libpng1.6 (1.6.39-2+deb12u5) bookworm-security; urgency=high

  * Security upload targeting bookworm.
  * CVE-2026-34757 - Use after free. (Closes: #1133051)
  * Cherry-pick upstream regression fix for previously fixed CVE 2026-33416.

 -- Tobias Frost <tobi@debian.org>  Fri, 08 May 2026 14:30:14 +0200

libpng1.6 (1.6.39-2+deb12u4) bookworm-security; urgency=medium

  * Security upload targeting bookworm.
  * Backporting upstream fixes for:
    - CVE-2026-33416 - Use-after-free (Closes: #1132012)
    - CVE-2026-33636 - OOB read/write on ARM plattforms (Closes: #1132013)

 -- Tobias Frost <tobi@debian.org>  Mon, 30 Mar 2026 20:59:03 +0200

libpng1.6 (1.6.39-2+deb12u3) bookworm-security; urgency=medium

  * Security upload targeting boowkorm.
  * Backport fix for CVE-2026-25646 - Heap buffer overflow (Closes: #1127566)

 -- Tobias Frost <tobi@debian.org>  Mon, 16 Feb 2026 18:58:09 +0100

libpng1.6 (1.6.39-2+deb12u2) bookworm; urgency=medium

  * Backporting fixes from 1.6.54 for oldstable:
    - CVE-2026-22801 - Heap buffer over-read (Closes: #1125444
    - CVE-2026-22695 - Heap buffer over-read (Closes: #1125443)

 -- Tobias Frost <tobi@debian.org>  Sat, 24 Jan 2026 14:15:14 +0100

libpng1.6 (1.6.39-2+deb12u1) bookworm-security; urgency=high

  * Security upload targeting boowkorm.
  * Backport fixes for:
    - CVE-2025-64505 - Heap buffer over-read (Closes: #1121219)
    - CVE-2025-64506 - Heap buffer over-read (Closes: #1121218)
    - CVE-2025-64720 - Heap buffer overflow (Closes: #1121217)
    - CVE-2025-65018 - Heap buffer overflow (Closes: #1121216)
    - CVE-2025-66293 - Out-of-bounds read (Closes: #1121877)
  * Set gbp.conf for bookworm and enable salsa CI

 -- Tobias Frost <tobi@debian.org>  Sat, 06 Dec 2025 11:15:39 +0100

libpng1.6 (1.6.39-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * Support the noudeb build profile. (Closes: #1024944)

  [ Gianfranco Costamagna ]
  * Upload to sid

 -- Helmut Grohne <helmut@subdivi.de>  Sun, 27 Nov 2022 20:59:26 +0100

libpng1.6 (1.6.39-1) unstable; urgency=medium

  * New upstream version 1.6.39

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 26 Nov 2022 15:21:15 +0100

libpng1.6 (1.6.38-2) unstable; urgency=medium

  * Add manpages to build

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 21 Sep 2022 14:46:45 +0200

libpng1.6 (1.6.38-1) unstable; urgency=medium

  * New upstream version 1.6.38
  * Drop all patches, now upstream
  * Refactor copyright file and bump copyright years
  * Drop as-needed flag, now default
  * Add not-installed file
  * Move installexamples to libpng-dev.examples file

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 21 Sep 2022 12:36:17 +0200

libpng1.6 (1.6.37-5) unstable; urgency=medium

  * debian/patches/eb6767273a4eb5d6f4ad528370d7262cf7aa220c.patch:
    - cherry-pick upstream fix for memory lieak in png_handle_eXIf function
      (LP: #1960326)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 25 Apr 2022 19:29:57 +0200

libpng1.6 (1.6.37-4) unstable; urgency=medium

  * Drop apng support, seems to break chromium ability to open
    apng files (Closes: #1005850).

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Fri, 22 Apr 2022 18:48:37 +0200

libpng1.6 (1.6.37-3) unstable; urgency=medium

  [ Debian Janitor ]
  * Wrap long lines in changelog entries: 1.2.5-5.

  [ Gianfranco Costamagna ]
  * debian/patches/326.patch:
    - add upstream proposed patch to fix a decode fail with invalid eXIf
      chunks (Closes: #969502)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 16 Sep 2020 08:02:32 +0200

libpng1.6 (1.6.37-2) unstable; urgency=medium

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Repository, Repository-
    Browse.
  * Rely on pre-initialized dpkg-architecture variables.
  * Fix day-of-week for changelog entry 1.0.0-0.1.
  * Set upstream metadata fields: Bug-Submit.

  [ Gianfranco Costamagna ]
  * Bump std-version to 4.5.0, no changes required

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Fri, 07 Feb 2020 20:00:13 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libpng-tools`.
