Change log for libsoup3 package in Ubuntu

libsoup3 (3.6.1-1) unstable; urgency=medium

  * New upstream release
  * Remove 6 patches applies in new release

 -- Jeremy Bícha <email address hidden>  Mon, 25 Nov 2024 09:06:51 -0500

Available diffs

• diff from 3.6.0-4 to 3.6.1-1 (8.7 KiB)

libsoup3 (3.6.0-2ubuntu0.1) oracular-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2024-52531-1.patch: Be more robust against
      invalid input when parsing params
    - debian/patches/CVE-2024-52531-2.patch: Add test for passing
      invalid UTF-8 to soup_header_parse_semi_param_list()
    - CVE-2024-52531
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2024-52532-1.patch: process the frame as soon
      as data is read
    - debian/patches/CVE-2024-52532-2.patch: disconnect error copy
      after the test ends
    - CVE-2024-52532

 -- Bruce Cable <email address hidden>  Mon, 18 Nov 2024 15:21:41 +1100

Available diffs

• diff from 3.6.0-2 (in Debian) to 3.6.0-2ubuntu0.1 (3.8 KiB)

libsoup3 (3.4.4-5ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: Request smuggling
    - debian/patches/CVE-2024-52530.patch: Strictly don't allow NUL
      bytes in headers
    - CVE-2024-52530
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2024-52531-1.patch: Be more robust against
      invalid input when parsing params
    - debian/patches/CVE-2024-52531-2.patch: Add test for passing
      invalid UTF-8 to soup_header_parse_semi_param_list()
    - CVE-2024-52531
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2024-52532-1.patch: process the frame as soon
      as data is read
    - debian/patches/CVE-2024-52532-2.patch: disconnect error copy
      after the test ends
    - CVE-2024-52532

 -- Bruce Cable <email address hidden>  Mon, 18 Nov 2024 15:21:40 +1100

Available diffs

• diff from 3.4.4-5 (in Debian) to 3.4.4-5ubuntu0.1 (5.1 KiB)
• diff from 3.4.4-5build2 (in Ubuntu) to 3.4.4-5ubuntu0.1 (4.7 KiB)

libsoup3 (3.6.0-4) unstable; urgency=medium

  * d/patches: Add bug fixes from upstream
    - d/p/server-Add-note-about-recommended-usage.patch:
      Document the level of security support for the server side.
      Upstream has clarified the documentation to state that SoupServer
      is not intended to be exposed to untrusted clients.
      (Related to CVE-2024-52531, CVE-2024-52532)
    - d/p/headers-Be-more-robust-against-invalid-input-when-parsing.patch:
      Fix a buffer overrun if asked to parse non-UTF-8 headers. It is
      believed that this cannot happen on the client side, but it can
      happen in SoupServer. (CVE-2024-52531, Closes: #1087417)
    - d/p/tests-Add-test-for-passing-invalid-UTF-8-to-soup_header_p.patch:
      Add a test-case for the above
    - d/p/websocket-process-the-frame-as-soon-as-we-read-data.patch:
      Avoid an infinite loop in WebSocket processing
      (CVE-2024-52532, Closes: #1087416)
    - d/p/websocket-test-disconnect-error-copy-after-the-test-ends.patch:
      Fix a test failure after resolving CVE-2024-52532
  * d/p/websocket-test-Disconnect-error-signal-in-another-place.patch:
    Add proposed patch to fix another intermittent test failure after
    resolving CVE-2024-52532
  * d/control: libsoup-3.0-tests Depends on ca-certificates.
    Related to #1054962, #1064744
  * d/libsoup-3.0-doc.links: Register reference manual with devhelp
  * d/libsoup-3.0-doc.links: Create symlinks in
    /usr/share/doc/libsoup-3.0-{dev,doc} to make the HTML documentation
    more discoverable

 -- Simon McVittie <email address hidden>  Wed, 13 Nov 2024 14:50:50 +0000

Available diffs

• diff from 3.6.0-3 to 3.6.0-4 (4.8 KiB)

libsoup3 (3.6.0-3) unstable; urgency=medium

  * Add Build-Depends: ca-certificates for build tests
    (Closes: #1064744, #1054962)
  * Update Homepage

 -- Jeremy Bícha <email address hidden>  Thu, 31 Oct 2024 11:05:08 +0100

Available diffs

• diff from 3.6.0-2 to 3.6.0-3 (711 bytes)

libsoup3 (3.6.0-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * Remove unused python3 & python3-quart dependencies (Closes: #1080044)

