  * Revert all unvendoring changes as they completely break SOGo.
  * Rely on dh_installinit to install the systemd service file
    (closes: #1054486).
  * Refresh Remove-build-date.patch.
  * Update number of expected test failures to 1.
  * Release to unstable.

 -- Jordi Mallach <jordi@debian.org>  Wed, 07 Feb 2024 16:39:36 +0100

sogo (5.9.0-1) experimental; urgency=medium

  * New upstream release.
  * Refresh Remove-build-date patch.
  * Fix replacement of vendored JS libraries with packaged versions
    (closes: #1042529).
  * Drop unneeded Build-Depends on js libs.

 -- Jordi Mallach <jordi@debian.org>  Tue, 28 Nov 2023 09:46:18 +0100

sogo (5.8.4-2) unstable; urgency=medium

  * Use Debian packaged version of ckeditor, angularjs, lodash and
    punycode (closes: #1042529).

 -- Jordi Mallach <jordi@debian.org>  Fri, 08 Sep 2023 14:23:23 +0200

sogo (5.8.4-1) unstable; urgency=medium

  * New upstream release.

 -- Jordi Mallach <jordi@debian.org>  Mon, 26 Jun 2023 00:11:31 +0200

sogo (5.8.3-1) unstable; urgency=medium

  * New upstream release.
  * Update Standards-Version to 4.6.2, with no changes needed.

 -- Jordi Mallach <jordi@debian.org>  Mon, 19 Jun 2023 01:29:24 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog sogo`.
