xz-utils (5.2.5-2ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2026-34743.patch: adds a check to
      lzma_index_prealloc() to default to a safe size when decoding empty
      indexes in src/liblzma/common/index.c.
    - CVE-2026-34743

 -- Ian Constantin <ian.constantin@canonical.com>  Thu, 28 May 2026 19:06:40 +0300

xz-utils (5.2.5-2ubuntu1) jammy; urgency=medium

  * SECURITY UPDATE: arbitrary file overwrite or code execution with
    crafted file names
    - debian/patches/CVE-2022-1271.patch: fix escaping of malicious
      filenames in src/scripts/xzgrep.in.
    - CVE-2022-1271

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 08 Apr 2022 08:51:38 -0400

xz-utils (5.2.5-2build2) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 25 Mar 2022 10:54:45 +0100

xz-utils (5.2.5-2build1) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:27:19 +0200

xz-utils (5.2.5-2) unstable; urgency=medium

  * Non-maintainer upload (Closes: #983067).
  * Upload to unstable.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Mon, 08 Mar 2021 23:01:54 +0100

xz-utils (5.2.5-1.1) experimental; urgency=medium

  * Non-maintainer upload.
  * Update the patches for #844770 and #975981 to what upstream applied.
  * Add a SIGPIPE fix to xzgrep (similar to xzcmp in #844770).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Tue, 02 Mar 2021 21:50:25 +0100

xz-utils (5.2.5-1.0) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream release (Closes: #975984).
    - Increase GETTEXT version (Closes: #959999).
  * Add % target to the rules file to work with newer debhelper
    (Closes: #945961).
  * Enable threads for static builds (Closes: #907449).
  * Ignore SIGPIPE in xzdiff script (Closes: #844770).
  * Teach xzgrep about zstd (Closes: #970891).
  * Clean up the xz man page (Closes: #894454).
  * Ignore hard link count if input is not deleted (Closes: #975981).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Mon, 28 Dec 2020 11:25:06 +0100

xz-utils (5.2.4-1) unstable; urgency=low

  * New upstream release.  Closes: #851615.
  * Standards-Version: 4.3.0 (checked).
  * Use an XZ compressed tarball for upstream source.
  * Add upstream signing key and verify tarball at "uscan" time.
  * Drop patches; all were applied or otherwise fixed upstream.
  * Update copyright file.
  * debian/control:
    - Use a stable repo.or.cz URL for packaging repo.
      Closes: #826382.  Thanks to Rolf Leggewie.
    - Use https for upstream homepage URL.
    - No longer Build-Depends: freebsd-glue on kfreebsd.
  * get-orig-source: Use https for upstream Git repository.
  * liblzma:
    - Remove compatibility tricks that permit sharing a process with
      liblzma.so.2.  This means liblzma.a no longer depends on libdl
      at run time.
      Closes: #919950.  Thanks to Josh Triplett.
    - Breaks: liblzma2 versions without symbol versioning.
    - Priority: optional.
  * xz-utils:
    - Lower priority of xz-utils to standard.  Closes: #685203.
    - README.Debian: Remove notes about differences from upstream.
    - Remove old NEWS.Debian.

 -- Jonathan Nieder <jrnieder@gmail.com>  Sun, 27 Jan 2019 17:09:34 -0800

xz-utils (5.2.2-1.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Force a constant /bin/sh for installed scripts. This helps the build
    be reproducible; /bin/sh on Debian is always POSIX. (Closes: #806331)

 -- Ximin Luo <infinity0@debian.org>  Wed, 28 Jun 2017 18:39:19 +0200

xz-utils (5.2.2-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * link against libfreebsd-glue on kfreebsd-* (Closes: #840063)

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Sat, 08 Oct 2016 15:11:19 +0200

# For older changelog entries, run 'apt-get changelog xzdec'
