bind9 (1:9.18.47-1~deb12u1) bookworm-security; urgency=high

  * New upstream version 9.18.47
   - [CVE-2026-1519]: Fix unbounded NSEC3 iterations when validating
     referrals to unsigned delegations.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 25 Mar 2026 16:59:36 +0100

bind9 (1:9.18.44-1~deb12u1) bookworm-security; urgency=high

  * New upstream version 9.18.44
   + [CVE-2025-13878]: Fix incorrect length checks for BRID and HHIT
     records.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 22 Jan 2026 08:24:36 +0100

bind9 (1:9.18.41-1~deb12u1) bookworm-security; urgency=high

  * New upstream version 9.18.41
   - [CVE-2025-8677]: DNSSEC validation fails if matching but invalid
     DNSKEY is found
   - [CVE-2025-40778]: Address various spoofing attacks.
   - [CVE-2025-40780]: Cache-poisoning due to weak pseudo-random number
     generator

 -- Ondřej Surý <ondrej@debian.org>  Wed, 22 Oct 2025 17:38:58 +0200

bind9 (1:9.18.36-1~deb12u1) bookworm; urgency=medium

  * New upstream version 9.18.36

 -- Ondřej Surý <ondrej@debian.org>  Wed, 16 Apr 2025 15:02:24 +0200

bind9 (1:9.18.35-1~deb12u1) bookworm; urgency=medium

  * New upstream version 9.18.35

 -- Ondřej Surý <ondrej@debian.org>  Thu, 13 Mar 2025 11:41:23 +0100

bind9 (1:9.18.33-1~deb12u2) bookworm-security; urgency=high

  * New upstream version 9.18.33
   - CVE-2024-12705: DNS-over-HTTPS flooding fixes
   - CVE-2024-11187: Limit additional section processing for large RDATA
     sets

 -- Ondřej Surý <ondrej@debian.org>  Sat, 25 Jan 2025 11:14:58 +0100

bind9 (1:9.18.28-1~deb12u2) bookworm-security; urgency=medium

  * Fix the assertion failure in samba-libs DLZ module. (Closes #1074378)

 -- Ondřej Surý <ondrej@debian.org>  Sat, 27 Jul 2024 05:13:42 +0200

bind9 (1:9.18.28-1~deb12u1) bookworm-security; urgency=high

  * New upstream version 9.18.28
   - CVE-2024-0760: A flood of DNS messages over TCP may make the server
     unstable
   - CVE-2024-1737: BIND's database will be slow if a very large number of
     RRs exist at the same name
   - CVE-2024-1975: SIG(0) can be used to exhaust CPU resources
   - CVE-2024-4076: Assertion failure when serving both stale cache data
     and authoritative zone content

 -- Ondřej Surý <ondrej@debian.org>  Tue, 16 Jul 2024 17:22:50 +0200

bind9 (1:9.18.24-1) bookworm-security; urgency=high

  * New upstream version 9.18.24
   - CVE-2023-4408: Parsing large DNS messages may cause excessive CPU
     load
   - CVE-2023-5517: Querying RFC 1918 reverse zones may cause an assertion
     failure when "nxdomain-redirect" is enabled
   - CVE-2023-5679: Enabling both DNS64 and serve-stale may cause an
     assertion failure during recursive resolution
   - CVE-2023-6516: Specific recursive query patterns may lead to an
     out-of-memory condition
   - CVE-2023-50387: KeyTrap - Extreme CPU consumption in DNSSEC validator
   - CVE-2023-50868: Preparing an NSEC3 closest encloser proof can exhaust
     CPU resources

 -- Ondřej Surý <ondrej@debian.org>  Mon, 12 Feb 2024 17:28:03 +0100

bind9 (1:9.18.19-1~deb12u1) bookworm-security; urgency=high

  * New upstream version 9.18.19
   - CVE-2023-3341: A stack exhaustion flaw in control channel code may
     cause named to terminate unexpectedly
   - CVE-2023-4236: named may terminate unexpectedly under high
     DNS-over-TLS query load