 -- Jeremy Bícha <email address hidden>  Sat, 31 Aug 2024 08:30:58 -0400

Available diffs

• diff from 3.6.0-1 to 3.6.0-2 (564 bytes)

libsoup3 (3.6.0-1) unstable; urgency=medium

  * New upstream release
  * Remove 3 patches applied in new release

 -- Jeremy Bícha <email address hidden>  Mon, 26 Aug 2024 06:57:51 -0400

Available diffs

• diff from 3.5.2-1 to 3.6.0-1 (7.6 KiB)

libsoup3 (3.5.2-1) unstable; urgency=medium

  * New upstream release
  * debian/libsoup-3.0-0.symbols: Add new symbols
  * Bump minimum glib
  * Fix nocheck build
  * Cherry-pick some additional fixes
  * Bump Standards Version to 4.7.0

 -- Jeremy Bícha <email address hidden>  Fri, 09 Aug 2024 18:27:30 -0400

Available diffs

• diff from 3.4.4-5build2 (in Ubuntu) to 3.5.2-1 (26.8 KiB)

libsoup3 (3.4.4-5build2) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <email address hidden>  Sun, 31 Mar 2024 02:17:22 +0000

Available diffs

• diff from 3.4.4-5build1 to 3.4.4-5build2 (309 bytes)

libsoup3 (3.4.4-5build1) noble; urgency=medium

  * No-change rebuild against libglib2.0-0t64

 -- Steve Langasek <email address hidden>  Fri, 08 Mar 2024 05:29:46 +0000

Available diffs

• diff from 3.4.4-5ubuntu1~ppa6 (in ~canonical-foundations/ubuntu/archive-bootstrap) to 3.4.4-5build1 (2.0 KiB)
• diff from 3.4.4-5 (in Debian) to 3.4.4-5build1 (601 bytes)

libsoup3 (3.4.4-5) unstable; urgency=medium

  * Don't require libapache2-mod-php on i386 either

 -- Jeremy Bícha <email address hidden>  Sun, 28 Jan 2024 20:05:48 -0500

Available diffs

• diff from 3.4.4-4 to 3.4.4-5 (440 bytes)

libsoup3 (3.4.4-4) unstable; urgency=medium

  * Don't require php on i386: only used by tests

 -- Jeremy Bícha <email address hidden>  Sun, 28 Jan 2024 08:50:22 -0500

Available diffs

• diff from 3.4.4-2 to 3.4.4-4 (1.2 KiB)
• diff from 3.4.4-3 to 3.4.4-4 (623 bytes)

libsoup3 (3.4.4-3) unstable; urgency=medium

  [ Simon McVittie ]
  * d/rules: Explicitly disable pkcs11_tests if built with nocheck,noinsttest.
    These require GNUTLS, which is omitted from the build dependencies
    if built with both of those profiles. Because we're using
    -Dauto_features=enabled, we need to override that for each feature that
    is not wanted.
    Note that both of those profiles need to be activated during
    bootstrapping: even if we are not going to run the test suite during
    the build, we need to compile it for the libsoup3.0-tests binary package,
    unless the noinsttest build profile was specified. (Closes: #1061133)

 -- Jeremy Bícha <email address hidden>  Fri, 19 Jan 2024 09:06:45 -0500

Available diffs

• diff from 3.4.4-2 to 3.4.4-3 (913 bytes)

libsoup3 (3.4.4-2) unstable; urgency=medium

  * Team upload
  * d/control: Stop generating from d/control.in
  * d/control: Explicitly build-depend on required GIR XML.
    Helps: #1030223
  * d/control: Add ${gir:Depends}, ${gir:Provides} to -dev package.
    Helps: #1030223
  * Remove version constraints unnecessary since Debian 11

 -- Simon McVittie <email address hidden>  Fri, 17 Nov 2023 13:28:30 +0000

Available diffs

• diff from 3.4.4-1 to 3.4.4-2 (2.6 KiB)

libsoup3 (3.4.4-1) unstable; urgency=medium

  * New upstream release
    - Fix regression seen in Ubuntu's s390s autopkgtest (LP: #2036444)

 -- Jeremy Bícha <email address hidden>  Thu, 26 Oct 2023 20:24:22 -0400

Available diffs

• diff from 3.4.2-4 to 3.4.4-1 (12.4 KiB)
• diff from 3.4.3-1 to 3.4.4-1 (7.1 KiB)

libsoup3 (3.4.3-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bícha <email address hidden>  Fri, 15 Sep 2023 14:09:13 -0400

