afdko (4.0.1+dfsg1-4) unstable; urgency=medium
 .
   * Team upload.
   * Mark python3-tqdm as <!nocheck>
   * d/watch: use GitHub template

amd-debug-tools (0.2.22-1) unstable; urgency=medium
 .
   * New upsteram version
     - Improve IOMMU detection.
     - Whitespace improvements.

android-platform-external-libselinux (10.0.0+r36-2.1) unstable; urgency=low
 .
   * Non-maintainer upload.
   * debian/rules: Build with -std=gnu17 to fix FTBFS with GCC 15.
     (Closes: #1096309)
android-platform-external-libselinux (10.0.0+r36-2) unstable; urgency=medium
 .
   * Team upload
 .
   [ 殷啟聰 | Kai-Chung Yan ]
   * Remove myself from Uploaders
 .
   [ Adrian Bunk ]
   * Switch to PCRE2 (Closes: #1000020).
android-platform-external-libselinux (10.0.0+r36-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version
   * Standards-Version: 4.5.0
android-platform-external-libselinux (8.1.0+r23-4) unstable; urgency=medium
 .
   * Team upload.
   * debian/patches: Replace my patch with the one from BTS to fix FTBFS.
     (Closes: #952415)
   * debian/.gitlab-ci.yml: Update to perform CI only on master branch.
android-platform-external-libselinux (8.1.0+r23-3) unstable; urgency=medium
 .
   * Team upload.
   * debian/watch: Update rule to get new upstream version.
   * debian/control: Add Rules-Requires-Root: no
   * debian/rules: Add more security hardening.
   * debian/patches: Add patch fix FTBFS
android-platform-external-libselinux (8.1.0+r23-2) unstable; urgency=medium
 .
   * Release to unstable
   * Install README.android to /usr/share/doc
android-platform-external-libselinux (8.1.0+r23-1) experimental; urgency=medium
 .
   * Install READMEs to the main packages rather than the dev ones
 .
   [ Saif Abdul Cassim ]
   * Track new upstream platform/external/selinux in AOSP
   * Switch to Salsa Vcs
 .
   [ Chandramouli Rajagopalan ]
   * Add myself to Uploaders
   * Track new upstream platform/external/selinux in AOSP
 .
   [ Umang Parmar ]
   * Add myself to Uploaders
   * Build libsepol and libsepol-dev binary packages
   * Use 'debian/clean' to simplify the build scripts
 .
   [ Hans-Christoph Steiner ]
   * New Upstream release
   * d/rules: Remove get-orig-source
android-platform-external-libselinux (7.0.0+r1-2) unstable; urgency=medium
 .
   * Upload to unstable
   * Update to debhelper 10
   * d/control: Unify the maintainer name to "Android Tools Maintainers"
android-platform-external-libselinux (7.0.0+r1-1) experimental; urgency=medium
 .
   * New upstream release
   * Define NDEBUG for C binaries
android-platform-external-libselinux (6.0.1+r55-1) unstable; urgency=medium
 .
   [ Chirayu Desai ]
   * New upstream release. (Identical to 6.0.1+r16)
   * debian: Add watch file for usage with uscan
 .
   [ Kai-Chung Yan ]
   * d/rules:  No need to enable all hardening features, pie + bindnow will be
     default in Stretch
android-platform-external-libselinux (6.0.1+r16-2) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Kai-Chung Yan ]
   * Install libraries to DEB_HOST_MULTIARCH path
   * Update Standards-Version to 3.9.8 (no changes)
   * d/rules: export DEB_BUILD_MAINT_OPTIONS = hardening=+all
android-platform-external-libselinux (6.0.1+r16-1) unstable; urgency=medium
 .
   * New upstream release
android-platform-external-libselinux (6.0.0+r26-3) unstable; urgency=medium
 .
   * upload to unstable
android-platform-external-libselinux (6.0.0+r26-2) experimental; urgency=medium
 .
   * Add version 0 to SONAME
   * Install docs for libselinux
android-platform-external-libselinux (6.0.0+r26-1) experimental; urgency=low
 .
   * New upstream release
   * Remove version info from the library
android-platform-external-libselinux (5.1.1+r8-1) unstable; urgency=low
 .
   [ Kai-Chung Yan ]
   * Initial release (Closes: #793611)

android-udev-rules (0~20260922-1) unstable; urgency=low
 .
   * Update to new upstream version 0~20260922.

