python-urllib3 (1.26.12-1+deb12u4) bookworm-security; urgency=high

  * Non-maintainer upload by the LTS Team.
  * Fix CVE-2026-44431: Sensitive headers forwarded across origins in proxied
    low-level redirects. (Closes: #1136653)

 -- Guilhem Moulin <guilhem@debian.org>  Fri, 26 Jun 2026 07:01:27 +0200

python-urllib3 (1.26.12-1+deb12u3) bookworm-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * Prevent issue in HTTPResponse().read() when decoded_content is True and then
    False Provided it has initialized eligible decoder(decompressor) and did
    decode once (Closes: #1126002)
  * fix missed coverage when calling read() having amt=None
  * tests: Change expectations as the initial payload changed

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 20 Jan 2026 22:34:53 +0100

python-urllib3 (1.26.12-1+deb12u2) bookworm-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * Redirects are not disabled when retries are disabled on PoolManager
    instantiation (CVE-2025-50181) (Closes: #1108076)
  * Unbounded number of links in the decompression chain (CVE-2025-66418)
    (Closes: #1122030)
  * Decompression-bomb safeguards bypassed when following HTTP redirects
    (streaming API) (CVE-2026-21441) (Closes: #1125062)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 12 Jan 2026 22:53:55 +0100

python-urllib3 (1.26.12-1+deb12u1) bookworm; urgency=medium

  * Non-maintainer upload.
  * Fix CVE-2023-43804: Cookie request header isn't stripped during
    cross-origin redirects. (Closes: #1053626)
  * Fix CVE-2023-45803: Request body not stripped after redirect from 303
    status changes request method to GET. (Closes: #1054226)
  * Fix CVE-2024-37891: Proxy-Authorization request header isn't stripped
    during cross-origin redirects. (Closes: #1074149)
  * Use system 'six' module in urllib3.util.ssltransport. (Closes: #1089507)
  * Fix test/test_connectionpool.py (currently ignored).
  * Adjust d/salsa-ci.yml for bookworm.
  * Adjust d/gbp.conf for bookworm.

 -- Guilhem Moulin <guilhem@debian.org>  Sat, 21 Dec 2024 15:28:17 +0100

python-urllib3 (1.26.12-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.26.12
  * Bump Standards-Version to 4.6.1 (no change)
  * Refresh patches

 -- Anthony Fok <foka@debian.org>  Thu, 22 Sep 2022 15:14:17 -0600

python-urllib3 (1.26.9-1) unstable; urgency=medium

  * New upstream version 1.26.9
  * Refresh patches.
  * Add python3-brotli to B-D, Suggests and autopkgtest's Depends.

 -- Daniele Tricoli <eriol@debian.org>  Sat, 19 Mar 2022 01:35:39 +0100

python-urllib3 (1.26.8-1) unstable; urgency=medium

  [ Jenkins ]
  * Remove constraints unnecessary since stretch

  [ Daniele Tricoli ]
  * New upstream release.
  * Refresh patches.
  * Enable salsa pipelines.
  * Enable autopkgtest tests.
  * debian/control
    - Update standards version to 4.6.0, no changes needed.
  * debian/copyright
    - Update copyright years.

 -- Daniele Tricoli <eriol@debian.org>  Mon, 14 Mar 2022 01:12:18 +0100

python-urllib3 (1.26.5-1~exp1) unstable; urgency=medium

  * New upstream version 1.26.5
    - CVE-2021-33503: Catastrophic backtracking in URL authority parser when
      passed URL containing many @ characters. (Closes: #989848)
  * Refresh patches.

 -- Daniele Tricoli <eriol@debian.org>  Sun, 27 Jun 2021 17:02:18 +0200

python-urllib3 (1.26.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - Enforces certificate validation in some cases involving HTTPS to HTTPS
      proxies CVE-2021-28363.

