tomcat10 (10.1.55-1ubuntu2~24.04.1) noble; urgency=medium

  * Backport to Noble (LP: #2155817):
    - debian/control: Relaxed eclipse JDT core compiler requirement.

 -- Reuben Roessler <reuben.roessler@canonical.com>  Mon, 22 Jun 2026 09:12:33 +1000

tomcat10 (10.1.55-1ubuntu2) stonking; urgency=medium

  * debian/tomcat10-common.links: Fixed jakartaee-migration-shaded.jar
    source location

 -- Reuben Roessler <reuben.roessler@canonical.com>  Wed, 10 Jun 2026 17:46:50 +1000

tomcat10 (10.1.55-1ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2155606). Remaining changes:
    - Restored tomcat10 server packages since dropped in 10.1.52-2
      (LP: 2154326)
      + Depend on libtcnative-2 instead of libtcnative-1
    - Added autopkgtest integrations:
      + Smoke-tests for default webapp and tomcat-native.
      + Enabled JUnit testing to work with autopkgtest.
  * New Changes:
    - Install jakartaee-migration-shaded.jar into the Tomcat lib directory
      (Closes: #1108280)
    - Fixed up various bugs due to historical packaging.
      Thanks to Utkarsh Gupta <utkarsh.gupta@canonical.com> (LP: #2155105)
      + debian/sysuser/tomcat11.conf: User home directory was inconsistent
        with CATALINA_BASE, changed to /nonexistent
      + debian/tomcat11.dirs: Removed empty dir creation of etc/logrotate.d
        as it is handled by ucf from template
      + debian/tomcat11.postrm.in: Added leading / to
        /var/lib/tomcat11/lib/classes since should be an absolute path
      + debian/README.Debian: Added some comments regarding historical
        packaging notes.
        - tomcat user is shared by tomcatXX packages
        - tomcat log rotation

 -- Reuben Roessler <reuben.roessler@canonical.com>  Fri, 05 Jun 2026 09:31:03 +1000

tomcat10 (10.1.55-1) unstable; urgency=medium

  * New upstream version 10.1.55.
    - The source package includes the security fixes for the following reported
      vulnerabilities: CVE-2026-41284, CVE-2026-41293, CVE-2026-42498,
      CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515.
      Debian dropped the server packages in 10.1.52-2 thus these issues are no
      longer relevant for sid and forky.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Tue, 02 Jun 2026 12:58:32 +0200

tomcat10 (10.1.54-1ubuntu2) stonking; urgency=medium

  * Added autopkgtest integrations:
    - Smoke-tests for default webapp and tomcat-native.
    - Enabled JUnit testing to work with autopkgtest.

 -- Reuben Roessler <reuben.roessler@canonical.com>  Mon, 01 Jun 2026 16:16:39 +1000

tomcat10 (10.1.54-1ubuntu1) stonking; urgency=medium

  * Restored tomcat10 server packages since dropped in 10.1.52-2 (LP: #2154326)
    - Depend on libtcnative-2 instead of libtcnative-1

 -- Reuben Roessler <reuben.roessler@canonical.com>  Mon, 25 May 2026 14:19:39 +1000

tomcat10 (10.1.54-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - New build dependency on Bouncy Castle

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 13 Apr 2026 13:23:26 +0200

tomcat10 (10.1.52-2) unstable; urgency=medium

  * Drop tomcat10 server packages because only one Tomcat version is supported
    per release. Only retain libtomcat10-java because of compatibility reasons
    for now. Users are strongly encouraged to switch to Tomcat 11 instead.
  * Standards-Version updated to 4.7.4

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 01 Apr 2026 15:53:55 +0200

tomcat10 (10.1.52-1) unstable; urgency=medium

  * New upstream version 10.1.52.
   - Fix CVE-2025-61795: denial-of-service (Closes: #1119294)
   - Fix CVE-2025-48989: "made you reset attack" (Closes: #1111096)
  * Declare compliance with Debian Policy 4.7.3.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Wed, 28 Jan 2026 04:45:47 +0100

tomcat10 (10.1.46-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 29 Sep 2025 13:43:22 +0200

tomcat10 (10.1.40-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Look for OpenJDK from 11 to 25 when starting the server
  * Standards-Version updated to 4.7.2

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 03 Apr 2025 22:07:33 +0200

tomcat10 (10.1.35-1) unstable; urgency=medium

  * New upstream version 10.1.35.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Sun, 09 Feb 2025 00:19:28 +0100

tomcat10 (10.1.34-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 17 Dec 2024 08:16:03 +0100

tomcat10 (10.1.33-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 23 Nov 2024 19:37:37 +0100

tomcat10 (10.1.31-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 23 Oct 2024 18:33:07 +0200

tomcat10 (10.1.30-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Depend on libbyte-buddy-java instead of libcglib-nodep-java
  * Fixed the taglibs tests
  * Fixed the database tests
  * No longer attempt to run the non compiled TestJNDIRealmIntegration test