binutils-djgpp (3) unstable; urgency=medium
 .
   * Build using binutils-source, based on binutils-mingw-w64.
binutils-djgpp (2.35.1+dfsg-3) unstable; urgency=medium
 .
   * Wrap and sort the control files.
   * Remove the unused quilt build-dependency. Closes: #1129930.
   * Drop “Rules-Requires-Root: no” since it’s now the default.
   * Drop “Priority: optional” since it’s now the default.
   * Remove the old FSF address from debian/copyright.
   * Standards-Version 4.7.4, no further change required.
   * Bump to debhelper compatibility level 14.
binutils-djgpp (2.35.1+dfsg-2) unstable; urgency=medium
 .
   [ Stephen Kitt ]
   * Remove the obsolete README.source.
   * Strip the remote path in debian/watch.
   * Update the DJGPP stub to the version used by DJGPP 2.05’s stubify,
     with the empty environment patch applied (see
     https://github.com/jwt27/djgpp-cvs/commit/da81e265d6dd).
   * Update Lintian overrides.
   * Standards-Version 4.6.1, no change required.
 .
   [ Debian Janitor ]
   * Drop unnecessary dh arguments: --parallel
binutils-djgpp (2.35.1+dfsg-1) unstable; urgency=medium
 .
   * New upstream release.
   * Update debian/watch to account for three-component version numbers.
binutils-djgpp (2.34+dfsg-1) unstable; urgency=medium
 .
   * Add debian/watch and convert debian/copyright to machine-readable
     format to prepare for switch to native packaging.
   * Switch to a non-native package with a separate copy of the source
     code, to avoid tying the package to the main Debian binutils’
     package’s cadence; the DJGPP patches are updated more slowly.
     This means we no longer need to patch binutils-source.
     Closes: #964604.
   * Lintian: rename “manpage-has-errors-from-man” to “groff-message”.
   * Switch to debhelper compatibility level 13.
binutils-djgpp (1.4) unstable; urgency=medium
 .
   * Apply the DJGPP binutils patches. Thanks to J.W. Jagersma for
     reminding me that these are necessary!
binutils-djgpp (1.3) unstable; urgency=medium
 .
   * Declare the symlinks the right way round...
binutils-djgpp (1.2) unstable; urgency=medium
 .
   * Target i386 rather than i586 (and provide symlinks for compatibility
     with third-party scripts and tools).
   * Drop unused Lintian override.
   * Standards-Version 4.5.0, no change required.
binutils-djgpp (1.1) unstable; urgency=medium
 .
   * Apply the binutils-mingw-w64 fix for build/host confusion.
   * Copy binutils-mingw-w64’s spelling check.
   * Standards-Version 4.4.1, no change required.
binutils-djgpp (1) unstable; urgency=medium
 .
   * Initial packaging based on binutils-mingw-w64. Closes: #935803.

bluez (5.87-5) unstable; urgency=medium
 .
   * Team upload
   * Add patch to fix build against evolution-data-server 3.62

borgbackup2 (2.0.0b25-4) unstable; urgency=medium
 .
   * Fix some more issues in tests
borgbackup2 (2.0.0b25-3) unstable; urgency=medium
 .
   * Fix tests by passing BORG_PASSPHRASE
borgbackup2 (2.0.0b25-2) unstable; urgency=medium
 .
   * Add debian patch 10494.patch, fixing testsuite failure
     with an upstream proposed approach
borgbackup2 (2.0.0b25-1) unstable; urgency=medium
 .
   * New upstream version 2.0.0b25
   * Refresh patch
   * Bump borgstore dependency
   * debian/tests: move from none-256 to authenticated-256 as per upstream deprecation

buteo-sync-plugin-caldav (0.4.10-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream release

buteo-syncfw (0.11.12-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream release
   * Add Lintian override for use of get-orig-source
   * Remove unnecessary .placeholder file
   * Update Standards Version to 4.7.4

bzip3 (1.5.4-1) unstable; urgency=medium
 .
   * New upstream released.
   * d/patches: Remove the patches merged into upstream.
   * d/control:
     - Update debhelper-compat to 14
     - Update Standards-Version: 4.7.4

clifm (1.29-1) unstable; urgency=medium
 .
   * New upstream version 1.29
   * d/watch: update to new version 5 format

crimson (0.5.3-2) unstable; urgency=medium
 .
   * Team upload
   * Drop Uwe from Uploaders (Closes: #1144550)
   * d/copyright: Convert to machine-readable format

crow-translate (4.1.0+ds-1) unstable; urgency=medium
 .
   * Salvage the package. (Closes: #1148551)
   * New upstream release. (Closes: #1129375)
   * Build with Qt6 and KF6. (Closes: #1129376)
   * debian/watch: Track KDE release tarballs. (Closes: #1129374)
   * Repack to exclude bundled espeak-ng and SingleApplication examples.
   * Disable Piper TTS (needs onnxruntime >= 1.27).
   * Run upstream tests during build.
   * debian/control: Depend on qdbus-qt6. (Closes: #1142860)
   * debian/control: Recommend a Qt TextToSpeech engine plugin.
   * debian/control: Bump debhelper compat to 14; use single-binary addon.
   * debian/control: Apply wrap-and-sort -abst.
   * debian/control: Update Homepage and description.
   * debian/copyright: Update for new upstream release.
   * debian/clean: Remove the test home directory.
   * debian/upstream/metadata: Update upstream locations.
   * debian/patches: Drop patch applied upstream.

eodag (4.9.2+ds-2) unstable; urgency=medium
 .
   * Team upload.
   * Require at least jsonpath-ng 1.9.0, tests fail with 1.8.0.
   * Add patch to skip test that doesn't work reliably.
     (closes: #1150381)
eodag (4.9.2+ds-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.
     (closes: #1150325)
   * Refresh patches.

feather-wallet (2.8.1+dfsg-7) unstable; urgency=medium
 .
   * Add debian/patches/fix-openssl4-compat.patch, thanks Reuben Roessler
     (closes: #1138339).
   * Add debian/patches/fix-boost-1.92 (closes: #1149273).
   * debian/control:
     - Bump debhelper-compat from version 13 to 14, removing the now-unnecessary
       Depends on ${misc:Depends} and ${shlibs:Depends}.
     - Add Build-Depends on dh-sequence-single-binary.

