smarty4 (4.3.0-1+deb12u2) bookworm-security; urgency=medium

  * CVE-2024-35226 (Closes: #1072529)

 -- Moritz Mühlenhoff <jmm@debian.org>  Tue, 10 Dec 2024 20:04:55 +0100

smarty4 (4.3.0-1+deb12u1) bookworm; urgency=medium

  * debian/patches:
    + Add CVE-2023-28447.patch. Prohibit execution of arbitrary JavaScript code
      in the context of the user's browser session. (Closes: #1033965,
      CVE-2023-28447).

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 06 Jul 2023 06:04:52 +0200

smarty4 (4.3.0-1) unstable; urgency=medium

  * New upstream release.
  * debian/patches:
    + Drop PHP-8.2 upstream patches. Applied in this version.
  * debian/control:
    + Bump Standards-Version: to 4.6.2. No changes needed.
  * debian/copyright:
    + Update auto-generated copyright.in file.
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Sat, 14 Jan 2023 23:22:18 +0100

smarty4 (4.2.1-3) unstable; urgency=medium

  * debian/patches:
    + Add various patches for PHP 8.2 compatibility.
      See: https://github.com/smarty-php/smarty/pull/775/
    + Drop patch snippets for unit tests / non-existent files.

 -- Mike Gabriel <sunweaver@debian.org>  Tue, 22 Nov 2022 15:46:54 +0100

smarty4 (4.2.1-2) unstable; urgency=medium

  * debian/control:
    + Bump versioned B-D on smarty-lexer to (>= 3.1.32+dfsg1-5~).
  * debian/rules:
    + Re-enable configfile/template parser/lexer generation. (Closes: #1022736).

 -- Mike Gabriel <sunweaver@debian.org>  Tue, 25 Oct 2022 07:56:12 +0200

smarty4 (4.2.1-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2018-25047: Prohibit XSS in libs/plugins/function.mailto.php.
      (Closes: #1019896).
  * debian/rules:
    + Disable configparser and templateparser creation temporarily. Use
      the files generated/provided by upstream for now. (see smarty3 bug
      #1021571).

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 24 Oct 2022 20:59:37 +0200

smarty4 (4.1.1-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2021-21408: Prevent template authors from running restricted static
      php methods. (Closes: #1010375).
    - CVE-2021-29454: Prevent template authors from running arbitrary PHP code
      by crafting a malicious math string. (Closes: #1010375, as well).
    - CVE-2022-29221: Prevent template authors from injecting PHP code by
      choosing malicious filenames. (Closes: #1011757).
  * debian/control:
    + Bump Standards-Version: to 4.6.1. No changes needed.
  * debian/smarty4.docs:
    + Drop demo/ from documentation files. Folder removed upstream.
  * debian/copyright:
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Sun, 29 May 2022 07:58:20 +0200

smarty4 (4.1.0-1) unstable; urgency=medium

  * Upload to unstable.

  * New upstream release.
  * debian/copyright:
    + Update auto-generated copyright.in file.
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Sun, 13 Mar 2022 20:47:12 +0100

smarty4 (4.0.0-1) experimental; urgency=medium

  * Upload to experimental.

  * New upstream release.
  * Rename src:pkg and bin:pkg to smarty4.
  * debian/control:
    + Bump Standards-Version: to 4.6.0. No changes needed.
  * debian/copyright:
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 09 Dec 2021 22:26:34 +0100

smarty3 (3.1.39-2) unstable; urgency=medium

  * debian/watch:
    + Fix Github watch URL.

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 29 Apr 2021 14:40:03 +0200

smarty3 (3.1.39-1) unstable; urgency=medium

  * New upstream release.
  * debian/copyright:
    + Update copyright attributions.

 -- Mike Gabriel <sunweaver@debian.org>  Tue, 23 Feb 2021 11:41:59 +0100

smarty3 (3.1.38-1) unstable; urgency=medium

  * New upstream release.
  * debian/patches:
    + Drop 0001_bring-lexer-source-functionally-up-to-date.patch. Applied
      upstream.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 18 Jan 2021 17:20:40 +0100

smarty3 (3.1.36-2) unstable; urgency=medium

  * debian/control:
    + Update versioned B-D on smarty-lexer to (>= 3.1.32+dfsg1-3~).
  * debian/patches:
    + Add 0001_bring-lexer-source-functionally-up-to-date.patch. Bring
      lexer source functionally up-to-date with (manually edited) compiled
      version. (Closes: #977604).
  * debian/watch:
    + Switch to format version 4.

 -- Mike Gabriel <sunweaver@debian.org>  Fri, 18 Dec 2020 14:53:44 +0000

smarty3 (3.1.36-1) unstable; urgency=medium

  * New upstream release.
  * debian/rules:
    + Stop creating Git snapshots, use upstream orig tarballs (generated from
      Github tags) instead.
    + Upstream changelog has been renamed to CHANGELOG.md.
  * debian/copyright:
    + Update copyright attributions.
    + Drop global Comment: field. No tarball repacking anymore.
  * debian/control:
    + Bump Standards-Version: to 4.5.1. No changes needed.
    + Bump DH compat level to version 13.
  * debian/upstream/metadata:
    + Add file. Comply with DEP-12.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 07 Dec 2020 09:33:25 +0100

smarty3 (3.1.34+20190228.1.c9f0de05+selfpack1-1) unstable; urgency=medium

  * New upstream release.
  * debian/control:
    + Bump Standards-Version: to 4.4.1. No changes needed.
    + Add Rules-Requires-Root: field and set it to "no".
  * debian/{control,compat}:
    + Switch to debhelper-compat notation. Bump DH comat level to version 12.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 18 Nov 2019 10:49:54 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog smarty4`.
