cpp-httplib (0.26.0+ds-2ubuntu3+esm1) resolute-security; urgency=medium

  * SECURITY UPDATE: HTTP header injection via percent-decoded values
    - debian/patches/CVE-2026-45372.patch: stop percent-decoding
      request header values in parse_header()
    - CVE-2026-45372

 -- Sudhakar Verma <sudhakar.verma@canonical.com>  Wed, 24 Jun 2026 15:54:58 +0530

cpp-httplib (0.26.0+ds-2ubuntu3) resolute; urgency=medium

  * Revert changes introducing 32 bit compile warnings.

 -- Mario Limonciello <superm1@debian.org>  Fri, 06 Mar 2026 20:34:10 -0600

cpp-httplib (0.26.0+ds-2ubuntu2) resolute; urgency=medium

  * Disable MaxTimeoutTest.ContentStream for more archs

 -- Mario Limonciello <superm1@debian.org>  Thu, 05 Mar 2026 23:13:03 -0600

cpp-httplib (0.26.0+ds-2ubuntu1) resolute; urgency=medium

  * Don't build armhf, upstream doesn't support it and it blocks
    autopkgtest.

 -- Mario Limonciello <superm1@gmail.com>  Thu, 05 Feb 2026 21:23:49 -0600

cpp-httplib (0.26.0+ds-2) experimental; urgency=low

  * Re-do upload, with binaries

 -- Andrea Pappacoda <tachi@debian.org>  Sat, 20 Sep 2025 18:37:50 +0200

cpp-httplib (0.26.0+ds-1) experimental; urgency=medium

  * Update to new upstream version 0.26.0+ds.
  * build(meson): use C++17 for gtest >= 1.17.0
  * d/control: libcpp-httplib0.25 -> libcpp-httplib0.26
  * d/rules: use new option names

 -- Andrea Pappacoda <tachi@debian.org>  Sat, 20 Sep 2025 15:31:16 +0200

cpp-httplib (0.25.0+ds-1) experimental; urgency=medium

  * Update to new upstream version 0.25.0+ds.

  * Fix numerous CVEs (Closes: #1109340):
    - CVE-2025-52887 (Unlimited number of HTTP headers causes memory leak).
      Version 0.22.0 adds a limit to the number of headers which can be passed
      in an HTTP request, mitigating a possible DoS due to memory exhaustion.

    - CVE-2025-53628 (HTTP Header Smuggling due to insecure trailers merge).
      Version 0.23.0 changes the way HTTP trailer fields are handled so to
      avoid an attacker to modify headers with prohibited trailers.

    - CVE-2025-53629 (Unbounded Memory Allocation in Chunked Requests).
      Version 0.23.0 complements the fix for CVE-2025-46728, actually solving
      memory exhaustion attacks via chucked HTTP requests.

  * d/control: libcpp-httplib0.20 -> libcpp-httplib0.25
  * d/changelog: mention CVE-2025-46728 in 0.20.1+ds-1 changelog entry.
  * d/rules: remove redundant file copy

 -- Andrea Pappacoda <tachi@debian.org>  Sat, 16 Aug 2025 20:27:58 +0200

cpp-httplib (0.20.1+ds-3) experimental; urgency=low

  * Third time's the charm

 -- Andrea Pappacoda <tachi@debian.org>  Fri, 13 Jun 2025 15:22:45 +0200

cpp-httplib (0.20.1+ds-2) experimental; urgency=low

  * Re-try git-debpush upload

 -- Andrea Pappacoda <tachi@debian.org>  Fri, 13 Jun 2025 15:14:20 +0200

cpp-httplib (0.20.1+ds-1) experimental; urgency=low

  * Update to new upstream version 0.20.1+ds.
  * fix CVE-2025-46728 (DoS via unbounded request line length).
    While this version intended to enforce request body size limits for
    chunked Transfer-Encoding, it actually adds size limits for a unique
    lines read from HTTP requests, solving another kind of DoS.
    See the GHSA-px83-72rx-v57c GitHub advisory for more details.
    Thanks to Yang Wang for the patch!
    Closes: #1104926
  * d/control: libcpp-httplib0.18 -> libcpp-httplib0.20

 -- Andrea Pappacoda <tachi@debian.org>  Thu, 05 Jun 2025 15:57:30 +0200

cpp-httplib (0.18.7-1) unstable; urgency=medium

  * Update to new upstream version 0.18.7.
  * Upload to unstable
  * d/control: use my @debian.org email address
  * d/rules: copy missing meson test files