firefox-esr-mobile-config (5.5.1-1) unstable; urgency=medium
 .
   * New upstream version
   * d/copyright: update for new upstream release
   * d/patches: update for new upstream release

fonts-babelstone-modern (6.002-4) unstable; urgency=medium
 .
   * Team upload.
   * Document Reserved Font Name.
   * Move to contrib.
   * Fix lintian: capitalization-error-in-description.
 .
   [ ChangZhuo Chen (陳昌倬) ]
   * d/control: Bump Standards-Version to 4.7.3:
     * Remove unnecessary Priority, Rules-Requires-Root.
   * d/salsa-ci.yml: Add Salsa CI config

fonts-beteckna (0.5-5) unstable; urgency=medium
 .
   * Team upload
   * d/copyright: Add missing Font exception
   * README: change mode to passive
   * Scan git HEAD (no current tags/releases)
   * Disable ff ligature (Closes: #824202, #609742, #567718)

fonts-century-catalogue (001.001-9) unstable; urgency=medium
 .
   * Team upload
   * Drop retired Uploader (Closes: #1139753)
   * Override build target instead of install
   * d/copyright: Convert to machine-readable format
   * Drop newline from LangName
   * Clean build directory (Closes: #1044757)
   * Set hhea ascent/descent offsets so line height is sane (Closes: #600362)

fonts-gubbi (1.3-9) unstable; urgency=medium
 .
   * Team upload
   * Use clean file
   * Clear FSType

fonts-vollkorn (4.105+ds-2) unstable; urgency=medium
 .
   * Team upload
   * Set weightClass to address graphical glitches (Closes: #1149041)

gnome-shell-extension-no-annoyance (0+20241212-8ca0647-4) unstable; urgency=medium
 .
   * Update for GNOME 51 (Closes: #1148614)
   * Update patch for metadata.json to include shell-version 51.

ipy (1:1.2-1) unstable; urgency=medium
 .
   * Team Upload
   * Rename d/.gitlab-ci.yml -> d/salsa-ci.yml
   * Disable useless ALL & ANY Salsa CI jobs
   * Rewrite d/watch in v5 format, switch to new repos
   * Bump Standards-Version to 4.7.4, drop Priority: tag
   * New upstream version 1.2

jsonpath-ng (1.9.1-1) unstable; urgency=medium
 .
   [ Bas Couwenberg ]
   * Bump Standards-Version to 4.7.4, no changes.
   * Update lintian overrides.
   * Use pybuild-plugin-pyproject instead of python3-setuptools.
 .
   [ Antonio Valentino ]
   * New upstream release.
   * debian/patches:
     - Refresh all patches.
   * Update paths in d/copyright.

kdiskmark (3.3.0+ds-3) unstable; urgency=medium
 .
   * Salvage the package. (Closes: #1148553)
   * debian/patches/0001: Fix FTBFS on 32-bit. (Closes: #1140620)
   * debian/watch: Track the -standalone release tags.
   * debian/control: Bump debhelper compat to 14; use single-binary addon.
   * debian/control: Apply wrap-and-sort -abst; drop Priority field.
   * debian/control: Move long description to the source stanza.
   * debian/copyright: Fix GPL version in comment; add myself.
kdiskmark (3.3.0+ds-2) unstable; urgency=medium
 .
   * d/control: drop myself from Uploaders.
kdiskmark (3.3.0+ds-1) unstable; urgency=medium
 .
   * New upstream version.
   * d/copyright: bump years.
   * Bump standards version to 4.7.4.
kdiskmark (3.2.0+ds-1) unstable; urgency=medium
 .
   * New upstream version.
   * Bump standard version to 4.7.2.
   * d/copyright:
     - bump years.
     - drop data/icons/flags/* part.
   * d/control:
     - Rules-Requires-Root dropped.
     - qt5 to qt6, add libpolkit-qt6-1-dev to build-depends.
   * d/watch: update to version 5.
kdiskmark (3.1.3+ds-5) unstable; urgency=medium
 .
   * Bump standards version to 4.7.0.
kdiskmark (3.1.3+ds-4) unstable; urgency=medium
 .
   * d/control: update short description. (Closes: #1052266)
   * d/clean: added, fix source after build problem. (Closes: #1046455)
kdiskmark (3.1.3+ds-3) unstable; urgency=medium
 .
   * d/control: add fio to Depends.
kdiskmark (3.1.3+ds-2) unstable; urgency=medium
 .
   * Upload to unstable.
   * d/watch: updated.
kdiskmark (3.1.3+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #973684)

lfortran (0.67.0-1) unstable; urgency=medium
 .
   * New upstream release
   * Include /usr/lib/libasr headers in -dev pkg

libbraiding (1.3.2-1) unstable; urgency=medium
 .
   [ Debian Janitor ]
   * Set upstream metadata fields: Repository-Browse.
   * Update standards version to 4.6.1, no changes needed.
   * Set upstream metadata fields: Repository.
   * Update standards version to 4.6.2, no changes needed.
 .
   [ Tobias Hansen ]
   * New upstream version.
   * Build-Depend on pkgconf.
   * Install pc file.

libgbinder (1.1.54-1) unstable; urgency=medium
 .
   * New upstream release
   * Add debian/libgbinder1.docs to install README
   * Install /etc/gbinder.d/
   * Update minimum libglibutil
libgbinder (1.1.53-1) unstable; urgency=medium
 .
   * New upstream release
   * Adopt for the Debian UBports Team (Closes: #1142242)
   * debian/copyright: remove unnecessary Files-Excluded: debian
   * Remove unnecessary direct library Depends handled by dh_shlibdeps
   * Update debian/rules for upstream buildsystem change
   * Update debian/libgbinder1.symbols
   * Use DEB_CFLAGS_MAINT_APPEND instead of patching Makefiles

libglibutil (1.0.83-1) unstable; urgency=medium
 .
   [ Lucas de Castro Borges ]
   * New upstream version
   * debian/libglibutil1.symbols: Add new symbols
 .
   [ Jeremy Bícha ]
   * Adopt for the Debian UBports Team (Closes: #1142243)
   * libglibutil-dev: Add Depends: libglib2.0-dev (Closes: #1150175)
   * Use DEB_CFLAGS_MAINT_APPEND instead of patching Makefiles
   * Remove unnecessary Files-Excluded: debian

libhomfly (1.04-1) unstable; urgency=medium
 .
   * New upstream release.
   * Ship pkg-config file.
   * Move package from Debian Science Team to Debian Math Team.

