node-undici (8.9.0+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 8.9.0+dfsg+~cs3.2.0
    Fixes the following vulnerabilities:
    + CVE-2026-13697 (High): cross-user information disclosure and
      parse-time crash via degenerate private cache directives.
      Closes: #1143070
    + CVE-2026-14643 (Medium): optional whitespace around = in qualified
      no-cache and private directives could bypass shared-cache
      restrictions and disclose authenticated data across users.
    + CVE 2026-15157 (Medium): a malicious type property on a duck-typed
      blob-like HTTP/1.1 request body could inject CRLF sequences into the
      generated content-type header.
    + CVE-2026-16728 (Medium): the retry interceptor could expose a stale
      Content-Length after resuming a partial response, potentially causing
      downstream response desynchronization, hangs, or corruption.
    + CVE-2026-16729 (Medium): unsanitized domain and unparsed values passed
      to setCookie() could inject cookie attributes.
      Closes: #1143063

 -- Jérémy Lal <kapouer@melix.org>  Thu, 30 Jul 2026 15:40:51 +0200

node-undici (8.5.0+dfsg+~cs3.2.0-3) unstable; urgency=medium

  * Declare compliance with policy 4.7.4
  * Remove unused node-tap test dependency
  * Add node-ws to network autopkgtest deps (websocket tests need it)

 -- Xavier Guimard <yadd@debian.org>  Tue, 23 Jun 2026 12:55:08 +0200

node-undici (8.5.0+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Upload to unstable 

 -- Jérémy Lal <kapouer@melix.org>  Sat, 20 Jun 2026 22:54:52 +0200

node-undici (8.5.0+dfsg+~cs3.2.0-1) experimental; urgency=medium

  * New upstream version 8.5.0+dfsg+~cs3.2.0.
    Fixes the following vulnerabilities. Closes: #1140363.
    High severity:
    + CVE-2026-12151: WebSocket DoS via fragment count bypass
    + CVE-2026-9697: TLS certificate validation bypass in SOCKS5 ProxyAgent
    + CVE-2026-6734: Cross-origin request routing via SOCKS5 proxy pool reuse
    Medium severity:
    + CVE-2026-9678: Cross-user information disclosure via shared cache whitespace bypass
    + CVE-2026-9679: HTTP header injection via Set-Cookie percent-decoding
    Low severity:
    + CVE-2026-11525: Set-Cookie SameSite attribute downgrade
    + CVE-2026-6733: HTTP response queue poisoning via keep-alive socket reuse
  * Drop applied patch
  * Refresh patch
  * Drop another test (release.js)

 -- Jérémy Lal <kapouer@melix.org>  Sat, 20 Jun 2026 15:47:40 +0200

node-undici (7.24.6+dfsg+~cs3.2.0-3) unstable; urgency=medium

  * Use upstream patch to improve tls-cert-leak test.

 -- Jérémy Lal <kapouer@melix.org>  Sat, 23 May 2026 15:37:16 +0200

node-undici (7.24.6+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Add patch for @sinonjs/fake-timer 15 (node-sinon 21)

 -- Xavier Guimard <yadd@debian.org>  Tue, 31 Mar 2026 13:51:05 +0200

node-undici (7.24.6+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.24.6+dfsg+~cs3.2.0

 -- Xavier Guimard <yadd@debian.org>  Sun, 29 Mar 2026 20:41:59 +0200

node-undici (7.24.5+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * Declare compliance with policy 4.7.3
  * Drop "Rules-Requires-Root: no"
  * Drop "Priority: optional"
  * New upstream version 7.24.5+dfsg+~cs3.2.0
    Fixes: CVE-2026-2581, CVE-2026-2229, CVE-2026-1528, CVE-2026-1527,
    CVE-2026-1526, CVE-2026-1525, CVE-2025-47279.
    Closes: #1130885, #1130884, #1130883, #1130882, #1130880, #1130879,
    #1105860.

 -- Xavier Guimard <yadd@debian.org>  Mon, 23 Mar 2026 12:45:37 +0100

node-undici (7.18.2+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.18.2+dfsg+~cs3.2.0
    CVE-2026-22036: Unbounded decompression chain in HTTP responses
    via Content-Encoding leads to resource exhaustion. Closes: #1125679.
  * Switch to watch 5
  * Update salsa-ci.yml

 -- Jérémy Lal <kapouer@melix.org>  Thu, 15 Jan 2026 22:23:32 +0100

node-undici (7.16.0+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Tighten dependency on node-llhttp for ci
  * patch: skip tls-cert-leak on i386. Closes: #1117521.