 -- Andrea Pappacoda <tachi@debian.org>  Tue, 11 Mar 2025 18:18:06 +0100

cpp-httplib (0.18.0+ds-1) experimental; urgency=medium

  * Update to new upstream version 0.18.0+ds.
  * d/control: libcpp-httplib0.16 -> libcpp-httplib0.18
  * d/control: apply X-Style: black
  * d/control: add build dependency on libcurl-dev

 -- Andrea Pappacoda <andrea@pappacoda.it>  Tue, 17 Sep 2024 17:33:26 +0200

cpp-httplib (0.16.3+ds-2) unstable; urgency=medium

  * d/patches: bump minimum Meson version to 0.62.0
  * d/patches: fix SSLClientServerTest.* tests with OpenSSL 3.2.0

 -- Andrea Pappacoda <andrea@pappacoda.it>  Tue, 17 Sep 2024 16:33:49 +0200

cpp-httplib (0.16.3+ds-1) unstable; urgency=medium

  * Update to new upstream version 0.16.3+ds.
  * Upload to unstable
  * d/control: declare dpkg-build-api = 1.
    This switches the default for Rules-Requires-Root to "no", hence setting
    it explicitly is no longer needed.

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sun, 18 Aug 2024 19:27:08 +0200

cpp-httplib (0.16.0+ds-1) experimental; urgency=medium

  * Update to new upstream version 0.16.0+ds.
  * d/copyright: update CMake files info

 -- Andrea Pappacoda <andrea@pappacoda.it>  Tue, 09 Jul 2024 21:45:50 +0200

cpp-httplib (0.15.3+ds-3) unstable; urgency=medium

  * Switch to dgit-maint-debrebase(7) workflow
  * d/gbp.conf: disable import-orig.merge.
    Needed to switch to git-debrebase.
  * d/README.source: document packaging workflow

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sun, 07 Jul 2024 18:27:10 +0200

cpp-httplib (0.15.3+ds-2) unstable; urgency=medium

  * Upload to unstable
  * d/patches: fix tests on 32 bit architectures

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sun, 23 Jun 2024 19:26:48 +0200

cpp-httplib (0.15.3+ds-1) experimental; urgency=medium

  * New upstream version 0.15.3+ds
  * d/control: libcpp-httplib0.14t64 -> libcpp-httplib0.15
  * d/control: build-depend on libssl-dev >= 3.0.0
  * d/patches: use static certs for tests (Closes: #1069357, #1073440)
  * d/s/lintian-overrides: override pkg-config => pkgconf

 -- Andrea Pappacoda <andrea@pappacoda.it>  Fri, 21 Jun 2024 23:18:06 +0200

cpp-httplib (0.14.3+ds-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1061906

 -- Steve Langasek <vorlon@debian.org>  Wed, 28 Feb 2024 17:39:39 +0000

cpp-httplib (0.14.3+ds-1) unstable; urgency=medium

  * New upstream version 0.14.3+ds

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sun, 24 Dec 2023 17:57:33 +0100

cpp-httplib (0.14.2+ds-1) unstable; urgency=medium

  * New upstream version 0.14.2+ds
  * d/patches: drop upstreamed patches

 -- Andrea Pappacoda <andrea@pappacoda.it>  Mon, 11 Dec 2023 10:38:29 +0100

cpp-httplib (0.14.1+ds-2) unstable; urgency=medium

  * d/patches: update version number to 0.14.1.
    Thanks to David James for the report! (Closes: #1056604)

 -- Andrea Pappacoda <andrea@pappacoda.it>  Thu, 30 Nov 2023 09:34:38 +0100

cpp-httplib (0.14.1+ds-1) unstable; urgency=medium

  * New upstream version 0.14.1+ds
  * Upload to unstable

 -- Andrea Pappacoda <andrea@pappacoda.it>  Fri, 20 Oct 2023 20:19:31 +0200

cpp-httplib (0.14.0+ds-1) experimental; urgency=medium

  * New upstream version 0.14.0+ds
  * d/control: libcpp-httplib0.13 -> libcpp-httplib0.14
  * d/patches: drop upstreamed patches

 -- Andrea Pappacoda <andrea@pappacoda.it>  Mon, 11 Sep 2023 23:40:58 +0200

cpp-httplib (0.13.1+ds-1) unstable; urgency=medium

  * New upstream version 0.13.1+ds
  * d/control: libcpp-httplib0.11 -> libcpp-httplib0.13
  * d/patches: drop upstreamed patches

 -- Andrea Pappacoda <andrea@pappacoda.it>  Thu, 13 Jul 2023 18:23:21 +0200

cpp-httplib (0.11.4+ds-3) unstable; urgency=medium

  * d/patches: use C++14 with libgtest-dev >= 1.13.0.
    Fixes a FTBFS with the new GoogleTest in unstable.