libpgjava (42.7.14-1) unstable; urgency=medium
 .
   * New upstream version 42.7.14. (Closes: #1150330)
     + CVE-2026-107315: versions 42.7.4 through 42.7.13 pad a value that is
       shorter than its declared length with bytes left in its send buffer
       instead of zeros, and the server stores those bytes as part of the
       value. The bytes are messages the driver sent earlier on the same
       connection: SQL text and parameter values of recent statements, which on
       a pooled connection can come from other requests. Each padded value can
       carry up to 8192 bytes of this traffic, or 16320 bytes on a connection
       with GSS encryption. The padding happens when an application declares a
       length larger than the data it supplies, through
       PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy,
       PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The
       driver accepts these calls without an error. An attacker who can make
       the application store such a value and read it back can collect earlier
       traffic. Applications whose declared lengths always match their data are
       not affected. Versions 42.7.3 and earlier pad with zeros.
     + CVE-2026-107314: versions 42.7.11 through 42.7.13 enforce no restriction
       when the requireAuth connection property excludes all six authentication
       methods the driver knows, for example
       requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver
       then accepts any method the server asks for, including cleartext
       password authentication. A value without a method in it, such as
       requireAuth=, (a single comma), is affected the same way. An attacker
       positioned between the application and its server can ask for cleartext
       password authentication and receive the database password. A positive
       list such as requireAuth=scram-sha-256, and a partial exclusion such as
       requireAuth=!password,!md5, are enforced correctly. The property has no
       default value, so a deployment that does not set it is not affected.
       42.7.14 fixes the problem: such a connection is refused with SQLState
       08004, and a value without a method in it is rejected as invalid.

libvpd (2.2.9-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Fix file loss during bookworm to trixie upgrade (DEP17 /usr-move).
     Add dpkg-divert protective diversions for udev rules file.
     Thanks to Helmut Grohne for the patch. (Closes: #1091747)
libvpd (2.2.9-1) unstable; urgency=medium
 .
   * Update to new upstream version 2.2.9.
   * Update copyright details
   * Fix typo in symbols file's Build-Depends-Package
   * Import symbols file improvements from Ubuntu with lto
   * Follow SONAME change
libvpd (2.2.8-1) unstable; urgency=medium
 .
   * New upstream release
   * Update d/watch to version 4
   * Update d/copyright year
   * Bump Standards-Version to 4.6.0.1
   * d/patches : Remove dynamic exception specification (Closes: #992074)
libvpd (2.2.7-1) unstable; urgency=medium
 .
   [ Ondřej Nový ]
   * d/watch: Use https protocol
 .
   [ Frédéric Bonnard ]
   * Update to new upstream version 2.2.7.
   * Switch to debhelper-compat usage
   * List not installed files explicitly
   * Update d/copyright file with new version
   * Update homepage after github migration
   * Add Build-Depends-Package field to symbol file
   * Add Rules-Requires-Root field
   * Bump Standards-Version to 4.5.0
libvpd (2.2.6-1) unstable; urgency=medium
 .
   * New upstream release
   * Handle special upstream version of tag for gbp
   * Rediff patches
   * Delete unneeded debian patch
   * Ignore void std::* symbols
   * Improve packaging author information
   * Update Vcs infos
   * Use https for the homepage
   * Upgrade debhelper compatibility level
   * Bump Standards-Version
libvpd (2.2.5-3) unstable; urgency=medium
 .
   * d/p/0001-Changes-run.vpdupdate-creation-path-from-var-lib-lsv.patch
     Use runtime directory for the udev notify file, instead of
     /var/lib. Thanks Dimitri John Ledkov. (Closes: #872993)
   * d/control :
     - Fix accents in my name
   * d/control : upgrade Standard-version to 4.1.0
     - Use Priority optional instead of extra
     - d/copyright : using https for Format
libvpd (2.2.5-2) unstable; urgency=medium
 .
   * Fix license LGPL-2.1+ and its content.
   * Improve symbol file for better compatibility with Ubuntu and -O3
     optimisation which generates or removes symbols (std::* not meant to be
     exported anyway) on ppc64el. Marking them optional.
libvpd (2.2.5-1) unstable; urgency=medium
 .
   * Import from Ubuntu (Closes: #740172)

lomiri-system-settings (1.4.0-6) unstable; urgency=medium
 .
   [ Jeremy Bícha ]
   * Salsa CI: Stop ignoring blhc failures
   * Update debian/upstream/metadata
   * Simplify debian/rules
 .
   [ Mike Gabriel ]
   * debian/rules:
     + Downgrade versioned dependency on base-files in Ubuntu to the version
       shipped with Ubuntu 24.04. This fixes installing this package on Ubuntu
       noble via the Lomiri PPA at https://launchpad.net/~lomiri.