 -- Ondřej Surý <ondrej@debian.org>  Thu, 21 Sep 2023 19:33:58 +0200

bind9 (1:9.18.16-1~deb12u1) bookworm-security; urgency=high

  * New upstream version 9.18.16
   - CVE-2023-2828: The overmem cleaning process has been improved,
     to prevent the cache from significantly exceeding the configured
     max-cache-size limit.
   - CVE-2023-2911: A query that prioritizes stale data over lookup
     triggers a fetch to refresh the stale data in cache. If the fetch
     is aborted for exceeding the recursion quota, it was possible for
     named to enter an infinite callback loop and crash due to stack
     overflow. This has been fixed.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Jun 2023 20:48:44 +0200

bind9 (1:9.18.13-1) unstable; urgency=medium

  * New upstream version 9.18.13

 -- Ondřej Surý <ondrej@debian.org>  Wed, 15 Mar 2023 18:11:29 +0100

bind9 (1:9.18.12-1) unstable; urgency=medium

  * New upstream version 9.18.12
  * Drop libtool-bin from B-D (Closes: #1022968)

 -- Ondřej Surý <ondrej@debian.org>  Fri, 10 Feb 2023 15:15:49 +0100

bind9 (1:9.18.11-2) unstable; urgency=medium

  * Allow the named to use systemd notify service

 -- Ondřej Surý <ondrej@debian.org>  Thu, 26 Jan 2023 21:13:55 +0100

bind9 (1:9.18.11-1) unstable; urgency=medium

  * New upstream version 9.18.11

 -- Ondřej Surý <ondrej@debian.org>  Wed, 25 Jan 2023 15:51:35 +0100

bind9 (1:9.18.10-2) unstable; urgency=medium

  * Backport upstream feature to use sd_notify()
  * Use systemd notify for service readyness check (Closes: #994696)
  * apparmor.d: Allow named to read all OpenSSL config files.
    (Closes: #1025519)
  * apparmor.d: Allow named to query for hugepages support.
    (Closes: #1020315)
  * Fix path to README.Debian (Closes: #1016646)

 -- Bernhard Schmidt <berni@debian.org>  Thu, 22 Dec 2022 17:12:17 +0100

bind9 (1:9.18.10-1) unstable; urgency=medium

  * New upstream version 9.18.10

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Dec 2022 18:00:33 +0100

bind9 (1:9.18.9-1) unstable; urgency=medium

  * New upstream version 9.18.9

 -- Ondřej Surý <ondrej@debian.org>  Wed, 16 Nov 2022 14:00:05 +0100

bind9 (1:9.18.8-1) unstable; urgency=medium

  * New upstream version 9.18.8

 -- Ondřej Surý <ondrej@debian.org>  Wed, 19 Oct 2022 14:58:38 +0200

bind9 (1:9.18.7-1) unstable; urgency=medium

  * New upstream version 9.18.7
   - CVE-2022-2795: Processing large delegations may severely degrade
     resolver performance
   - CVE-2022-2881: Buffer overread in statistics channel code
   - CVE-2022-2906: Memory leaks in code handling Diffie-Hellman key
     exchange via TKEY RRs (OpenSSL 3.0.0+ only)
   - CVE-2022-3080: BIND 9 resolvers configured to answer from stale
     cache with zero stale-answer-client-timeout may terminate unexpectedly
   - CVE-2022-38177: Memory leak in ECDSA DNSSEC verification code
   - CVE-2022-38178: Memory leaks in EdDSA DNSSEC verification code

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Sep 2022 12:48:36 +0200

bind9 (1:9.18.6-2) unstable; urgency=medium

  * No-change source-only upload

 -- Bernhard Schmidt <berni@debian.org>  Mon, 05 Sep 2022 21:30:08 +0200

bind9 (1:9.18.6-1) unstable; urgency=medium

  * Disable treat-warnings-as-errors in sphinx-build
  * New upstream version 9.18.6