 -- Jérémy Lal <kapouer@melix.org>  Thu, 09 Oct 2025 16:46:37 +0200

node-undici (7.16.0+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.16.0+dfsg+~cs3.2.0.
  * Refresh patch

 -- Jérémy Lal <kapouer@melix.org>  Tue, 07 Oct 2025 10:09:34 +0200

node-undici (7.15.0+dfsg+~cs3.2.0-3) unstable; urgency=medium

  * Fix substvar name in control. Closes: #1115737.

 -- Jérémy Lal <kapouer@melix.org>  Sat, 20 Sep 2025 18:03:56 +0200

node-undici (7.15.0+dfsg+~cs3.2.0-2) unstable; urgency=medium

  * Loosen dependency on node-llhttp

 -- Jérémy Lal <kapouer@melix.org>  Mon, 01 Sep 2025 01:59:16 +0200

node-undici (7.15.0+dfsg+~cs3.2.0-1) unstable; urgency=medium

  * New upstream version 7.15.0+dfsg+~cs3.2.0
  * Unbundle and B-D node-llhttp, and use its wasm blobs
  * Add missing Expat license
  * patch: simplify build and install by using global llhttp
  * Update https-pem test module

 -- Jérémy Lal <kapouer@melix.org>  Fri, 29 Aug 2025 16:25:05 +0200

node-undici (7.3.0+dfsg1+~cs24.12.11-2) unstable; urgency=medium

  * Fix llhttp makefile (shuffle bug) (Closes: #1105523)

 -- Yadd <yadd@debian.org>  Tue, 13 May 2025 22:42:34 +0200

node-undici (7.3.0+dfsg1+~cs24.12.11-1) unstable; urgency=medium

  * New upstream version 7.3.0+dfsg1+~cs24.12.11

 -- Jérémy Lal <kapouer@melix.org>  Sun, 26 Jan 2025 16:18:40 +0100

node-undici (7.2.3+dfsg1+~cs24.12.11-2) experimental; urgency=medium

  * Breaks/Replaces libllhttp9.1. Closes: #1093828.

 -- Jérémy Lal <kapouer@melix.org>  Sat, 25 Jan 2025 12:59:34 +0100

node-undici (7.2.3+dfsg1+~cs24.12.11-1) experimental; urgency=medium

  * New upstream version 7.2.3+dfsg1+~cs24.12.11
  * CVE-2025-22150: Uses Insufficiently Random Values
  * Standards-Version 4.7.0
  * Bump libllhttp soname to 9.2
  * copyright: update paths
  * rules: remove extra LICENSE
  * lintian-overrides: fix paths
  * patches: remove unapplied
  * rules: clean

 -- Jérémy Lal <kapouer@melix.org>  Tue, 21 Jan 2025 19:53:51 +0100

node-undici (7.1.0+dfsg1+~cs24.12.10-1) experimental; urgency=medium

  * New upstream version 7.1.0+dfsg1+~cs24.12.10
  * watch: use llhttp tag
  * node-undici.docs: fix path
  * rules: set WASM_* env vars for Makefile
  * copyright: add cache-tests and dfsg-exclude parts of it
  * Add missing test module @matteo.collina/tspl
  * B-D libclang-rt-dev-wasm32
  * Update fix-llhttp-version.patch
  * Build wasm with simd flag too
  * pkgjs tests:
    + use node --test, reenable many tests
    + bundle @matteo.collina/tspl
    + update selfsigned module, default to 2048 key
    + control: proxyquire becomes proxy-agent

 -- Jérémy Lal <kapouer@melix.org>  Tue, 10 Dec 2024 16:04:19 +0100

node-undici (5.28.4+dfsg1+~cs23.12.11-2) unstable; urgency=medium

  * Team upload
  * Fix fix-wasm-build.patch
  * Clean obj-* directory
  * Build with upstream script. Closes: #1068842
  * Drop fix_perms llhttp.wasm, not installed

 -- Jérémy Lal <kapouer@melix.org>  Fri, 12 Apr 2024 12:05:59 +0200

node-undici (5.28.4+dfsg1+~cs23.12.11-1) unstable; urgency=medium

  * New upstream version (Closes: CVE-2024-30261)
  * Refresh patches

 -- Yadd <yadd@debian.org>  Fri, 05 Apr 2024 15:26:06 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-6) unstable; urgency=medium

  * Update homepages
  * Drop test/connect-timeout.js from network test (unstable test in debci env)
  * Clean build links

 -- Yadd <yadd@debian.org>  Mon, 22 Jan 2024 14:45:20 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-5) unstable; urgency=medium

  * Drop dependency to node-busboy

 -- Yadd <yadd@debian.org>  Sun, 21 Jan 2024 06:57:54 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-4) unstable; urgency=medium