mistral (23.0.0-2) unstable; urgency=high
 .
   * OSSA-2026-044: Four authorization and privilege vulnerabilities in Mistral,
     with the details as per below (Closes: #1150346).
   * CVE-2026-97147: several of Mistral's v2 API write paths resolve the target
     object with a query that can return another project's resource, then write
     to it (CVE-2026-97147). An authenticated project member can use this to
     rewrite and un-publish another project's public action definitions and
     environments. A project administrator can create a workbook whose embedded
     ad-hoc action or workflow name collides with a resource of another project,
     which moves that resource into the caller's project and causes the original
     owner's subsequent updates of it to fail with server errors. All
     deployments exposing the Mistral API are affected. Applied upstream
     patches: "Fix create-or-update of definitions hijacking other projects'
     rows", "Enforce access control when updating action definitions", "Enforce
     access control when updating workbooks and environments", "Resolve
     own-project object when updating code sources / dynamic actions", "Resolve
     own-project cron trigger in create_or_update_cron_trigger":
     - CVE-2026-97147_Fix_create-or-update_of_definitions_hijacking_oth....patch
     - CVE-2026-97147_Enforce_access_control_when_updating_action_defin....patch
     - CVE-2026-97147_Enforce_access_control_when_updating_workbooks_an....patch
     - CVE-2026-97147_Resolve_own-project_object_when_updating_code_sou....patch
     - CVE-2026-97147_Resolve_own-project_cron_trigger_in_create_or_upd....patch
     Added my own patch to fix broken unit test:
     - CVE-2026-97147_Resolve_own-project_object_Fix-test-DB-cleanup-fo....patch
   * CVE-2026-93861: Mistral's workflow membership API lets a project that has
     accepted a share of another project's private workflow create a further
     membership naming a third project (CVE-2026-93861). The new membership row
     is created with its project_id defaulted to the accepting project rather
     than the original workflow owner, so the owner can neither see nor delete
     it. The third project can accept this membership it was never actually
     granted by the owner, then read and execute the owner's private workflow;
     only the accepting (not the owning) project can later revoke that access.
     Applied upstream patch: "Only allow the owner of a resource to share it":
     - CVE-2026-93861_Only_allow_the_owner_of_a_resource_to_share_it.patch
   * CVE-2026-93858: Mistral's ssh_proxied action provider (CVE-2026-93858). By
     supplying a specially-crafted action payload, an unprivileged authenticated
     user may override paramiko's proxy_command resulting in execution of
     arbitrary code on the executor host operating system. Only Mistral
     deployments allowing the std.ssh_proxied action provider (the default) are
     affected. Applied upstream patch: "Fix RCE via std.ssh_proxied
     proxy_command":
     - CVE-2026-93858_Fix_RCE_via_std.ssh_proxied_proxy_command.patch
   * CVE-2026-93860: vulnerability in Mistral's maintenance API method. By
     calling the maintenance API method, an unprivileged authenticated user may
     pause processing for creation of new objects for all tenant projects
     resulting in a temporary denial of service. All Mistral deployments are
     affected. Applied upstream patch: "Restrict the maintenance endpoint to
     admins":
     - CVE-2026-93860_Restrict_the_maintenance_endpoint_to_admins.patch

ncl (6.6.2.dfsg.1-16) unstable; urgency=medium
 .
   * Patch for hdf 4.4 transition. Closes: #1146671
   * Ensure linking against -lhdf not --ldf for HDF 4.4
   * Build-dep on libhdfeos-dev >= 3.0-4 for hdf4.4

ocsigenserver (7.0.0-2) unstable; urgency=medium
 .
   * Stop suggesting or recommending ocsigenserver-doc (Closes: #1149797)
   * Bump debhelper compat level to 14
   * Bump Standards-Version to 4.7.4

openimageio (3.1.18.0+dfsg-2) unstable; urgency=medium
 .
   * Team upload
   * Upload to unstable
openimageio (3.1.18.0+dfsg-1) experimental; urgency=medium
 .
   * Team upload.
 .
   [ Sébastien Noel ]
   * New upstream release, addressing the following security issues:
     - CVE-2024-55193: NULL pointer dereference (Closes: #1094411)
     - CVE-2024-55194: Heap overflow (Closes: #1094410)
     - CVE-2026-7582: Out-of-bounds write (Closes: #1135382)
     - CVE-2026-43903, CVE-2026-43904, CVE-2026-43905, CVE-2026-43906,
       CVE-2026-43907, CVE-2026-43908, CVE-2026-43909, CVE-2026-43996
       (Closes: #1139915)
     - CVE-2026-65969, CVE-2026-63638, CVE-2026-63635, CVE-2026-63422,
       CVE-2026-63420, CVE-2026-63419, CVE-2026-59956, CVE-2026-59181,
       CVE-2026-59156 (Closes: #1148554)
   * Update package name to match soname bump:
     - libopenimageio2.5 → libopenimageio3.1
   * Switch Build-Depends from Qt5 to Qt6
   * Add Build-Depends on libjxl-dev
   * Cleanup d/copyright
 .
   [ Antoine Lassagne ]
   * Enable python autopkgtests

php-league-html-to-markdown (5.1.3-1) unstable; urgency=medium
 .
   [ Colin O'Dell ]
   * Keep attributes of preserved HTML tags encoded (GHSA-vc6h-86x6-wcjg)
   * Keep the contents of <pre> and <code> inside of their code
     (GHSA-8m5h-gv5q-jmp5)
   * Keep link and image attributes inside of their Markdown syntax
     (GHSA-r2cp-59h5-vgjj)
   * Prepare to release 5.1.3
 .
   [ David Prévot ]
   * Drop test currently failing on Debian infrastructure
   * Fix lintian-overrides