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Aug 2022 09:39:20 +0200

bind9 (1:9.18.5-1) unstable; urgency=medium

  * New upstream version 9.18.5

 -- Ondřej Surý <ondrej@debian.org>  Wed, 20 Jul 2022 16:40:31 +0200

bind9 (1:9.18.4-2) unstable; urgency=medium

  [ Simon Deziel ]
  * debian/extras/etc/db.0: correct descriptive comment

  [ Bernhard Schmidt ]
  * Add sleep workaround in tests/simpletests (Closes: #1012059)

 -- Ondřej Surý <ondrej@debian.org>  Tue, 05 Jul 2022 12:58:06 +0200

bind9 (1:9.18.4-1) unstable; urgency=medium

  * Disable treat-warnings-as-errors in sphinx-build
  * New upstream version 9.18.4

 -- Ondřej Surý <ondrej@debian.org>  Wed, 15 Jun 2022 14:36:44 +0200

bind9 (1:9.18.3-1) unstable; urgency=medium

  * New upstream version 9.18.3

 -- Ondřej Surý <ondrej@debian.org>  Wed, 18 May 2022 16:53:01 +0200

bind9 (1:9.18.2-1) unstable; urgency=medium

  * Drop libldap2-dev from Build-Depends (Closes: #1008021)
  * New upstream version 9.18.2
  * Add runtime dependency on libuv1 >= 1.40.0 (Closes: #1009889)

 -- Ondřej Surý <ondrej@debian.org>  Tue, 26 Apr 2022 11:03:35 +0200

bind9 (1:9.18.1-1) unstable; urgency=high

  * New upstream version 9.18.1
  * CVE-2021-25220: The rules for acceptance of records into the cache
    have been tightened to prevent the possibility of poisoning if
    forwarders send records outside the configured bailiwick.
  * CVE-2022-0396: TCP connections with 'keep-response-order' enabled
    could leave the TCP sockets in the 'CLOSE_WAIT' state when the client
    did not properly shut down the connection.
  * CVE-2022-0635: Lookups involving a DNAME could trigger an assertion
    failure when 'synth-from-dnssec' was enabled (which is the default)
  * CVE-2022-0667: When chasing DS records, a timed out or artificially
    delayed fetch could cause 'named' to crash while resuming a DS lookup.

 -- Ondřej Surý <ondrej@debian.org>  Mon, 14 Mar 2022 15:29:31 +0100

bind9 (1:9.18.0-2) unstable; urgency=medium

  * Add patch to use detected L1 cache-line size instead of hard-coded
    value, this should fix architectures with 128-byte L1 cache.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 27 Jan 2022 13:16:04 +0100

bind9 (1:9.18.0-1) unstable; urgency=medium

  * Bump the upstream version in debian/ to 9.18
  * New upstream version 9.18.0

 -- Ondřej Surý <ondrej@debian.org>  Wed, 26 Jan 2022 12:31:55 +0100

bind9 (1:9.18.0~0+git28350c-1) unstable; urgency=medium

  * New upstream version 9.18.0~0+git28350c
   + Pull the 9.18.0 pre-release git to have the L1 cache line
     fix (Closes: #1004271)
  * Fix the typo when backing up and restoring configure{,.ac}
    (Closes: #903586)
  * Remove some prehistoring conffile no longer in use
    (Closes: #942377)
  * Pick UTC date for release_date variable (Closes: #1000893)

 -- Ondřej Surý <ondrej@debian.org>  Mon, 24 Jan 2022 16:00:49 +0100

bind9 (1:9.17.22-1) unstable; urgency=medium

  * New upstream version 9.17.22

 -- Ondřej Surý <ondrej@debian.org>  Wed, 19 Jan 2022 18:38:13 +0100

bind9 (1:9.17.21-1) unstable; urgency=medium

  * New upstream version 9.17.21

 -- Ondřej Surý <ondrej@debian.org>  Wed, 15 Dec 2021 15:22:46 +0100

bind9 (1:9.17.20-3) unstable; urgency=medium

  * Retain bind9-resolvconf.service alias (Closes: #1000565)

 -- Ondřej Surý <ondrej@debian.org>  Thu, 25 Nov 2021 10:10:50 +0100

bind9 (1:9.17.20-2) unstable; urgency=medium

  * Tighten the dependencies on bind9-libs for the utils too
    (Closes: #1000354)