  * Build libllhttp (Closes: #977716)
    + add patch to export SONAME
    + add libllhttp9 and libllthhp-dev
    + update lintian overrides
    + add build dependency to cmake
  * Fix permissions

 -- Yadd <yadd@debian.org>  Sat, 20 Jan 2024 08:50:46 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-3) unstable; urgency=medium

  * Source-only upload

 -- Yadd <yadd@debian.org>  Sun, 03 Dec 2023 07:07:30 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-2) unstable; urgency=medium

  * Build and publish undici-types, needed by new @types/node
  * Binary upload

 -- Yadd <yadd@debian.org>  Sat, 02 Dec 2023 22:34:40 +0400

node-undici (5.28.2+dfsg1+~cs23.11.12.3-1) unstable; urgency=medium

  * New upstream version 5.28.2+dfsg1+~cs23.11.12.3
  * Refresh patches

 -- Yadd <yadd@debian.org>  Sat, 02 Dec 2023 22:01:17 +0400

node-undici (5.28.0+dfsg1+~cs23.11.12.3-2) unstable; urgency=medium

  * Update lintian overrides
  * Add patch to workaround nodejs bug
    (fixes nodejs build, thanks to Jérémy Lal)

 -- Yadd <yadd@debian.org>  Mon, 27 Nov 2023 15:45:33 +0400

node-undici (5.28.0+dfsg1+~cs23.11.12.3-1) unstable; urgency=medium

  * New upstream version 5.28.0+dfsg1+~cs23.11.12.3
  * Drop workaround-node-bug.patch
  * Update build
  * Drop some failing test

 -- Yadd <yadd@debian.org>  Sun, 26 Nov 2023 08:07:47 +0400

node-undici (5.26.3+dfsg1+~cs23.10.12-3) unstable; urgency=medium

  * Add fix for node-proxy >= 2

 -- Yadd <yadd@debian.org>  Thu, 23 Nov 2023 11:38:43 +0400

node-undici (5.26.3+dfsg1+~cs23.10.12-2) unstable; urgency=medium

  * Add wokaround to nodejs bug (unable to require node:*)

 -- Yadd <yadd@debian.org>  Sat, 14 Oct 2023 14:49:40 +0400

node-undici (5.26.3+dfsg1+~cs23.10.12-1) unstable; urgency=medium

  * Embed @fastify/busboy
  * New upstream version (Closes: #1053879, CVE-2023-45143)
  * Unfuzz patches
  * Fix for clang 16 (Closes: #1052723)
  * Update copyright
  * Update lintian overrides
  * Update test

 -- Yadd <yadd@debian.org>  Fri, 13 Oct 2023 22:03:31 +0400

node-undici (5.22.1+dfsg1+~cs20.10.10.2-1) unstable; urgency=medium

  [ Michael R. Crusoe ]
  * Drop unused libsimde-dev from build dependencies

  [ Yadd ]
  * Update wasm exclusion
  * New upstream version 5.22.1+dfsg1+~cs20.10.10.2
  * Update test
  * Refresh patches
  * Update lintian overrides

 -- Yadd <yadd@debian.org>  Sun, 09 Jul 2023 15:08:57 +0400

node-undici (5.19.1+dfsg1+~cs20.10.9.5-2) unstable; urgency=medium

  * Disable network test on armel (Closes: #1032559)

 -- Yadd <yadd@debian.org>  Wed, 22 Mar 2023 10:50:17 +0400

node-undici (5.19.1+dfsg1+~cs20.10.9.5-1) unstable; urgency=medium

  * New upstream version (Closes: #1031418, CVE-2023-23936, CVE-2023-24807)
  * Refresh patches

 -- Yadd <yadd@debian.org>  Fri, 17 Feb 2023 07:23:05 +0400

node-undici (5.15.0+dfsg1+~cs20.10.9.3-1) unstable; urgency=medium

  * Update standards version to 4.6.2, no changes needed.
  * New upstream version 5.15.0+dfsg1+~cs20.10.9.3

 -- Yadd <yadd@debian.org>  Sun, 15 Jan 2023 10:04:29 +0400

node-undici (5.14.0+dfsg1+~cs20.10.9-1) unstable; urgency=medium

  * New upstream version 5.14.0+dfsg1+~cs20.10.9

 -- Yadd <yadd@debian.org>  Sun, 11 Dec 2022 15:50:58 +0100

node-undici (5.13.0+dfsg1+~cs20.10.9-1) unstable; urgency=medium

  * Update lintian override info format in d/source/lintian-overrides
    on line 2-3.
  * New upstream version 5.13.0+dfsg1+~cs20.10.9