php-phpstan-phpdoc-parser (2.3.6-1) unstable; urgency=medium
 .
   [ Ondrej Mirtes ]
   * Fix three ways a valid PHPDoc is read or written back wrong
   * Run the tests written for `@pure-unless-parameter-passed`
   * Read `Foo & .5` as an intersection, not as a reference
   * Write the PHPDoc language down as a grammar, and fuzz from it
 .
   [ Jan Tvrdík ]
   * Lexer: make the numeric-separator groups non-capturing
   * Lexer: extract the matches with PREG_PATTERN_ORDER
 .
   [ Fabien Potencier ]
   * Compute token offsets once instead of rescanning from the first token
 .
   [ David Prévot ]
   * Adapt packaging to removed abnfgen
   * Upgrade upstream signing key to new packet format.
   * Update standards version to 4.7.4, no changes needed.
   * Use debhelper-compat 14
   * Document lintian-overrides

postgresql-semver (0.42.0-1) unstable; urgency=medium
 .
   * New upstream version 0.42.0.

pyjdata (0.3.6-2) unstable; urgency=medium
 .
   * Team upload.
   * Backport upstream commit "permit numpy as _ArrayData_/_ArrayZipData_,
     speed up ndarray encoding/decoding" (Closes: #1114709)
   * Backport upstream commit "bump version to 0.3.6"
   * Clean up temporary test.json file after unit tests.
   * Update debian/watch to version 5 using the Github template.
   * Fix capitalization of Python in description and synopsis.
   * Drop redundant Priority field from Source stanza.
   * Drop unused ${shlibs:Depends} substvar.
   * Bump debhelper compat to 13.
   * Bump Standards-Version to 4.7.4.
pyjdata (0.3.6-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #964992)

pytactl (3.1-1) unstable; urgency=medium
 .
   * New upstream release
pytactl (3.0-1) unstable; urgency=medium
 .
   * New upstream release
   * d/rules: skip git tests
   * Use upstream 60-pytactl.rules
   * autopkgtest: relax isolation-machine requirement

python-adafruit-circuitpython-typing (1.12.3-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1150095)

python-discid (1.4.2-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1144979)

python-esprima (4.0.1-2) unstable; urgency=medium
 .
   * tests-adjustments.patch: skip fragile tests. (Closes: #1149554)
   * d/control: declare compliance to standards version 4.7.4.
   * d/control: bump to debhelper-compat 14.
     This introduces dh-sequence-single-binary mode.

python-glance-store (5.7.0-3) unstable; urgency=medium
 .
   * CVE-2026-51773: Fix VIM session cookie leak to untrusted hosts in the
     VMware datastore driver: _retry_request() now refuses to send any
     request, and the vmware_soap_session cookie, to a host other than the
     configured vmware_server_host, so a user-supplied vsphere:// image
     location cannot exfiltrate vCenter credentials when
     show_multiple_locations is enabled (Closes: #1149967):
     - CVE-2026-51773_refuse-vim-cookie-to-untrusted-hosts.patch

python-locationsharinglib (5.0.3-2) unstable; urgency=medium
 .
   * Fix FTBFS with the nocheck build profile. (Closes: #1150283)

python-mimesis (22.2.0-1) unstable; urgency=medium
 .
   * New upstream release

python-os-ken (4.2.2-4) unstable; urgency=medium
 .
   * Add a runtime dependency on the Font Awesome fonts to the -doc
     package, as needed by docs built with openstackdocstheme 3.2.0-4.

python-os-vif (5.2.1-2) unstable; urgency=medium
 .
   * Add a runtime dependency on the Font Awesome fonts to the -doc
     package, as needed by docs built with openstackdocstheme 3.2.0-4.

python-ovsdbapp (2.19.0-3) unstable; urgency=medium
 .
   * Add a runtime dependency on the Font Awesome fonts to the -doc
     package, as needed by docs built with openstackdocstheme 3.2.0-4.

python-pysnmp4 (7.1.22-4) unstable; urgency=medium
 .
   * Team Upload
   * Build-depends on python3-flit instead of the whole 'flit' toolbox
   * Implement nodoc build profile
   * Rewrite d/watch in v5 format
   * Enable a few build-time tests

python-sarif-python-om (1.0.4-4) unstable; urgency=medium
 .
   * Team Upload
   * Rewrite d/watch in v5 format
   * Use dh-sequence-python3
   * Bump Standards-Version to 4.7.4, drop Priority: tag
   * Drop "Rules-Requires-Root: no": it is the default now
   * Add debian/salsa-ci.yml
   * Add a patch: python3-pbr is not needed at runtime

qtcontacts-sqlite (0.3.25-2) unstable; urgency=medium
 .
   * Team upload
   * Release to unstable
 .
 qtcontacts-sqlite (0.3.25-1) experimental; urgency=medium
 .
   [ Jeremy Bícha ]
   * Team upload
   * New upstream release
   * Cherry-pick 4 cmake patches from Henrik Schnor
   * Update debian/changelog
 .
   [ Henrik Schnor ]
   * Add Qt6 packages
   * Use the new upstream CMake build system
   * Remove obsolete patches
   * Stop ignoring build test failures
qtcontacts-sqlite (0.3.25-1) experimental; urgency=medium
 .
   [ Jeremy Bícha ]
   * Team upload
   * New upstream release
   * Cherry-pick 4 cmake patches from Henrik Schnor
   * Update debian/changelog
 .
   [ Henrik Schnor ]
   * Add Qt6 packages
   * Use the new upstream CMake build system
   * Remove obsolete patches
   * Stop ignoring build test failures