Available diffs

• diff from 3.4.2-4 to 3.4.3-1 (10.7 KiB)

libsoup3 (3.4.2-4) unstable; urgency=medium

  * Revert "d/rules, d/meson/no-exe-wrapper.ini: Work around FTBFS on mips64el":
    The underlying issue was fixed in meson 1.2.1
  * Have -dev package depend on libsysprof-capture-4-dev instead of
    libsysprof-4-dev

 -- Jeremy Bícha <email address hidden>  Thu, 10 Aug 2023 09:55:02 -0400

Available diffs

• diff from 3.4.2-3 to 3.4.2-4 (1.2 KiB)

libsoup3 (3.4.2-3) unstable; urgency=medium

  * d/rules, d/meson/no-exe-wrapper.ini: Work around FTBFS on mips64el
    Mitigates: #1041499

 -- Jeremy Bícha <email address hidden>  Fri, 04 Aug 2023 11:37:09 -0400

Available diffs

• diff from 3.4.2-2 to 3.4.2-3 (750 bytes)

libsoup3 (3.4.2-2) unstable; urgency=medium

  * Release to unstable

 -- Jeremy Bícha <email address hidden>  Sun, 23 Jul 2023 15:55:23 -0400

Available diffs

• diff from 3.4.2-1 to 3.4.2-2 (296 bytes)

libsoup3 (3.4.2-1) experimental; urgency=medium

  * New upstream release
  * Update lintian override info format
  * Update standards version to 4.6.2, no changes needed

 -- Jeremy Bícha <email address hidden>  Sun, 07 May 2023 10:46:02 -0400

Available diffs

• diff from 3.4.1-1 to 3.4.2-1 (2.1 KiB)

libsoup3 (3.4.1-1) experimental; urgency=medium

  * New upstream release
  * Drop patch applied in new release

 -- Jeremy Bicha <email address hidden>  Fri, 21 Apr 2023 10:56:33 +0200

Available diffs

• diff from 3.4.0-1 to 3.4.1-1 (6.3 KiB)

libsoup3 (3.4.0-1) experimental; urgency=medium

  * New upstream release
  * Cherry-pick fix for build on various architectures

 -- Jeremy Bicha <email address hidden>  Sun, 19 Mar 2023 18:12:58 -0400

Available diffs

• diff from 3.2.2-1 to 3.4.0-1 (27.6 KiB)

libsoup3 (3.2.2-1) unstable; urgency=medium

  * New upstream release
  * Drop cherry-picked 32-bit patches: applied in new release

 -- Jeremy Bicha <email address hidden>  Wed, 30 Nov 2022 15:11:19 -0500

Available diffs

• diff from 3.2.1-2 to 3.2.2-1 (7.4 KiB)

libsoup3 (3.2.1-2) unstable; urgency=medium

  * Cherry-pick patches to fix 32-bit build

 -- Jeremy Bicha <email address hidden>  Fri, 21 Oct 2022 14:09:33 -0400

Available diffs

• diff from 3.2.0-1 to 3.2.1-2 (12.9 KiB)

libsoup3 (3.2.0-1) unstable; urgency=medium

  * New upstream release

 -- Jeremy Bicha <email address hidden>  Wed, 14 Sep 2022 16:04:35 -0400

Available diffs

• diff from 3.1.4-1 to 3.2.0-1 (703 bytes)

libsoup3 (3.1.4-1) unstable; urgency=medium

  [ Jeremy Bicha ]
  * New upstream release

  [ Eric Long ]
  * Add patch to fix build test timeout on riscv64 (Closes: #1018709)

 -- Jeremy Bicha <email address hidden>  Fri, 02 Sep 2022 16:23:08 -0400

Available diffs

• diff from 3.1.3-2 to 3.1.4-1 (7.6 KiB)

libsoup3 (3.1.3-2) unstable; urgency=medium

  [ Samuel Thibault ]
  * Fix unsatisfiable dependency on non-Linux (Closes: #1017758)

