undertow (1.4.25-2) unstable; urgency=medium

  * Team upload.
  * Depend on libgeronimo-annotation-1.3-spec-java and libservlet3.1-java
    instead of libtomcat8-java
  * Standards-Version updated to 4.2.1
  * Use salsa.debian.org Vcs-* URLs

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 03 Dec 2018 22:37:39 +0100

undertow (1.4.25-1) unstable; urgency=medium

  * New upstream version 1.4.25
    - Fix CVE-2018-1114: File descriptor leak caused by
      JarURLConnection.getLastModified() allows attacker to cause a denial of
      service. (Closes: #897247)
    - Fix CVE-2017-12196: When using Digest authentication the server does not
      ensure that the value of URI in the Authorization header matches the URI
      in HTTP request line. This allows the attacker to cause a MITM attack and
      access the desired content on the server.
  * Declare compliance with Debian Policy 4.1.4.

 -- Markus Koschany <apo@debian.org>  Sun, 06 May 2018 21:29:28 +0200

undertow (1.4.23-3) unstable; urgency=medium

  * Rebuild against libjboss-classfilewriter-java >= 1.2.2-2.
    Fix unsatisfiable dependency.

 -- Markus Koschany <apo@debian.org>  Mon, 26 Mar 2018 20:15:01 +0200

undertow (1.4.23-2) unstable; urgency=medium

  * Add java9.patch and fix FTBFS with Java 9. (Closes: #893532)
  * Use source/target 1.9.

 -- Markus Koschany <apo@debian.org>  Sun, 25 Mar 2018 17:06:48 +0200

undertow (1.4.23-1) unstable; urgency=high

  * New upstream version 1.4.23.
    - Fix CVE-2017-7559: HTTP Request smuggling vulnerability.
      (Closes: #885576)

 -- Markus Koschany <apo@debian.org>  Fri, 02 Mar 2018 20:29:02 +0100

undertow (1.4.22-1) unstable; urgency=medium

  * New upstream version 1.4.22.
  * Use compat level 11.
  * Declare compliance with Debian Policy 4.1.3.
  * Drop websockets-jsr.patch. Not needed anymore.

 -- Markus Koschany <apo@debian.org>  Wed, 17 Jan 2018 21:11:59 +0100

undertow (1.4.21-2) unstable; urgency=medium

  * Add websockets-jsr.patch and implement a yet unsupported new method
    introduced by the recent update of libtomcat8-java to version 8.5.24.
    Thanks to Adrian Bunk for the report. (Closes: #883357)
  * Declare compliance with Debian Policy 4.1.2.

 -- Markus Koschany <apo@debian.org>  Sun, 03 Dec 2017 20:49:51 +0100

undertow (1.4.21-1) unstable; urgency=medium

  * New upstream version 1.4.21.
  * Declare compliance with Debian Policy 4.1.1.

 -- Markus Koschany <apo@debian.org>  Thu, 02 Nov 2017 14:14:55 +0100

undertow (1.4.20-1) unstable; urgency=medium

  * New upstream version 1.4.20.
  * Tighten build-dependency on jboss-xnio.
  * Add no-wildfly.patch and don't require the wildfly openssl dependency.
  * Declare compliance with Debian Policy 4.1.0.

 -- Markus Koschany <apo@debian.org>  Tue, 19 Sep 2017 19:58:15 +0200

undertow (1.4.18-1) unstable; urgency=medium

  * New upstream version 1.4.18.
    - Fixes CVE-2017-2666 and CVE-2017-2670. (Closes: #864405)
  * Declare compliance with Debian Policy 4.0.0.
  * Use https for Format field.
  * Ignore zanata-maven-plugin.
  * Ignore karaf submodule.
  * Add libmaven-bundle-plugin-java to B-D.
  * Remove lintian-overrides file.

 -- Markus Koschany <apo@debian.org>  Thu, 29 Jun 2017 18:05:28 +0200

undertow (1.4.8-1) unstable; urgency=medium

  * New upstream version 1.4.8.