qtpim-opensource-src (5.0~git20201102.f9a8f0fc+dfsg1-11) unstable; urgency=medium
 .
   * Team upload
   * Update symbols files to fix the build
   * Update Standards Version to 4.7.4
qtpim-opensource-src (5.0~git20201102.f9a8f0fc+dfsg1-10) unstable; urgency=medium
 .
   * Team upload
   * Cherry-pick QContactManager patch from qt6-pim 6.12.0~beta1
     to avoid deadlock

r-bioc-assorthead (1.6.4+dfsg-1) unstable; urgency=medium
 .
   * Team upload.
   * Packaging update (routine-update)
   * New upstream version
r-bioc-assorthead (1.6.3+dfsg3-1) unstable; urgency=medium
 .
   * Team upload.
   * Stop unvendoring the scran libraries.
r-bioc-assorthead (1.6.3+dfsg2-1) unstable; urgency=medium
 .
   * Team upload.
   * Stop unvendoring the byteme library.
   * debputy lint --auto-fix (routine-update)
r-bioc-assorthead (1.6.3+dfsg-2) unstable; urgency=medium
 .
   * Team upload.
   * Depend on unvendored libhnswlib-dev.
r-bioc-assorthead (1.6.3+dfsg-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version
   * Standards-Version: 4.7.4 (routine-update)
   * Refresh patch.
   * Restrict to R packages team core architectures (routine-update)
   * Drop 'Rules-Requires-Root: no' from d/control (routine-update)
r-bioc-assorthead (1.0.1+ds-3) unstable; urgency=medium
 .
   * Team upload.
   * Packaging update (routine-update)
   * Standards-Version: 4.7.3 (routine-update)
   * Reflow Uploaders field (cme)
   * Remove Priority field (cme)
   * Restrict to 64-bits architectures (routine-update)
   * Restrict to little-endian architectures (routine-update)
r-bioc-assorthead (1.0.1+ds-2) unstable; urgency=medium
 .
   * Upload to unstable.
r-bioc-assorthead (1.0.1+ds-1) experimental; urgency=medium
 .
   * Initial release (closes: #1088299)

r-cran-partykit (1.3-0-1) unstable; urgency=medium
 .
   * Team upload.
   * Packaging update (routine-update)
   * Use uscan v5 $template template. (routine-update)
   * New upstream version
   * Standards-Version: 4.7.4 (routine-update)
   * Refresh patch.
   * Restrict to R packages team core architectures (routine-update)
   * Drop 'Rules-Requires-Root: no' from d/control (routine-update)

ripe-atlas-sagan (2.0.1-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 2.0.1
   * Salsa CI: disable ALL,ANY,BLHC, enable nocheck, nodoc
   * Add build-dep on python3-sphinx-rtd-theme <!nodoc>
   * Mark python3-pytest as <!nocheck>
   * Nump Standards-Version to 4.7.4, drop Priority: tag
   * Drop dependency on python3-ipy
   * Switch to debhelper-compat 14

ripe-atlas-tools (3.4.0-0.3) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Drop dependency on python3-ipy

ruby-google-apis-androidpublisher-v3 (0.109.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-cloudbilling-v1 (0.41.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-cloudresourcemanager-v1 (0.46.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-compute-v1 (0.155.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-container-v1 (0.121.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-container-v1beta1 (0.108.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-dns-v1 (0.56.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-iam-v1 (0.92.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-pubsub-v1 (0.72.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-sqladmin-v1beta4 (0.106.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-google-apis-storage-v1 (0.68.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

rust-expr-lang (2.1.0-1) unstable; urgency=medium
 .
   * Package expr-lang 2.1.0 from crates.io using debcargo 2.8.4
     (Closes: #1149246)

rust-hdrhistogram (7.6.0-1) unstable; urgency=medium
 .
   * Team upload.
   * Package hdrhistogram 7.6.0 from crates.io using debcargo 2.8.3
     (Closes: #1149984)
rust-hdrhistogram (7.5.2-1) unstable; urgency=medium
 .
   * Team upload.
   * Package hdrhistogram 7.5.2 from crates.io using debcargo 2.6.0
   * Add patch for base64 0.21.
rust-hdrhistogram (7.5.0-1) unstable; urgency=medium
 .
   * Team upload.
   * Package hdrhistogram 7.5.0 from crates.io using debcargo 2.5.0 (Closes: 974197)
   * Eliminate dev-dependencies on ieee754 and rug so the rest of the testsuite
     can run.
   * Fix tests when run with no-default-features.
rust-hdrhistogram (6.3.4-2) unstable; urgency=medium
 .
   * Team upload.
   * Package hdrhistogram 6.3.4 from crates.io using debcargo 2.4.2
rust-hdrhistogram (6.3.4-1) unstable; urgency=medium
 .
   * Package hdrhistogram 6.3.4 from crates.io using debcargo 2.2.10

rust-into-attr (0.1.1-1) unstable; urgency=medium
 .
   * Package into-attr 0.1.1 from crates.io using debcargo 2.8.3

rust-usage-config (6.12.1-1) unstable; urgency=medium
 .
   * Package usage-config 6.12.1 from crates.io using debcargo 2.8.4
     (Closes: #1149256)

rust-usage-test (6.12.1-1) unstable; urgency=medium
 .
   * Package usage-test 6.12.1 from crates.io using debcargo 2.8.4
     (Closes: #1149251)