 -- Yadd <yadd@debian.org>  Sat, 03 Dec 2022 18:14:54 +0100

node-undici (5.12.0+dfsg1+~cs20.10.9-1) unstable; urgency=medium

  * New upstream version 5.12.0+dfsg1+~cs20.10.9
  * Unfuzz patches

 -- Yadd <yadd@debian.org>  Fri, 28 Oct 2022 22:39:53 +0200

node-undici (5.11.0+dfsg1+~cs20.10.9-1) unstable; urgency=medium

  * New upstream version 5.11.0+dfsg1+~cs20.10.9
  * Update llhttp build
  * Unfuzz patches
  * Add dependency to node-busboy

 -- Yadd <yadd@debian.org>  Tue, 18 Oct 2022 06:25:29 +0200

node-undici (5.10.0+dfsg1+~cs18.9.18.10-2) unstable; urgency=medium

  * Launch tap test without timeout (may fix armel autopkgtest)

 -- Yadd <yadd@debian.org>  Wed, 14 Sep 2022 10:25:18 +0200

node-undici (5.10.0+dfsg1+~cs18.9.18.10-1) unstable; urgency=medium

  * Enable __proto__ in test, needed here for pkg-js-autopkgtest 0.15
  * New upstream version 5.10.0+dfsg1+~cs18.9.18.10

 -- Yadd <yadd@debian.org>  Mon, 12 Sep 2022 12:01:40 +0200

node-undici (5.10.0+dfsg1+~cs18.9.18.7-1) unstable; urgency=medium

  * New upstream version 5.10.0+dfsg1+~cs18.9.18.7

 -- Yadd <yadd@debian.org>  Tue, 30 Aug 2022 06:32:25 +0200

node-undici (5.9.1+dfsg1+~cs18.9.18.1-1) unstable; urgency=medium

  * New upstream version 5.9.1+dfsg1+~cs18.9.18.1

 -- Yadd <yadd@debian.org>  Mon, 22 Aug 2022 09:34:29 +0200

node-undici (5.8.2+dfsg1+~cs18.9.18.1-1) unstable; urgency=medium

  * New upstream version 5.8.2+dfsg1+~cs18.9.18.1

 -- Yadd <yadd@debian.org>  Sat, 13 Aug 2022 07:06:18 +0200

node-undici (5.8.1+dfsg1+~cs18.9.18.1-1) unstable; urgency=medium

  * New upstream version 5.8.1+dfsg1+~cs18.9.18.1
  * Refresh patches
  * Update test modules

 -- Yadd <yadd@debian.org>  Mon, 08 Aug 2022 21:01:44 +0200

node-undici (5.8.0+dfsg1+~cs18.9.16-2) unstable; urgency=medium

  * Update typescript patch (Closes: #1016322)

 -- Yadd <yadd@debian.org>  Sat, 30 Jul 2022 15:17:27 +0200

node-undici (5.8.0+dfsg1+~cs18.9.16-1) unstable; urgency=medium

  * Apply multi-arch hints (foreign)
  * New upstream version 5.8.0+dfsg1+~cs18.9.16

 -- Yadd <yadd@debian.org>  Tue, 19 Jul 2022 15:55:13 +0200

node-undici (5.7.0+dfsg1+~cs18.9.16-3) unstable; urgency=medium

  * Fix bad control field

 -- Yadd <yadd@debian.org>  Thu, 14 Jul 2022 21:59:46 +0200

node-undici (5.7.0+dfsg1+~cs18.9.16-2) unstable; urgency=medium

  * node-llhttp: add dependencies to node-debug and node-semver
  * Use custom autopkgtest since lld is not available on s390x arch

 -- Yadd <yadd@debian.org>  Thu, 14 Jul 2022 10:46:45 +0200

node-undici (5.7.0+dfsg1+~cs18.9.16-1) unstable; urgency=medium

  * New upstream version 5.7.0+dfsg1+~cs18.9.16

 -- Yadd <yadd@debian.org>  Thu, 14 Jul 2022 08:30:12 +0200

node-undici (5.6.1+dfsg1+~cs18.9.16-1) unstable; urgency=medium

  * New undici version (Closes: CVE-2022-32210)
  * Add patch to drop SSL tests with too short key

 -- Yadd <yadd@debian.org>  Sun, 10 Jul 2022 18:29:46 +0200

node-undici (5.2.0+dfsg1+~cs18.9.15.10-1) unstable; urgency=medium

  [ Yadd, Jérémy Lal ]
  * Initial release (Closes: #1010470)

 -- Yadd <yadd@debian.org>  Sat, 11 Jun 2022 18:54:32 +0200