 -- Markus Koschany <apo@debian.org>  Fri, 23 Dec 2016 00:17:42 +0100

undertow (1.4.7-1) unstable; urgency=medium

  * New upstream version 1.4.7.

 -- Markus Koschany <apo@debian.org>  Sun, 18 Dec 2016 00:12:45 +0100

undertow (1.4.6-1) unstable; urgency=medium

  * New upstream version 1.4.6.

 -- Markus Koschany <apo@debian.org>  Mon, 28 Nov 2016 22:46:45 +0100

undertow (1.4.4-1) unstable; urgency=medium

  * New upstream version 1.4.4.

 -- Markus Koschany <apo@debian.org>  Sat, 29 Oct 2016 18:29:08 +0200

undertow (1.4.3-1) unstable; urgency=medium

  * New upstream version 1.4.3.
    - Fixes CVE-2016-7046. (Closes: #838600)
      Thanks to Salvatore Bonaccorso for the report.
  * Switch to compat level 10.
  * debian/watch: Use version=4.

 -- Markus Koschany <apo@debian.org>  Fri, 23 Sep 2016 19:18:11 +0200

undertow (1.4.1-1) unstable; urgency=medium

  * New upstream version 1.4.1.
  * Ignore org.wildfly.openssl:wildfly-openssl.

 -- Markus Koschany <apo@debian.org>  Fri, 09 Sep 2016 02:21:45 +0200

undertow (1.4.0-1) unstable; urgency=medium

  * Imported Upstream version 1.4.0.

 -- Markus Koschany <apo@debian.org>  Fri, 05 Aug 2016 12:14:46 +0200

undertow (1.3.23-1) unstable; urgency=medium

  * Imported Upstream version 1.3.23.
  * Declare compliance with Debian Policy 3.9.8.
  * Drop JettyALPNClientProvider.patch. Fixed upstream.

 -- Markus Koschany <apo@debian.org>  Sun, 05 Jun 2016 17:47:27 +0200

undertow (1.3.21-1) unstable; urgency=medium

  * Imported Upstream version 1.3.21.
  * Remove http2 test suite from libundertow-java.poms and
    maven.rules.
  * Add JettyALPNClientProvider.patch and fix multiple compilation errors.

 -- Markus Koschany <apo@debian.org>  Sun, 10 Apr 2016 20:12:33 +0200

undertow (1.3.19-1) unstable; urgency=medium

  * Imported Upstream version 1.3.19.
  * Declare compliance with Debian Policy 3.9.7.

 -- Markus Koschany <apo@debian.org>  Sun, 20 Mar 2016 19:17:54 +0100

undertow (1.3.16-1) unstable; urgency=medium

  * Imported Upstream version 1.3.16.
  * Vcs-Git: Use https.

 -- Markus Koschany <apo@debian.org>  Sat, 30 Jan 2016 17:03:04 +0100

undertow (1.3.11-1) unstable; urgency=medium

  * debian/rules: Do not execute dh_auto_test to prevent a FTBFS due
    to a bug in maven-compiler-plugin 3.2. (Closes: #808691)
  * Imported Upstream version 1.3.11.

 -- Markus Koschany <apo@debian.org>  Thu, 24 Dec 2015 19:56:00 +0100

undertow (1.3.7-1) unstable; urgency=medium

  * Imported Upstream version 1.3.7.

 -- Markus Koschany <apo@debian.org>  Fri, 27 Nov 2015 19:40:51 +0100

undertow (1.3.5-1) unstable; urgency=medium

  * Imported Upstream version 1.3.5.
  * Change homepage field to undertow.io.

 -- Markus Koschany <apo@debian.org>  Mon, 16 Nov 2015 17:25:21 +0100

undertow (1.3.4-1) unstable; urgency=medium

  * Initial release (Closes: #767001)

 -- Markus Koschany <apo@debian.org>  Mon, 02 Nov 2015 17:57:08 +0100