 -- Ondřej Surý <ondrej@debian.org>  Mon, 22 Nov 2021 08:58:22 +0100

bind9 (1:9.17.20-1) unstable; urgency=medium

  * New upstream version 9.17.20
  * Remove the sphinx-patch, the role has been fixed upstream

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Nov 2021 07:49:14 +0100

bind9 (1:9.17.19-3) unstable; urgency=medium

  * Remove the .so libraries from excluded files

 -- Ondřej Surý <ondrej@debian.org>  Fri, 12 Nov 2021 14:24:13 +0100

bind9 (1:9.17.19-2) unstable; urgency=medium

  * Add libjemalloc-dev to Build-Depends
  * Sync the packaging between BIND 9.16 and BIND 9.17 branches
  * Don't install static libraries to bind9-dev, they are not built

 -- Ondřej Surý <ondrej@debian.org>  Tue, 09 Nov 2021 10:42:43 +0100

bind9 (1:9.17.19-1) unstable; urgency=medium

  * New upstream version 9.17.19

 -- Ondřej Surý <ondrej@debian.org>  Mon, 25 Oct 2021 14:29:06 +0200

bind9 (1:9.17.18-1) experimental; urgency=medium

  * New upstream version 9.17.18

 -- Ondřej Surý <ondrej@debian.org>  Thu, 16 Sep 2021 10:03:31 +0200

bind9 (1:9.17.17-2) experimental; urgency=medium

  * Bump MAPAPI to 3.0

 -- Ondřej Surý <ondrej@debian.org>  Fri, 20 Aug 2021 14:34:56 +0200

bind9 (1:9.17.17-1) experimental; urgency=medium

  * New upstream version 9.17.17

 -- Ondřej Surý <ondrej@debian.org>  Wed, 18 Aug 2021 18:31:14 +0200

bind9 (1:9.17.16-1) experimental; urgency=medium

  * New upstream version 9.17.16

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Jul 2021 20:31:56 +0200

bind9 (1:9.17.15-1) experimental; urgency=medium

  * New upstream version 9.17.15

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Jun 2021 15:13:26 +0200

bind9 (1:9.17.14-3) experimental; urgency=medium

  * Add upstream patch to address 'Checking of key-directory and
    dnssec-policy was broken'

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Jun 2021 09:08:52 +0200

bind9 (1:9.17.14-2) experimental; urgency=medium

  * Add upstream patch to fix: 'W' in wildcard expansions was being mapped
    to '\000'.

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Jun 2021 06:49:25 +0200

bind9 (1:9.17.14-1) experimental; urgency=medium

  * New upstream version 9.17.14

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Jun 2021 00:26:38 +0200

bind9 (1:9.17.13-2) experimental; urgency=medium

  * Revert upstream 'Add a Sphinx role for linking GitLab issues/MRs'

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 May 2021 11:30:01 +0200

bind9 (1:9.17.13-1) experimental; urgency=medium

  * New upstream version 9.17.13

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 May 2021 11:05:32 +0200

bind9 (1:9.17.12-2) experimental; urgency=medium

  * Add filter-a.so plugin into main package

 -- Ondřej Surý <ondrej@debian.org>  Sat, 01 May 2021 13:15:40 +0200

bind9 (1:9.17.12-1) experimental; urgency=medium

  * New upstream version 9.17.12
  * Add patches to implement I-D draft-hardaker-dnsop-nsec3-guidance

 -- Ondřej Surý <ondrej@debian.org>  Thu, 29 Apr 2021 10:49:07 +0200

bind9 (1:9.17.11-1) experimental; urgency=medium

  * New upstream version 9.17.11
  * Add upstream patches to fix TCP timeouts firing too early

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Mar 2021 14:43:40 +0100

bind9 (1:9.17.10-1) experimental; urgency=high

  * New upstream version 9.17.10
   + [CVE-2020-8625]: Fix off-by-one bug in ISC SPNEGO implementation.
  * Adjust the bind9-libs package for new upstream library names
  * Add libnghttp2-dev to Build-Depends
  * Update the way how we ignore development libraries, so the real ones
    gets installed

