antiword (0.37-18) unstable; urgency=medium
 .
   * debian/patches/fix-write-after-end-of-font-table.patch: Fix write one past
     end of font table array. (Closes: #1144643)
   * debian/patches/check_fonttable_bounds.patch: Add missing checks for
     running off the end of the fonttable. (Closes: #1144645)
   * debian/patches/fix-divide-by-zero.patch: Avoid integer divide by zero.
     (Closes: #1144640)
   * debian/patches/fix-oob-read-properties.patch: Fix OOB read reading
     document properties (Closes: #1008092, #1144641, #1144642)
   * debian/control: Mark conformance with policy 4.7.4.
   * debian/control: Add `Vcs-Browser:` and `Vcs-git:`. (Closes: #1131544)
   * debian/control: Drop `Rules-Requires-Root: no` which is now the default.

aodh (22.0.0-3) unstable; urgency=high
 .
   * CVE-2026-76878 / OSSA-2026-036: Aodh does not correctly enforce project
     scope when the all_projects query parameter is present with a false value.
     A non-admin project reader can list alarms belonging to other projects by
     passing all_projects=false in a list query, optionally combined with a
     foreign project_id to target a specific project. Leaked alarm data includes
     trust webhook URLs, Heat signal endpoints, and project identifiers. Applied
     upstream patch: "Fix all_projects=false bypass project scope"
     (Closes: #1144879).

apt-cacher (1.7.34) unstable; urgency=medium
 .
   * Fix spurious negation operator before $) variable. (Closes: #1143251)
   * d/control: change to debhelper compat 14 and drop obsolete substvars.

autoflake (2.4.0-1) unstable; urgency=medium
 .
   * New upstream release.
   * Update Standards-Version.
   * Update to debhelper compatibility level 14.
   * Add dh-sequence-single-binary.
   * Remove debhelper compat 14 auto-applied substvars.
   * Prefix debhelper files with the binary package name.

babel-minify (0.5.2+dfsg+~cs5.2.9-10) unstable; urgency=medium
 .
   * Team upload
   * Adapt to Babel 8

beancount-periodic (0.2.1-3) unstable; urgency=medium
 .
   * Team upload.
   * Orphan the package. (See #1145555)

binwalk (2.4.3+dfsg1-3) unstable; urgency=medium
 .
   * Team upload.
   * d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179;
     thanks to Fukui Daichi for providing the patch (Closes: #1136010).
   * d/watch: Update it to version 5 format.
   * d/control:
     - Drop 'Priority: optional'.
     - Drop 'Rules-Requires-Root: no'.
     - Bump Standards-Version to 4.7.4.
   * Bump debhelper-compat.
     - d/control:
       - Update debhelper-compat to 14.
       - Drop all ${*:Depends} substvar mentionings.
     - d/docs: Rename it to python3-binwalk.docs.
     - d/examples: Rename it to python3-binwalk.examples.
   * d/copyright: Add packaging copyrights.

bluez (5.87-2) unstable; urgency=high
 .
   * Team upload
   * SECURITY UPDATE: out of bounds read
     - debian/patches/CVE-2026-75032-part1.patch
       debian/patches/CVE-2026-75032-part2.patch
       Fix out-of-bounds read in AVRCP GetFolderItems parsing
       in profiles/audio/avrcp.c
     - CVE-2026-75032 (Closes: #1144961)

borghash (0.2.0-1) unstable; urgency=medium
 .
   * New upstream version 0.2.0

bwidget (1.10.1-5) unstable; urgency=medium
 .
   * Change homepage domain from tcl.tk to tcl-lang.org because the former
     one is no longer available.
   * Switch all URLs from http:// to https://.
   * Depend on libtk instead of tk, simplify debian/rules.
   * Drop the priority field from debian/control.