 -- Stefano Rivera <stefanor@debian.org>  Tue, 11 May 2021 20:30:00 -0400

python-urllib3 (1.26.2-1) unstable; urgency=medium

  * New upstream version 1.26.2
  * Refresh patches.
  * debian/control
    - Bump debhelper compatibility level to 13.
    - Bump Standards-Version to 4.5.1 (no changes needed).
  * debian/copyright
    - Update copyright years.
  * debian/rules
    - Ignore test_ssltransport.py.
  * debian/watch
    - Bump version to 4.

 -- Daniele Tricoli <eriol@debian.org>  Thu, 31 Dec 2020 02:22:32 +0100

python-urllib3 (1.25.11-1) unstable; urgency=medium

  * Team upload.

  [ Ondřej Nový ]
  * d/control: Update Maintainer field with new Debian Python Team
    contact address.
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Dmitry Shachnev ]
  * New upstream release.
  * Refresh patches for the new release.
  * Skip test_respect_retry_after_header_sleep test.
    It needs pytest-freezegun module which is not packaged in Debian yet.

 -- Dmitry Shachnev <mitya57@debian.org>  Sat, 14 Nov 2020 15:40:30 +0300

python-urllib3 (1.25.9-1) unstable; urgency=medium

  * Team upload
  * New upstream release
    - Refresh patches

 -- Scott Kitterman <scott@kitterman.com>  Sat, 02 May 2020 13:14:11 -0400

python-urllib3 (1.25.8-2) unstable; urgency=medium

  * Drop python2 support; Closes: #938244
  * debian/control
    - bump versioned b-d on six to >= 1.12.0 (the same version of the embedded
      module); Closes: #950738

 -- Sandro Tosi <morph@debian.org>  Wed, 01 Apr 2020 11:35:50 -0400

python-urllib3 (1.25.8-1) unstable; urgency=medium

  * Team upload.

  [ Debian Janitor ]
  * Use secure URI in Homepage field.
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Håvard Flaget Aasen ]
  * New upstream version 1.25.8
  * Rebase patches.
  * Update Standards-Version to 4.5.0
  * Remove python-nose and python3-nose from build-dependency.
  * Add Rules-Requires-Root: no
  * Remove test/conftest.py during build.

 -- Håvard Flaget Aasen <haavard_aasen@yahoo.no>  Sat, 25 Jan 2020 15:56:27 +0100

python-urllib3 (1.25.6-5) unstable; urgency=medium

  * Team upload.
  * debian/control
    - remove psutil from b-d, nothing in urllib3 uses that module

 -- Sandro Tosi <morph@debian.org>  Thu, 09 Jan 2020 20:45:05 -0500

python-urllib3 (1.25.6-4) unstable; urgency=medium

  * Upload to unstable (Closes: #945883)

 -- Daniele Tricoli <eriol@debian.org>  Thu, 05 Dec 2019 01:11:15 +0100

python-urllib3 (1.25.6-3) experimental; urgency=medium

  * debian/rules
    - Export LC_ALL=C.UTF-8 to build tests also using pbuilder.
      Thanks to Andreas Beckmann for the report and suggestion.
      (Closes: #945450)

 -- Daniele Tricoli <eriol@debian.org>  Mon, 02 Dec 2019 23:20:06 +0100

python-urllib3 (1.25.6-2) experimental; urgency=medium

  * debian/control
    - Add python{,3}-idna to B-D. (Closes: #943510)

 -- Daniele Tricoli <eriol@debian.org>  Sun, 27 Oct 2019 14:28:10 +0100

python-urllib3 (1.25.6-1) experimental; urgency=medium

  * Team upload.

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.
  * Bump Standards-Version to 4.4.0.

  [ Drew Parsons ]
  * New upstream release.
    - fixes CVE-2019-11236 CRLF injection vulnerability.
      Closes: #927172.
  * Standards-Version: 4.4.1
  * debhelper compatibility level 12

 -- Drew Parsons <dparsons@debian.org>  Sat, 12 Oct 2019 11:50:26 +0800

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python3-urllib3`.