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Feb 2021 09:27:46 +0100

bind9 (1:9.17.9-1) experimental; urgency=medium

  * Exclude test-async.so from dh_install
  * Update the ISC code-signing key
  * New upstream version 9.17.9

 -- Ondřej Surý <ondrej@debian.org>  Thu, 21 Jan 2021 11:29:33 +0100

bind9 (1:9.17.8-1) experimental; urgency=medium

  * New upstream version 9.17.8

 -- Ondřej Surý <ondrej@debian.org>  Wed, 16 Dec 2020 22:35:50 +0100

bind9 (1:9.17.7-1) experimental; urgency=medium

  * New upstream version 9.17.7

 -- Ondřej Surý <ondrej@debian.org>  Thu, 26 Nov 2020 15:58:54 +0100

bind9 (1:9.17.6-1) experimental; urgency=medium

  * New upstream version 9.17.6

 -- Ondřej Surý <ondrej@debian.org>  Fri, 23 Oct 2020 15:11:42 +0200

bind9 (1:9.17.5-2) experimental; urgency=medium

  [ Bernhard Schmidt ]
  * Move Build-Depends for documentation to Build-Depends-Indep
  * Set Restart=on-failure in systemd unit

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Sep 2020 13:53:04 +0200

bind9 (1:9.17.5-1) experimental; urgency=medium

  * New upstream version 9.17.5

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Sep 2020 10:40:29 +0200

bind9 (1:9.17.4-1) experimental; urgency=medium

  * Add libtool-bin to Build-Depends
  * Disable static linking
  * New upstream version 9.17.4

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 Aug 2020 21:35:16 +0200

bind9 (1:9.17.3-1) experimental; urgency=medium

  * New upstream version 9.17.2
  * Adjust d/*.install files after upstream moved binaries from sbin to bin
  * Remove rfc-compliance from docs, it's gone
  * New upstream version 9.17.3
  * Add fonts-freefont-otf, latexmk, texlive-fonts-extra,
    texlive-latex-recommended, texlive-xetex, and xindy to Build-Depends
  * Install man pages for tsig-gen and named-compilezone

 -- Ondřej Surý <ondrej@debian.org>  Thu, 16 Jul 2020 00:38:43 +0200

bind9 (1:9.17.1+git20200519-1) experimental; urgency=medium

  * New upstream version 9.17.1+git20200519
  * Update Debian packaging for autoconf/automake and sphinx-doc

 -- Ondřej Surý <ondrej@debian.org>  Tue, 19 May 2020 22:02:19 +0200

bind9 (1:9.17.1-1) experimental; urgency=medium

  * Update d/copyright (Closes: #947978)
  * New upstream version 9.17.1

 -- Ondřej Surý <ondrej@debian.org>  Thu, 16 Apr 2020 10:34:10 +0200

bind9 (1:9.17.0-1) experimental; urgency=medium

  [ Andreas Hasenack ]
  * Bring back the DEP8 test from sid
  * Use iproute2 instead of net-tools
  * d/control: drop hardcoded python3 dependency

  [ Bernhard Schmidt ]
  * Fix apparmor profile name.
    Thanks to Andreas Hasenack
  * Enable readline support

  [ Andreas Hasenack ]
  * Update apparmor profile with what is in sid
  * Create the missing transitional packages for dnsutils, bind9utils
  * There is a licensing conflict with adding libreadline and we should
    use libedit-dev instead.

  [ Ondřej Surý ]
  * Switch to BIND 9.17 for the -dev packages
  * New upstream version 9.17.0

