tomcat10 (10.1.55-1ubuntu2) stonking; urgency=medium

  * debian/tomcat10-common.links: Fixed jakartaee-migration-shaded.jar
    source location

 -- Reuben Roessler <reuben.roessler@canonical.com>  Wed, 10 Jun 2026 17:46:50 +1000

tomcat10 (10.1.55-1ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2155606). Remaining changes:
    - Restored tomcat10 server packages since dropped in 10.1.52-2
      (LP: 2154326)
      + Depend on libtcnative-2 instead of libtcnative-1
    - Added autopkgtest integrations:
      + Smoke-tests for default webapp and tomcat-native.
      + Enabled JUnit testing to work with autopkgtest.
  * New Changes:
    - Install jakartaee-migration-shaded.jar into the Tomcat lib directory
      (Closes: #1108280)
    - Fixed up various bugs due to historical packaging.
      Thanks to Utkarsh Gupta <utkarsh.gupta@canonical.com> (LP: #2155105)
      + debian/sysuser/tomcat11.conf: User home directory was inconsistent
        with CATALINA_BASE, changed to /nonexistent
      + debian/tomcat11.dirs: Removed empty dir creation of etc/logrotate.d
        as it is handled by ucf from template
      + debian/tomcat11.postrm.in: Added leading / to
        /var/lib/tomcat11/lib/classes since should be an absolute path
      + debian/README.Debian: Added some comments regarding historical
        packaging notes.
        - tomcat user is shared by tomcatXX packages
        - tomcat log rotation

 -- Reuben Roessler <reuben.roessler@canonical.com>  Fri, 05 Jun 2026 09:31:03 +1000

tomcat10 (10.1.55-1) unstable; urgency=medium

  * New upstream version 10.1.55.
    - The source package includes the security fixes for the following reported
      vulnerabilities: CVE-2026-41284, CVE-2026-41293, CVE-2026-42498,
      CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515.
      Debian dropped the server packages in 10.1.52-2 thus these issues are no
      longer relevant for sid and forky.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Tue, 02 Jun 2026 12:58:32 +0200

tomcat10 (10.1.54-1ubuntu2) stonking; urgency=medium

  * Added autopkgtest integrations:
    - Smoke-tests for default webapp and tomcat-native.
    - Enabled JUnit testing to work with autopkgtest.

 -- Reuben Roessler <reuben.roessler@canonical.com>  Mon, 01 Jun 2026 16:16:39 +1000

tomcat10 (10.1.54-1ubuntu1) stonking; urgency=medium

  * Restored tomcat10 server packages since dropped in 10.1.52-2 (LP: #2154326)
    - Depend on libtcnative-2 instead of libtcnative-1

 -- Reuben Roessler <reuben.roessler@canonical.com>  Mon, 25 May 2026 14:19:39 +1000

tomcat10 (10.1.54-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - New build dependency on Bouncy Castle

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 13 Apr 2026 13:23:26 +0200

tomcat10 (10.1.52-2) unstable; urgency=medium

  * Drop tomcat10 server packages because only one Tomcat version is supported
    per release. Only retain libtomcat10-java because of compatibility reasons
    for now. Users are strongly encouraged to switch to Tomcat 11 instead.
  * Standards-Version updated to 4.7.4

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 01 Apr 2026 15:53:55 +0200

tomcat10 (10.1.52-1) unstable; urgency=medium

  * New upstream version 10.1.52.
   - Fix CVE-2025-61795: denial-of-service (Closes: #1119294)
   - Fix CVE-2025-48989: "made you reset attack" (Closes: #1111096)
  * Declare compliance with Debian Policy 4.7.3.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Wed, 28 Jan 2026 04:45:47 +0100

tomcat10 (10.1.46-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 29 Sep 2025 13:43:22 +0200

tomcat10 (10.1.40-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Look for OpenJDK from 11 to 25 when starting the server
  * Standards-Version updated to 4.7.2

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 03 Apr 2025 22:07:33 +0200

tomcat10 (10.1.35-1) unstable; urgency=medium

  * New upstream version 10.1.35.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Sun, 09 Feb 2025 00:19:28 +0100

tomcat10 (10.1.34-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 17 Dec 2024 08:16:03 +0100

tomcat10 (10.1.33-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 23 Nov 2024 19:37:37 +0100

tomcat10 (10.1.31-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 23 Oct 2024 18:33:07 +0200

tomcat10 (10.1.30-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Depend on libbyte-buddy-java instead of libcglib-nodep-java
  * Fixed the taglibs tests
  * Fixed the database tests
  * No longer attempt to run the non compiled TestJNDIRealmIntegration test

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 16 Sep 2024 18:47:28 +0200

tomcat10 (10.1.25-2) unstable; urgency=medium

  * Add the missing dependency on libeclipse-jdt-core-compiler-batch-java
    (Closes: #1078372)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 20 Aug 2024 17:47:28 +0200

tomcat10 (10.1.25-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 03 Jul 2024 23:57:31 +0200

tomcat10 (10.1.23-1) unstable; urgency=medium

  * New upstream version 10.1.23
  * Refresh the patches.
  * Declare compliance with Debian Policy 4.7.0.

 -- Markus Koschany <apo@debian.org>  Thu, 18 Apr 2024 22:34:59 +0200

tomcat10 (10.1.20-1) unstable; urgency=high

  * New upstream version 10.1.20.
    - Fix CVE-2024-24549: Denial of Service due to improper input validation
      vulnerability. (Closes: #1066878)
    - Fix CVE-2024-23672: Denial of Service via incomplete cleanup
      vulnerability. (Closes: #1066877)
  * Remove obsolete dependency on lsb-base from tomcat10 binary package.

 -- Markus Koschany <apo@debian.org>  Sat, 06 Apr 2024 13:43:19 +0200

tomcat10 (10.1.16-1) unstable; urgency=medium

  * New upstream version 10.1.16.
    - Fix CVE-2023-46589: potential request smuggling. (Closes: #1057082)

 -- Markus Koschany <apo@debian.org>  Sun, 03 Dec 2023 13:31:22 +0100

tomcat10 (10.1.15-1) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * Build depend on the versionless tomcat-jakartaee-migration jar.
    (Closes: #1054705)

  [ Markus Koschany ]
  * New upstream version 10.1.15.

 -- Markus Koschany <apo@debian.org>  Fri, 27 Oct 2023 22:40:52 +0200

tomcat10 (10.1.14-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 10 Oct 2023 09:44:59 +0200

tomcat10 (10.1.13-1) unstable; urgency=medium

  * New upstream version 10.1.13.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Fri, 01 Sep 2023 13:47:35 +0200

tomcat10 (10.1.10-1) unstable; urgency=medium

  * New upstream version 10.1.10.

 -- Markus Koschany <apo@debian.org>  Sun, 18 Jun 2023 18:16:33 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libtomcat10-java`.