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 16 Sep 2024 18:47:28 +0200

tomcat10 (10.1.25-2) unstable; urgency=medium

  * Add the missing dependency on libeclipse-jdt-core-compiler-batch-java
    (Closes: #1078372)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 20 Aug 2024 17:47:28 +0200

tomcat10 (10.1.25-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 03 Jul 2024 23:57:31 +0200

tomcat10 (10.1.23-1) unstable; urgency=medium

  * New upstream version 10.1.23
  * Refresh the patches.
  * Declare compliance with Debian Policy 4.7.0.

 -- Markus Koschany <apo@debian.org>  Thu, 18 Apr 2024 22:34:59 +0200

tomcat10 (10.1.20-1) unstable; urgency=high

  * New upstream version 10.1.20.
    - Fix CVE-2024-24549: Denial of Service due to improper input validation
      vulnerability. (Closes: #1066878)
    - Fix CVE-2024-23672: Denial of Service via incomplete cleanup
      vulnerability. (Closes: #1066877)
  * Remove obsolete dependency on lsb-base from tomcat10 binary package.

 -- Markus Koschany <apo@debian.org>  Sat, 06 Apr 2024 13:43:19 +0200

tomcat10 (10.1.16-1) unstable; urgency=medium

  * New upstream version 10.1.16.
    - Fix CVE-2023-46589: potential request smuggling. (Closes: #1057082)

 -- Markus Koschany <apo@debian.org>  Sun, 03 Dec 2023 13:31:22 +0100

tomcat10 (10.1.15-1) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * Build depend on the versionless tomcat-jakartaee-migration jar.
    (Closes: #1054705)

  [ Markus Koschany ]
  * New upstream version 10.1.15.

 -- Markus Koschany <apo@debian.org>  Fri, 27 Oct 2023 22:40:52 +0200

tomcat10 (10.1.14-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 10 Oct 2023 09:44:59 +0200

tomcat10 (10.1.13-1) unstable; urgency=medium

  * New upstream version 10.1.13.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Fri, 01 Sep 2023 13:47:35 +0200

tomcat10 (10.1.10-1) unstable; urgency=medium

  * New upstream version 10.1.10.

 -- Markus Koschany <apo@debian.org>  Sun, 18 Jun 2023 18:16:33 +0200

tomcat10 (10.1.9-1) experimental; urgency=medium

  * New upstream version 10.1.9.

 -- Markus Koschany <apo@debian.org>  Tue, 16 May 2023 11:32:58 +0200

tomcat10 (10.1.8-1) experimental; urgency=medium

  * New upstream version 10.1.8.

 -- Markus Koschany <apo@debian.org>  Tue, 25 Apr 2023 21:54:20 +0200

tomcat10 (10.1.7-1) experimental; urgency=medium

  * New upstream version 10.1.7.

 -- Markus Koschany <apo@debian.org>  Wed, 12 Apr 2023 00:27:16 +0200

tomcat10 (10.1.6-1) unstable; urgency=medium

  * New upstream version 10.1.6
  * Tighten dependency on libtcnative-1.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Thu, 23 Feb 2023 12:49:47 +0100

tomcat10 (10.1.5-2) unstable; urgency=medium

  * Install and link to websocket-client-api.jar. Fixes ClassNotFoundException.
    Thanks to Jorge Moraleda for the report. (Closes: #1030869)

 -- Markus Koschany <apo@debian.org>  Sun, 12 Feb 2023 19:27:47 +0100

tomcat10 (10.1.5-1) unstable; urgency=medium

  * New upstream version.
  * Drop tomcat-jakartaee-migration.patch. Fixed upstream.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Wed, 01 Feb 2023 00:13:09 +0100

tomcat10 (10.0.27-1) unstable; urgency=medium

  * New upstream version.
  * Release to unstable.
  * Make tomcat9 and tomcat10 co-installable. (Closes: #965006)
  * Tomcat 10 can be built from source again. (Closes: #1028632)
  * Add myself to Uploaders.
  * Declare compliance with Debian Policy 4.6.2.

