twitter-bootstrap3 (3.4.1+dfsg-7) unstable; urgency=medium

  * Team upload.
  * Fix clean target. Closes: #1046045.
  * Fix privacy-breach-logo.
  * Drop obsolete lintian overrides.
  * Drop "Rules-Requires-Root: no" (default).
  * Drop "Priority: optional" (default).
  * Update standards-version.
  * Simplify salsa-ci.yml.

 -- Santiago Vila <sanvila@debian.org>  Sat, 21 Feb 2026 21:30:00 +0100

twitter-bootstrap3 (3.4.1+dfsg-6) unstable; urgency=medium

  * Team upload
  * Do not refresh patches compared to 3.4.1+dfsg-4 in order
    to ease unblock to trixie.

 -- Bastien Roucariès <rouca@debian.org>  Sun, 01 Jun 2025 15:39:35 +0200

twitter-bootstrap3 (3.4.1+dfsg-5) unstable; urgency=medium

  * Team upload
  * Fix CVE-2025-1647 (Closes: #1105899)
    Improper Neutralization of Input During Web Page
    Generation (XSS or 'Cross-site Scripting') vulnerability
    in Bootstrap allows Cross-Site Scripting (XSS)
    DOM-based cross-site scripting (XSS) via DOM clobbering
    occurs when an attacker manipulates the Document Object Model
    (DOM) to overwrite or "clobber" an existing DOM object,
    leading to the execution of malicious scripts, particularly
    document.implementation variable.

 -- Bastien Roucariès <rouca@debian.org>  Fri, 30 May 2025 18:17:56 +0200

twitter-bootstrap3 (3.4.1+dfsg-4) unstable; urgency=medium

  * Team upload
  * Fix CVE-2024-6485:
    A security vulnerability has been discovered in bootstrap
    that could enable Cross-Site Scripting (XSS) attacks.
    The vulnerability is associated with the data-loading-text
    attribute within the button plugin.
    This vulnerability can be exploited by injecting malicious
    JavaScript code into the attribute, which would then be
    executed when the button's loading state is triggered.
    (Closes: #1084060)
  * Fix CVE-2024-6484:
    A vulnerability has been identified in Bootstrap that
    exposes users to Cross-Site Scripting (XSS) attacks.
    The issue is present in the carousel component, where the
    data-slide and data-slide-to attributes can be exploited
    through the href attribute of an <a> tag due to inadequate
    sanitization. This vulnerability could potentially enable
    attackers to execute arbitrary JavaScript within
    the victim's browser.
    (Closes: #1084060)

 -- Bastien Roucariès <rouca@debian.org>  Thu, 10 Apr 2025 23:47:00 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog fonts-glyphicons-halflings`.