 -- Jeremy Bicha <email address hidden>  Sun, 21 Aug 2022 16:23:16 -0400

Available diffs

• diff from 3.1.3-1 to 3.1.3-2 (497 bytes)

libsoup3 (3.1.3-1) unstable; urgency=medium

  * Team upload
  * New upstream release

 -- Jesús Soto <email address hidden>  Tue, 16 Aug 2022 14:23:55 -0500

Available diffs

• diff from 3.1.1-1 to 3.1.3-1 (56.7 KiB)

libsoup3 (3.1.1-1) unstable; urgency=medium

  * New upstream release
  * Refresh patch
  * Build-Depend on gi-docgen instead of gtk-doc-tools
  * debian/libsoup-3.0-0.symbols: Add new symbols

 -- Jeremy Bicha <email address hidden>  Wed, 03 Aug 2022 08:20:06 -0400

Available diffs

• diff from 3.0.7-1 to 3.1.1-1 (149.2 KiB)

libsoup3 (3.0.7-1) unstable; urgency=medium

  * New upstream release (LP: #1980400)
  * debian/libsoup-3.0-0.symbols: Drop 2 unused symbols no longer exported

 -- Jeremy Bicha <email address hidden>  Thu, 30 Jun 2022 15:10:11 -0400

Available diffs

• diff from 3.0.6-1 to 3.0.7-1 (13.1 KiB)

libsoup3 (3.0.7-0ubuntu1) jammy; urgency=medium

  * New upstream release (LP: #1980400)
  * debian/libsoup-3.0-0.symbols: Drop 2 unused symbols no longer exported

 -- Jeremy Bicha <email address hidden>  Thu, 30 Jun 2022 15:10:11 -0400

Available diffs

• diff from 3.0.5-1 (in Debian) to 3.0.7-0ubuntu1 (18.3 KiB)

libsoup3 (3.0.6-1) unstable; urgency=medium

  * New upstream release
  * debian/control.in: Bump minimum meson to 0.54

 -- Jeremy Bicha <email address hidden>  Thu, 31 Mar 2022 16:47:01 -0400

Available diffs

• diff from 3.0.5-1 to 3.0.6-1 (5.9 KiB)

libsoup3 (3.0.5-1) unstable; urgency=medium

  * New upstream release
  * Drop test patches applied in new release

 -- Jeremy Bicha <email address hidden>  Fri, 18 Mar 2022 14:47:42 -0400

Available diffs

• diff from 3.0.4-3 to 3.0.5-1 (10.8 KiB)
• diff from 3.0.4-4 to 3.0.5-1 (9.2 KiB)

libsoup3 (3.0.4-4) unstable; urgency=medium

  * Team upload
  * d/rules: Increase test timeouts.
    http2-body-stream-test timed out on mipsel and riscv64 machines.
    Ideally we should extend the timeout for particularly slow tests
    upstream, but for now, just apply a multiplier so we can see how long
    they take in practice.
  * d/patches: Add more debug-logging for starting/stopping Apache.
    This will hopefully help to debug intermittent test failures in which
    Apache fails to bind to a port that is already in use.

 -- Simon McVittie <email address hidden>  Wed, 16 Mar 2022 12:21:59 +0000

Available diffs

• diff from 3.0.4-3 to 3.0.4-4 (2.1 KiB)

libsoup3 (3.0.4-3) unstable; urgency=medium

  * Team upload

  [ Jeremy Bicha ]
  * debian/control.in: Have libsoup-3.0-dev depend on libsysprof-4-dev
    per its pkgconfig file

  [ Simon McVittie ]
  * d/p/tests-Install-http2-server.py.patch,
    d/p/tests-Install-missing-test-cert-and-key-for-installed-tes.patch:
    Add patches to install http2-server.py and some test TLS certificates,
    fixing an autopkgtest
  * d/patches: Remove workarounds for libsoup#175.
    A better workaround for glib#2563 was merged upstream before 3.0.4.
  * d/control.in: installed-tests depend on python3 and python3-quart
  * d/control.in: Fix Vcs-Git, Vcs-Browser for this source package name
  * Upload to unstable.
    Please coordinate with the GNOME team before transitioning other
    packages to use this version of libsoup: it is important that we avoid
    trying to load libsoup 2 and libsoup 3 into the same process space.

 -- Simon McVittie <email address hidden>  Tue, 15 Mar 2022 13:09:07 +0000

Available diffs

• diff from 3.0.4-2 to 3.0.4-3 (3.5 KiB)

libsoup3 (3.0.4-2) experimental; urgency=medium

  * debian/* Fix several libsoup-3.0 missing hyphens. Thanks Alberto Garcia.

 -- Jeremy Bicha <email address hidden>  Thu, 24 Feb 2022 11:25:39 -0500