 -- Markus Koschany <apo@debian.org>  Mon, 16 Jan 2023 22:51:22 +0100

tomcat10 (10.0.0~M7-1) experimental; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Fixed the compatibility with the version of bnd in Debian
  * Set the generic version of the Maven artifacts to 10.x (Fixes: #965006)
  * Grant write access on /var/log/tomcat10 to the adm group

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 14 Jul 2020 20:14:44 +0200

tomcat10 (10.0.0~M6-1) experimental; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Renamed the package to tomcat10
    - Migrate the taglibs-standard libraries to the Jakarta EE namespace

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 15 Jun 2020 09:51:05 +0200

tomcat9 (9.0.70-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 05 Dec 2022 18:50:40 +0100

tomcat9 (9.0.68-1) unstable; urgency=medium

  * New upstream release
  * Look for OpenJDK 17 and up to 21 when starting the server (Closes: #1020948)
  * Simplified the Maven rules

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 08 Oct 2022 13:53:36 +0200

tomcat9 (9.0.67-1) unstable; urgency=medium

  * Team upload.

  [ Thorsten Glaser ]
  * Fix a Policy violation in the Depends of bin:tomcat9

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 27 Sep 2022 00:49:00 +0200

tomcat9 (9.0.65-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.65.

 -- Markus Koschany <apo@debian.org>  Fri, 12 Aug 2022 12:56:06 +0200

tomcat9 (9.0.64-2) unstable; urgency=medium

  * Fallback to the default log formatter when systemd isn't used
  * Depend on systemd-sysusers and systemd-tmpfiles instead of systemd
  * Depend on libeclipse-jdt-core-java (>= 3.26.0)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 21 Jun 2022 14:59:03 +0200

tomcat9 (9.0.64-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.6.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 20 Jun 2022 15:17:59 +0200

tomcat9 (9.0.63-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.63.
    - Fix CVE-2022-29885: Improve documentation for the EncryptInterceptor and
      do not claim it protects against all risks associated with running over
      any untrusted network.

 -- Markus Koschany <apo@debian.org>  Fri, 13 May 2022 14:04:35 +0200

tomcat9 (9.0.62-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.62.
  * Drop 0027-java11-compilation.patch because it is apparently no longer
    required.
  * Refresh disable-jacoco.patch for new release.
  * Depend on java11-runtime-headless because Java 8 is no longer supported.
    Thanks to Per Lundberg for the report. (Closes: #1006647)

 -- Markus Koschany <apo@debian.org>  Fri, 29 Apr 2022 23:10:59 +0200

tomcat9 (9.0.58-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.58.
  * Add disable-jacoco.patch and remove the dependency on jacoco when running
    the test suite.

 -- Markus Koschany <apo@debian.org>  Wed, 09 Feb 2022 15:51:20 +0100

tomcat9 (9.0.55-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.55.

 -- Markus Koschany <apo@debian.org>  Mon, 15 Nov 2021 22:12:42 +0100

tomcat9 (9.0.54-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.54.
    - Fix CVE-2021-42340:
      The fix for bug 63362 introduced a memory leak. The object introduced to
      collect metrics for HTTP upgrade connections was not released for
      WebSocket connections once the connection was closed. This created a
      memory leak that, over time, could lead to a denial of service via an
      OutOfMemoryError.
  * Update 0010-debianize-build-xml.patch and depend on the setup-bnd task to
    prevent a FTBFS when building the tests. This replaces the workaround by
    setting addOSGi to false.
    Thanks to Aurimas Fišeras for the report.

 -- Markus Koschany <apo@debian.org>  Fri, 22 Oct 2021 21:59:08 +0200

tomcat9 (9.0.53-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.53.
    - Drop security patches. Fixed upstream.
    - Fix CVE-2021-41079:
      Apache Tomcat did not properly validate incoming TLS packets. When Tomcat
      was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially
      crafted packet could be used to trigger an infinite loop resulting in a
      denial of service.
  * Declare compliance with Debian Policy 4.6.0.
  * Set the fileOwner of catalina.out to tomcat explicitly.
    Thanks to Adam Cecile for the report. (Closes: #987179)
  * Refresh 0021-dont-test-unsupported-ciphers.patch
  * tomcat9.cron.daily: Set maxdepth to 1 so that log files of custom
    applications in subdirectories of /var/log/tomcat9 are not compressed.
    Thanks to Ludovic Pouzenc for the report. (Closes: #982961)
  * Exclude TestJNDIRealmIntegration because of missing dependencies.