 -- Andrea Pappacoda <andrea@pappacoda.it>  Thu, 13 Jul 2023 12:47:48 +0200

cpp-httplib (0.11.4+ds-2) unstable; urgency=medium

  * d/patches: fix fox CVE-2023-26130.
    Backport of the security fix for CVE-2023-26130, a CRLF Injection, from
    upstream commit 5b397d455d25a391ba346863830c1949627b4d08 included in
    upstream release 0.12.4 and newer. (Closes: #1037100)

 -- Andrea Pappacoda <andrea@pappacoda.it>  Thu, 13 Jul 2023 10:16:54 +0200

cpp-httplib (0.11.4+ds-1) unstable; urgency=medium

  * New upstream version 0.11.4+ds

 -- Andrea Pappacoda <andrea@pappacoda.it>  Thu, 12 Jan 2023 16:39:07 +0100

cpp-httplib (0.11.3+ds-1) unstable; urgency=medium

  * New upstream version 0.11.3+ds
  * d/rules: use Meson's LTO

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sat, 03 Dec 2022 14:45:23 +0100

cpp-httplib (0.11.2+ds-1) unstable; urgency=medium

  * New upstream version 0.11.2+ds
  * Upload to unstable
  * d/patches: drop upstreamed patches

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sat, 17 Sep 2022 22:26:28 +0200

cpp-httplib (0.11.1+ds-1) experimental; urgency=medium

  * New upstream version 0.11.1+ds
  * d/patches: set soname to libcpp-httplib.so.0.11
  * d/control: libcpp-httplib0 -> libcpp-httplib0.11

 -- Andrea Pappacoda <andrea@pappacoda.it>  Tue, 30 Aug 2022 00:14:09 +0200

cpp-httplib (0.10.8+ds-1) unstable; urgency=medium

  * New upstream version 0.10.8+ds
  * d/control: explicitly depend on python3
  * d/rules: skip flaky tests on specific archs

 -- Andrea Pappacoda <andrea@pappacoda.it>  Wed, 08 Jun 2022 22:39:14 +0200

cpp-httplib (0.10.6+ds-1) unstable; urgency=medium

  * New upstream version 0.10.6+ds
  * d/patches: drop test-unjoined-thread, add meson-version-fix
  * d/patches: fix test failures

 -- Andrea Pappacoda <andrea@pappacoda.it>  Tue, 19 Apr 2022 12:47:03 +0200

cpp-httplib (0.10.3+ds-1) unstable; urgency=medium

  * New upstream version 0.10.3+ds
  * d/control: drop python3-distutils from Build-Depends
  * d/patches: drop upstreamed patches

 -- Andrea Pappacoda <andrea@pappacoda.it>  Thu, 24 Feb 2022 00:33:17 +0100

cpp-httplib (0.10.2+ds-1) unstable; urgency=medium

  * New upstream version 0.10.2
  * d/control: drop python3 from Build-Depends-Arch
  * d/patches: fix race condition in tests
  * d/patches: add missing _Online suffix in tests
  * d/rules: don't build tests if nocheck is set
  * d/tests: add autopkgtest
  * d/watch: use GitHub's API

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sat, 29 Jan 2022 23:54:10 +0100

cpp-httplib (0.10.1+ds-1) unstable; urgency=medium

  * New upstream version 0.10.1

 -- Andrea Pappacoda <andrea@pappacoda.it>  Thu, 30 Dec 2021 10:54:41 +0100

cpp-httplib (0.9.10+ds-1) unstable; urgency=medium

  * New upstream version 0.9.10
  * d/patches: drop upstreamed patches

 -- Andrea Pappacoda <andrea@pappacoda.it>  Tue, 14 Dec 2021 22:49:30 +0100

cpp-httplib (0.9.9+ds-1) unstable; urgency=medium

  * Mark test deps with <!nochech>
  * Switch to git-buildpackage based packaging
  * New upstream version 0.9.9
  * Update patches
  * d/patches: skip online tests
  * d/rules: add qa=+all option

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sat, 27 Nov 2021 15:21:58 +0100

cpp-httplib (0.9.7+ds-1) unstable; urgency=low

  * Initial release. Closes: #994547

 -- Andrea Pappacoda <andrea@pappacoda.it>  Sun, 31 Oct 2021 20:31:25 +0100