casync (2+20201210-2.2) unstable; urgency=medium
 .
   * Non-maintainer upload
   * Fix fuse autopkgtest (Closes: #1145291)
casync (2+20201210-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload
   * Drop optional fuse dependency (Closes: #1084456)
casync (2+20201210-2) unstable; urgency=medium
 .
   * Team upload.
   * Bump Standards-Version to 4.6.2, no changes
   * Build-depend on systemd-dev for pkgconfig instead of udev
   * Bump debhelper-compat to 13
   * d/watch: bump to version 4
   * Update upstream/metadata
casync (2+20201210-1) unstable; urgency=medium
 .
   [ Helmut Grohne ]
   * Fix FTCBFS: Annotate sphinx dependency :native (Closes: #983102)
 .
   [ Martin Pitt ]
   * Update to current upstream git snapshot to pick up a few bug fixes.
   * Set Rules-Requires-Root to no
   * Bump Standards-Version to 4.5.1
   * Drop obsolete alternate libssl1.0-dev build dependency (Closes: #917339)
 .
   [ Debian Janitor ]
   * Set upstream metadata fields: Repository.
casync (2+20190213-1) unstable; urgency=medium
 .
   * New upstream version 2+20190213
     - Fixes FTBFS with gcc-9. (Closes: #925647)
casync (2+20180321-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Add upstream fix for FTBFS with glibc 2.28. (Closes: #907409)
casync (2+20180321-2) unstable; urgency=medium
 .
   * Add udev Build-Depends to be able to query udev.pc (Closes: #897597)
casync (2+20180321-1) unstable; urgency=medium
 .
   [ Michael Biebl ]
   * Update Vcs-* to point to https://salsa.debian.org
 .
   [ Martin Pitt ]
   * New upstream version 2+20180321
     - Fixes udev rule installation.
   * debian/copyright: Use https URL in Format:
   * Bump Standards-Version to 4.1.4
casync (2+61.20180112-1) unstable; urgency=medium
 .
   * New upstream version 2+61.20180112
     - Drop patches (applied upstream)
     - Add new libudev dependency
     - Fixes build with glibc 2.26 (Closes: #887692)
casync (2-1) unstable; urgency=medium
 .
   * New upstream version 2
     - Add new build-dependencies zstd and zlib for alternative compressors
   * Remove bogus Closes tag
   * Fix formatting error in casync.rst.
     This error caused a broken manpage
   * Install README and NEWS files
casync (1+92-1) unstable; urgency=medium
 .
   * New upstream version 1+92
     - Includes undefined behavior fixes (Closes: #869136)
   * Drop unused libgrypt-dev build-dependency.
     Upstream moved to openssl
   * Use ninja instead of meson to run tests (Closes: #869531)
casync (1+65-2) unstable; urgency=medium
 .
   * Restrict architecture to linux-any.
     While upstream has indicated it is willing to accept patches for other
     architectures, currently only linux is supported. (Closes: #869134)
   * Run tests in serially instead of in parallel
   * Bump test timeouts to 3 minutes. (Closes: #869140)
casync (1+65-1) unstable; urgency=medium
 .
   * Initial release for debian (Closes: #868980).
     - Import upstream git snapshot
   * Bump debhelper compat to 10, make use of builtin meson support
   * Set pkg-systemd as maintainer, and add myself as uploader
   * Bump standards version
   * Enable compiler hardening features
   * Add gbp config file
   * Add Vcs-* header
   * Add missing Build-Depends on openssl and sphinx
   * Force UTF-8 for building
     - Otherwise sphinx might choke
   * Add an autopkgtest running upstream tests as root

cattle-1.0 (1.4.0-3) unstable; urgency=medium
 .
   * Package relationships
     + Fix all those related to GObject Introspection [Simon McVittie]
       - Follow the best practices outlined in the relevant
         mini-policy. This includes ditching libgirepository1.0-dev,
         which makes the package more multiarch-friendly
       - Closes: #1118795
     + Replace obsolete pkg-config with pkgconf [Simon McVittie]
     + Drop Suggests on devhelp [Jeremy Bícha]
 .
   * Build system
     + Only generate API reference when necessary [Helmut Grohne]
       - In particular, avoid the use of gtk-doc for binary-arch
         builds. This makes it possible to cross-build the package
       - Closes: #1065680
     + Support nodoc build profile
 .
   * Other
     + Update Standards-Version to 4.7.4
       - No changes needed
     + Update watch file to v5 format
     + Update Vcs-* fields
       - Move out of "debian" Salsa namespace