 -- Ondřej Surý <ondrej@debian.org>  Fri, 20 Mar 2020 14:23:38 +0100

bind9 (1:9.16.22-1) unstable; urgency=medium

  * New upstream version 9.16.22

 -- Ondřej Surý <ondrej@debian.org>  Mon, 25 Oct 2021 14:27:31 +0200

bind9 (1:9.16.21-1) unstable; urgency=medium

  * New upstream version 9.16.21

 -- Ondřej Surý <ondrej@debian.org>  Thu, 16 Sep 2021 09:54:17 +0200

bind9 (1:9.16.20-2) unstable; urgency=medium

  * Bump MAPAPI to 3.0

 -- Ondřej Surý <ondrej@debian.org>  Fri, 20 Aug 2021 14:40:11 +0200

bind9 (1:9.16.20-1) unstable; urgency=medium

  * New upstream version 9.16.20

 -- Ondřej Surý <ondrej@debian.org>  Wed, 18 Aug 2021 18:27:37 +0200

bind9 (1:9.16.19-1) unstable; urgency=medium

  * New upstream version 9.16.19

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Jul 2021 20:27:13 +0200

bind9 (1:9.16.18-1) unstable; urgency=medium

  * New upstream version 9.16.18

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Jun 2021 15:06:55 +0200

bind9 (1:9.16.17-3) unstable; urgency=medium

  * Add upstream patch to address 'Checking of key-directory and
    dnssec-policy was broken'

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Jun 2021 09:07:09 +0200

bind9 (1:9.16.17-2) unstable; urgency=high

  * Add upstream patch to fix: 'W' in wildcard expansions was being mapped
    to '\000'.

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Jun 2021 06:45:25 +0200

bind9 (1:9.16.17-1) unstable; urgency=medium

  * New upstream version 9.16.17

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Jun 2021 00:10:22 +0200

bind9 (1:9.16.16-2) unstable; urgency=medium

  * Revert upstream 'Add a Sphinx role for linking GitLab issues/MRs'

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 May 2021 11:28:18 +0200

bind9 (1:9.16.16-1) unstable; urgency=medium

  * New upstream version 9.16.16
  * Patches to implement I-D draft-hardaker-dnsop-nsec3-guidance were
    merged upstream; remove them from the package.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 May 2021 10:00:00 +0200

bind9 (1:9.16.15-1) unstable; urgency=high

  * New upstream version 9.16.15 (Closes: #987741, #987742, #987743)
   + CVE-2021-25214: A malformed incoming IXFR transfer could trigger an
     assertion failure in ``named``, causing it to quit abnormally.
   + CVE-2021-25215: ``named`` crashed when a DNAME record placed in the
     ANSWER section during DNAME chasing turned out to be the final
     answer to a client query.
   + CVE-2021-25216: When a server's configuration set the
    ``tkey-gssapi-keytab`` or ``tkey-gssapi-credential`` option, a
    specially crafted GSS-TSIG query could cause a buffer overflow in
    the ISC implementation of SPNEGO (a protocol enabling negotiation of
    the security mechanism used for GSSAPI authentication).
  * Add patches to implement I-D draft-hardaker-dnsop-nsec3-guidance

 -- Ondřej Surý <ondrej@debian.org>  Thu, 29 Apr 2021 09:11:32 +0200

bind9 (1:9.16.13-1) unstable; urgency=medium

  * New upstream version 9.16.13
  * Add upstream patches to fix TCP timeouts firing too early

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Mar 2021 14:23:49 +0100

bind9 (1:9.16.12-3) unstable; urgency=medium

  * Add most important patches from upcoming 9.16.13 release

 -- Ondřej Surý <ondrej@debian.org>  Fri, 12 Mar 2021 09:59:49 +0100

bind9 (1:9.16.12-2) unstable; urgency=medium

  * Add patch to fix sphinx-build failure on Ubuntu Xenial

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Feb 2021 12:26:09 +0100

bind9 (1:9.16.12-1) unstable; urgency=high

  * New upstream version 9.16.12
   + [CVE-2020-8625]: Fix off-by-one bug in ISC SPNEGO implementation.
     (Closes: #983004)
  * Adjust the bind9-libs and bind9-dev packages for new upstream library
    names

 -- Ondřej Surý <ondrej@debian.org>  Thu, 18 Feb 2021 08:13:58 +0100

bind9 (1:9.16.11-3) unstable; urgency=medium

  * Split the simple validation test to separate file and mark it as flaky
    (Closes: #976045)