rust-yaml-serde (0.10.3-1) unstable; urgency=medium
 .
   * Package yaml_serde 0.10.3 from crates.io using debcargo 2.8.4
     (Closes: #1149253)

snapper-gui (0git.960a94834f-10) unstable; urgency=medium
 .
   * [adb47c9a] Port from GtkSourceView 3 to GtkSourceView 4 (Closes: 1079426)

sphinx-external-toc (1.0.1-3) unstable; urgency=medium
 .
   * Team Upload
   * Build-depends on python3-flit instead of the whole 'flit' toolbox

spip (4.4.28+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.28

tasmanian (8.2-4) unstable; urgency=medium
 .
   * Fix CMake autopkgtest on riscv64 and s390x.
     Add the file package as a dependency of the test, see #1150412 for the
     rationale.
tasmanian (8.2-3) unstable; urgency=medium
 .
   * Fix the CMake config-file package
     – d/patches/TasmanianConfig.patch: new patch, to deal with our packaging of
       Python and Octave interfaces
     – add tasgrid as a dependency of libtasmanian-dev, since the config-file
       package unconditionally requires the presence of tasgrid
     – add an autopkgtest that runs “find_package(Tasmanian)” through CMake
   * Also ship Fortran *.mod files in /usr/include.
     They were already shipped in compiler-specific paths (via dh-fortran), but
     having them also in /usr/include makes it easier to detect them via the
     CMake config-file package.
   * Ship Doxygen documentation in new libtasmanian-doc package
   * Bump to debhelper compat level 14
   * Bump to Standards-Version 4.7.4
   * testsuite-i386.patch: update using upstream fix

tcl9.1 (9.1.0+dfsg-2) unstable; urgency=medium
 .
   * Upload to unstable.
   * Delete dropped file patterns from debian/copyright.
   * Bump debhelper compatibility level to 14.
tcl9.1 (9.1.0+dfsg-1) experimental; urgency=medium
 .
   * New upstream release.
tcl9.1 (9.1~b1+dfsg-1) experimental; urgency=medium
 .
   * New upstream beta release.
   * Switch to tcl-lang.org from no longer available tcl.tk in the homepage.
   * Switch to https:// from http:// in all the URLs.
   * Drop the priority field from debian/copyright.
tcl9.1 (9.1~b0+dfsg-1) experimental; urgency=medium
 .
   * New upstream beta release.
   * Refresh patches.
   * Update symbols for libtcl9.1.
   * Make tcl9.1-doc multi-arch foreign.
   * Fix debian/watch to download original tarballs using uscan. Drop the
     get-orig-source target from debian/watch.
tcl9.1 (9.1~a1+dfsg-2) experimental; urgency=medium
 .
   * Fix mangling version in debian/watch.
   * Improve description of the patches.
   * Bump standards version.
tcl9.1 (9.1~a1+dfsg-1) experimental; urgency=medium
 .
   * Initial alpha release (closes: #1131562).

tk9.1 (9.1.0-2) unstable; urgency=medium
 .
   * Upload to unstable.
   * Remove dropped file patterns from debian/copyright.
   * Bump debhelper compatibility level to 14.
tk9.1 (9.1.0-1) experimental; urgency=medium
 .
   * New upstream release.
   * Refresh patches.
tk9.1 (9.1~b1-1) experimental; urgency=medium
 .
   * New upstream beta release.
   * Refresh patches, remove no longer necessary ones.
   * Switch to tcl-lang.org from tcl.tk in the homepage, which is not available
     anymore.
   * Switch to https:// from http:// in all the URLs.
   * Drop the priority field from debian/copyright.
tk9.1 (9.1~b0-2) experimental; urgency=medium
 .
   * Add two patches from upstream, which fix font sizes when run in XFCE
     and a segfault when multiline text is inserted into an entry widget.
tk9.1 (9.1~b0-1) experimental; urgency=medium
 .
   * New upstream beta release.
   * Refresh patches.
   * Update symbols for libtk9.1.
   * Add libharfbuzz-dev to build dependencies to enable bidirectional text
     support.
   * Make tk9.1-doc multi-arch foreign.
   * Fix debian/watch to download original tarballs using uscan. Drop the
     get-orig-source target from debian/rules.
tk9.1 (9.1~a1-2) experimental; urgency=medium
 .
   * Fix debian version mangling in debian/watch.
   * Improve description of the patches.
   * Bump standards version to 4.7.4.
tk9.1 (9.1~a1-1) experimental; urgency=medium
 .
   * Initial alpha release (closes: #1131564).

tpm2-tools (5.8-1) unstable; urgency=low
 .
   * New upstream version 5.8

trizbort-qt (1.0-1) unstable; urgency=medium
 .
   * Initial Debian release. (Closes: #1148911)

waagent (2.16.0.2-2) unstable; urgency=medium
 .
   * d/control: drop python3-mock from build-depends
waagent (2.16.0.2-1) unstable; urgency=medium
 .
   [ Alexandre Detiste ]
   * do not require mock on python_version > 3.7 (Closes: #1150219)
 .
   [ Noah Meyerhans ]
   * New upstream release 2.16.0.2 (Closes: #1143437)
   * tests: skip test_validate_signature_should_use_systemd_run

wpewebkit (2.54.1-1) unstable; urgency=medium
 .
   * New upstream release.
   * Drop fix-ftbfs-loong64.patch (already applied upstream) and
     fix-ftbfs-hurd.patch (not meant for wpewebkit in the first place).
   * Update copyright information of all files.