civetweb (1.16+dfsg-5) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Fernando Hueso ]
   * d/rules: Add -DCIVETWEB_ENABLE_X_DOM_SOCKET=ON as requested per
     https://github.com/root-project/root-ci-images/pull/116
   * d/patches: Backport fix for ignored -DCIVETWEB_ENABLE_X_DOM_SOCKET=ON flag
     when using CMake (see https://github.com/civetweb/civetweb/pull/1225)
   * d/rules: Add -DCIVETWEB_ENABLE_ZLIB=ON as requested per
     https://github.com/root-project/root-ci-images/pull/116
     Closes: #1144743
 .
   [ Andreas Tille ]
   * Standards-Version: 4.7.4 (routine-update)
   * Reflow Uploaders field (cme)
   * Drop 'Rules-Requires-Root: no' from d/control (routine-update)

cockpit (366-1) unstable; urgency=medium
 .
   * New upstream release:
     - Networkmanager: Don't activate new network connections by default
     - Networkmanager: Navigate to details page after creation
   * ws: Free "language" string also when it comes from the cookie.
     Patch backported from ustream main. [CVE-2026-76235] (Closes: #1144975)

codespell (2.4.3-2) unstable; urgency=medium
 .
   * Team upload.
   * Skip a few more tests that can't be run at build-time.
   * Copy in codespell_lib/tests/ before running tests (closes: #1144623).
codespell (2.4.3-1) unstable; urgency=medium
 .
   * New upstream release

coq (9.2.0+dfsg-4) unstable; urgency=medium
 .
   * Add libcoq-core-ocaml to coq's Depends
   * Remove Priority and Rules-Requires-Root from debian/control

coq-unicoq (1.6-9.1-4) unstable; urgency=medium
 .
   * Team upload
   * Use OCaml 5.5.0 compatibility patch from upstream PR instead
coq-unicoq (1.6-9.1-3) unstable; urgency=medium
 .
   * Team upload
   * Add a packaged module signature, needed with OCaml 5.5.0
   * Remove Priority and Rules-Requires-Root from debian/control

dadadodo (1.04-10) unstable; urgency=medium
 .
   * QA upload.
   * debian/copyright: Update packaging copyright information.
   * debian/salsa-ci.yml: Add to provide CI tests for Salsa.
   * debian/tests/*: Create autopkgtest.
dadadodo (1.04-9) unstable; urgency=medium
 .
   * QA upload.
 .
   [ Debian Janitor ]
   * Use secure URI in Homepage field.
   * Update standards version to 4.6.1, no changes needed.
dadadodo (1.04-8) unstable; urgency=medium
 .
   * QA upload.
   * debian/control: Update Vcs-* fields.
   * debian/control: Bump Standards-Version to 4.6.0.
   * Bump debhelper compat to v13.
   * debian/copyright: Use secure URI.
dadadodo (1.04-7) unstable; urgency=medium
 .
   * QA upload.
   * Don't sabotage -Wformat (FTBFS, closes: #871166)
   * Bump dh to 10.
dadadodo (1.04-6) unstable; urgency=medium
 .
   * QA upload.
   * debian/copyright:
       - Changed the Sundhackar's email.
       - Removed the unnecessary information on header.
       - Reverted the license for debian/* to original, i.e., the same used
         by upstream up to 1.04-3.1 revision. This action will avoid a conflict
         between upstream code and the packaging.
   * debian/patches/:
       - Added 0005-Fix-Makefile.patch to improve the GCC hardening.
   * debian/rules:
       - Added the DEB_BUILD_MAINT_OPTIONS variable to improve the GCC hardening.
       - Fixed the shebang.
   * Renamed debian/dadadodo.docs to debian/docs.
   * Renamed debian/dadadodo.install to debian/install.
   * Renamed debian/dadadodo.manpages to debian/manpages.
dadadodo (1.04-5) unstable; urgency=medium
 .
   * Orphaning the package.
   * Update the Vcs-* headers to point at collab-maint.
   * Bump Standards-Version to 3.9.6.
   * Update debian/copyright.
dadadodo (1.04-4) unstable; urgency=low