 -- Ondřej Surý <ondrej@debian.org>  Sun, 14 Feb 2021 20:04:39 +0100

bind9 (1:9.16.11-2) unstable; urgency=medium

  * Cherry-pick upstream commit to fix segfault with named ACLs used in
    allow-update (Closes: #980786)

 -- Bernhard Schmidt <berni@debian.org>  Fri, 29 Jan 2021 08:27:31 +0100

bind9 (1:9.16.11-1) unstable; urgency=medium

  * Add the ISC code-signing key for 2021-2022
  * New upstream version 9.16.11

 -- Ondřej Surý <ondrej@debian.org>  Thu, 21 Jan 2021 09:58:33 +0100

bind9 (1:9.16.10-1) unstable; urgency=medium

  * New upstream version 9.16.10

 -- Ondřej Surý <ondrej@debian.org>  Wed, 16 Dec 2020 22:22:25 +0100

bind9 (1:9.16.9-1) unstable; urgency=medium

  * New upstream version 9.16.9

 -- Ondřej Surý <ondrej@debian.org>  Thu, 26 Nov 2020 12:52:28 +0100

bind9 (1:9.16.8-1) unstable; urgency=medium

  [ Ondřej Surý ]
  * New upstream version 9.16.8

  [ Bernhard Schmidt ]
  * d/t/control:
    - tag autopkgtest with needs-internet (Closes: #973955)
    - depend on bind9-dnsutils insead of the transitional dnsutils
  * d/rules: change deprecated --with-libjson-c configure argument to
    --with-json-c

 -- Bernhard Schmidt <berni@debian.org>  Mon, 09 Nov 2020 23:03:53 +0100

bind9 (1:9.16.7-1) unstable; urgency=medium

  * New upstream version 9.16.7

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Sep 2020 10:36:51 +0200

bind9 (1:9.16.6-3) unstable; urgency=medium

  [ Ondřej Surý ]
  * Add upstream patches to fix some rare conditions (Closes: #969448)

  [ Bernhard Schmidt ]
  * Set Restart=on-failure in systemd unit

 -- Bernhard Schmidt <berni@debian.org>  Tue, 15 Sep 2020 00:26:14 +0200

bind9 (1:9.16.6-2) unstable; urgency=medium

  * Move Build-Depends for documentation to Build-Depends-Indep, this
    should fix the arch-any build on s390x where xindy is not available.

 -- Bernhard Schmidt <berni@debian.org>  Sat, 22 Aug 2020 20:06:00 +0200

bind9 (1:9.16.6-1) unstable; urgency=medium

  * New upstream version 9.16.6

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 Aug 2020 21:32:46 +0200

bind9 (1:9.16.5-1) unstable; urgency=medium

  * New upstream version 9.16.5
  * Add fonts-freefont-otf, latexmk, texlive-fonts-recommended,
    texlive-latex-recommended, texlive-xetex, xindy to Build-Depends
  * Install man pages for tsig-gen and named-compilezone

 -- Ondřej Surý <ondrej@debian.org>  Thu, 16 Jul 2020 00:29:57 +0200

bind9 (1:9.16.4-1) unstable; urgency=medium

  * New upstream version 9.16.4
  * Update Debian packaging for sphinx-doc documentation

 -- Ondřej Surý <ondrej@debian.org>  Wed, 17 Jun 2020 09:27:29 +0200

bind9 (1:9.16.3-1) unstable; urgency=medium

  * New upstream version 9.16.3

 -- Ondřej Surý <ondrej@debian.org>  Tue, 19 May 2020 14:14:35 +0200

bind9 (1:9.16.2-3) unstable; urgency=medium

  [ Simon Deziel ]
  * apparmor: use profile name specifier

 -- Bernhard Schmidt <berni@debian.org>  Thu, 23 Apr 2020 11:45:43 +0200

bind9 (1:9.16.2-2) unstable; urgency=medium

  * Update gbp.conf to debian/master and upstream/latest
  * Reintroduce the bind9-dev package (Closes: #954906)

 -- Ondřej Surý <ondrej@debian.org>  Thu, 16 Apr 2020 12:14:44 +0200

bind9 (1:9.16.2-1) unstable; urgency=medium

  * Update d/copyright (Closes: #947978)
  * New upstream version 9.16.2 (Closes: #952946, #954919)