 -- Markus Koschany <apo@debian.org>  Fri, 24 Sep 2021 15:37:51 +0200

tomcat9 (9.0.43-3) unstable; urgency=medium

  * Team upload.
  * CVE-2021-30640: Fix NullPointerException.
    If no userRoleAttribute is specified in the user's Realm configuration its
    default value will be null. This will cause a NPE in the methods
    doFilterEscaping and doAttributeValueEscaping. This is upstream bug
    https://bz.apache.org/bugzilla/show_bug.cgi?id=65308

 -- Markus Koschany <apo@debian.org>  Tue, 10 Aug 2021 17:17:56 +0200

tomcat9 (9.0.43-2) unstable; urgency=medium

  * Team upload.

  [ mirabilos ]
  * fix /var/log/tomcat9 permissions
    fixup for commit 51128fe9fb2d4d0b56be675d845cf92e4301a6c3

  [ Markus Koschany ]
  * Fix CVE-2021-30640:
    A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to
    authenticate using variations of a valid user name and/or to bypass some of
    the protection provided by the LockOut Realm.
  * Fix CVE-2021-33037:
    Apache Tomcat did not correctly parse the HTTP transfer-encoding request
    header in some circumstances leading to the possibility to request
    smuggling when used with a reverse proxy. Specifically: - Tomcat
    incorrectly ignored the transfer encoding header if the client declared it
    would only accept an HTTP/1.0 response; - Tomcat honoured the identify
    encoding; and - Tomcat did not ensure that, if present, the chunked
    encoding was the final encoding.
    (Closes: #991046)

 -- Markus Koschany <apo@debian.org>  Sat, 07 Aug 2021 00:11:43 +0200

tomcat9 (9.0.43-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Rotate the catalina.out log file with the tomcat user (Closes: #971583)
  * Switch to debhelper level 13

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 02 Feb 2021 20:23:51 +0100

tomcat9 (9.0.41-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.5.1

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 09 Dec 2020 16:03:00 +0100

tomcat9 (9.0.40-1) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches
  * Changed the home directory of the tomcat user to /var/lib/tomcat
    (Closes: #926338)

  [ Vincent McIntyre ]
  * Automatically export the JAVA_HOME environment variable when the value
    is defined in /etc/defaults/tomcat9 (Closes: #966338)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 24 Nov 2020 08:21:29 +0100

tomcat9 (9.0.39-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * tomcat9-user now depends on netcat-openbsd instead of netcat
    (Closes: #966158)

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 12 Oct 2020 17:16:57 +0200

tomcat9 (9.0.38-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 16 Sep 2020 16:04:03 +0200

tomcat9 (9.0.37-3) unstable; urgency=medium

  * control: Bump build-dep on bnd, drop bnd compat and re-export patches.
    (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 06 Aug 2020 18:59:11 +0300

tomcat9 (9.0.37-2) unstable; urgency=medium

  * d/p/0029-fix-regression-in-bz64540.patch: Re-export util.net.jsse
    and util.modeler.modules. (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 28 Jul 2020 14:09:13 +0300

tomcat9 (9.0.37-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Fixed the compatibility with the version of bnd in Debian
  * Restored execute permission on /var/log/tomcat9 to the adm group

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 06 Jul 2020 22:39:32 +0200

tomcat9 (9.0.36-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Grant write access on /var/log/tomcat9 to the adm group (LP: #1861881)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 23 Jun 2020 11:47:47 +0200

tomcat9 (9.0.35-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2020-9484: Remote Code Execution via session persistence (Closes: #961209)
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 21 May 2020 15:50:03 +0200

tomcat9 (9.0.34-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Depend on libeclipse-jdt-core-java (>= 3.18.0)
  * Switch to debhelper level 12

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 27 Apr 2020 00:36:59 +0200

tomcat9 (9.0.31-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2019-10072: Denial of Service (Closes: #930872)
    - Fixes CVE-2019-12418: Local Privilege Escalation
    - Fixes CVE-2019-17563: Session fixation attack
    - Fixes CVE-2019-17569: HTTP Request Smuggling
    - Fixes CVE-2020-1935: HTTP Request Smuggling
    - Fixes CVE-2020-1938: AJP Request Injection (Closes: #952437)
    - Fixes CATALINA_PID handling in catalina.sh (Closes: #948553)
    - Refreshed the patches
    - Fixed the compilation with Java 11
  * Moved the RequiresMountsFor directive in the service file
    to the Unit section (Closes: #942316)
  * Tightened the dependency on systemd (Closes: #931997)
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Feb 2020 23:37:00 +0100

tomcat9 (9.0.27-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.4.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 14 Oct 2019 11:31:50 +0200

tomcat9 (9.0.24-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 22 Aug 2019 13:55:14 +0200

tomcat9 (9.0.22-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Track and download the new releases from GitHub
  * Standards-Version updated to 4.4.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 12 Jul 2019 15:01:28 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libtomcat10-java`.