 -- Ondřej Surý <ondrej@debian.org>  Thu, 16 Apr 2020 10:07:07 +0200

bind9 (1:9.16.1-2) unstable; urgency=medium

  [ Andreas Hasenack ]
  * Bring back the DEP8 test from sid
  * Use iproute2 instead of net-tools
  * d/control: drop hardcoded python3 dependency

  [ Bernhard Schmidt ]
  * Fix apparmor profile name.
    Thanks to Andreas Hasenack
  * Enable readline support

  [ Andreas Hasenack ]
  * Update apparmor profile with what is in sid
  * Create the missing transitional packages for dnsutils, bind9utils
  * There is a licensing conflict with adding libreadline and we should
    use libedit-dev instead.

  [ Ondřej Surý ]
  * Add Breaks: freeipa, so the package doesn't migrate to testing before freeipa is fixed

 -- Ondřej Surý <ondrej@debian.org>  Sun, 22 Mar 2020 09:21:21 +0100

bind9 (1:9.16.1-1) experimental; urgency=medium

  * New upstream version 9.16.1

 -- Ondřej Surý <ondrej@debian.org>  Fri, 20 Mar 2020 13:59:34 +0100

bind9 (1:9.16.0-1) experimental; urgency=medium

  * Change the branch to 9.16
  * New upstream version 9.16.0

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 Feb 2020 10:54:34 +0100

bind9 (1:9.15.8-1) experimental; urgency=medium

  * New upstream version 9.15.8

 -- Ondřej Surý <ondrej@debian.org>  Thu, 23 Jan 2020 14:58:01 +0100

bind9 (1:9.15.7-1) experimental; urgency=medium

  * Add libuv1-dev, libcmocka-dev, libedit-dev and zlib1g-dev to B-D
  * Update d/watch to use tar.xz
  * New upstream version 9.15.7

 -- Ondřej Surý <ondrej@debian.org>  Thu, 19 Dec 2019 09:40:52 +0100

bind9 (1:9.15.6-1) experimental; urgency=medium

  * Remove useless patches
  * New upstream version 9.15.6

 -- Ondřej Surý <ondrej@debian.org>  Wed, 20 Nov 2019 21:58:06 +0100

bind9 (1:9.15.5-1) experimental; urgency=medium

  * New upstream version 9.15.5
  * Install python files to dist-packages (Courtesy of Jim Popovitch)
  * Remove GPL licensed apport file until one with better license is available
  * Remove debian/nslookup.1
  * Remove 4-clause BSD content from the package

 -- Ondřej Surý <ondrej@sury.org>  Thu, 17 Oct 2019 08:41:55 +0200

bind9 (1:9.15.4-1) unstable; urgency=medium

  * New upstream version 9.15.4

 -- Ondřej Surý <ondrej@sury.org>  Mon, 23 Sep 2019 11:54:32 +0200

bind9 (1:9.15.3-2) unstable; urgency=medium

  * Fix the section for bind9 alias in the systemd unit [GL #1193]

 -- Ondřej Surý <ondrej@sury.org>  Wed, 28 Aug 2019 21:35:44 +0200

bind9 (1:9.15.3-1) unstable; urgency=medium

  * New upstream version 9.15.3
  * isc-config has been removed, remove it from the debian/

 -- Ondřej Surý <ondrej@sury.org>  Mon, 26 Aug 2019 10:26:41 +0200

bind9 (1:9.15.2-2) unstable; urgency=medium

  * Tighten libmaxminddb-dev dependency
  * Install the tmpfile for named service again

 -- Ondřej Surý <ondrej@sury.org>  Wed, 07 Aug 2019 11:11:13 +0200

bind9 (1:9.15.2-1) unstable; urgency=medium

  * New upstream version 9.15.2
  * Disable old GeoIP and enable new GeoIP2

 -- Ondřej Surý <ondrej@sury.org>  Thu, 18 Jul 2019 10:09:29 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog bind9-dev`.