  * New maintainer. (Closes: #660498)
  * Convert to Format: 3.0 (quilt).
  * Bump Standards-Version to 3.9.3.
  * Convert to dh short form and dh-exec.
  * Build with hardening flags enabled.
  * Convert debian/copyright to machine-readable format.
  * Add Homepage & Vcs-* headers.
  * Added debian/watch file.
  * Fixed a buffer overrun when reading large files. (Closes: #657642)

dadadodo (1.04-3) unstable; urgency=low

  * Fix -w option, which was looking at the wrong element of argv and thus
    always setting the width to 0.

dadadodo (1.04-2) unstable; urgency=low

  * Applied fixes from Branden Robinson <branden@debian.org>:
    - Make dadadodo check the COLUMNS environment variable for the terminal
      width before falling back to the hard-coded default of 72.
    - Clean up manpage and document new -w, -columns option.

dadadodo (1.04-1) unstable; urgency=low

  * New upstream release
  * Added patch by Brenton Stone to add -w option. (Closes: #239295)
  * Bumped Standards-Version to 3.6.1


dh-nss (1.7.1) unstable; urgency=medium
 .
   * t/dh_installnss: Fix typo
   * t/Test/DH.pm: Sync with debhelper/13.20
   * t/dh_installnss: Run tests with DH_VERBOSE=1
   * d/control: Drop `Priority: optional`, default as of dpkg-dev 1.22.13
   * d/control: Drop `Rules-Requires-Root: no`, default as of dpkg-dev 1.22.13
   * d/control: Update standards version to 4.7.4
   * d/control: Update email address
   * d/t/control: Depend on locales for locale-gen (Closes: #1144779)
   * d/t/shared-functions: Refresh control file of fake packages

dict-gcide (0.54) unstable; urgency=medium
 .
   * New upstream release 0.54 (revived upstream at git.gnu.org.ua).
   * Build toolchain updates:
     - Preprocess 72-col wrapped dictionary corpus for webfilter/webfmt.
     - Update sedfile for modern 0.54 markup and tags.
     - Update autotools scripts (config.guess, config.sub, configure.in).
     - Fix compiler warnings and missing prototypes in webfilter, webfmt, scan, parse.
     - Update scan.l metadata to GCIDE v.0.54 and modern URLs.
   * Modernize Debian packaging:
     - Maintain as 3.0 (native) format for self-contained toolchain + corpus.
     - Add debian/README.source explaining downstream fork and upstream sync.
     - Bump debhelper compat to 13 (via debhelper-compat) and remove debian/compat.
     - Convert debian/rules to modern dh sequencer.
     - Update debian/copyright to DEP-5 format with complete license blocks.
     - Bump Standards-Version to 4.7.0.
     - Update Homepage and Vcs fields to Salsa.
     - Add debian/watch for upstream GNU releases.
     - Fix lintian maintainer-script-lacks-debhelper-token in postinst/postrm.

dj-database-url (3.1.2-2) unstable; urgency=medium
 .
   * Team Upload
   * python3-uv-build is available, use it
   * Update standards version to 4.7.4, no changes needed.
   * Use dh-sequence-python3
   * Disable useless Salsa CI jobs

documentdb (0.116-0-1) unstable; urgency=medium
 .
   * New upstream version 0.116-0.

dumb-init (1.2.5-3.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Patch-out usage of python3-py (Closes: #1118707)
   * Build using the default build flags (Closes: #1119399)
   * Clean better (Closes: #1044759)
   * Add debian/salsa-ci.yml
   * Drop "Rules-Requires-Root: no": it is the default now
   * Bump Standards-Version to 4.7.4, drop Priority: tag

edbrowse (3.8.18-1) unstable; urgency=medium
 .
   [ Samuel Thibault ]
   * tests/control: Test a bit more.
   * rules: Use buildtools.mk.
   * Bump debhelper from old 12 to 13.
   * copyright: Update.
   * watch: Use version 5 github template.
 .
   [ Paul Gevers ]
   * control: Remove myself from Uploaders.
 .
   [ Jérémy Lal ]
   * Latest edbrowse supports quickjs-ng: build against libquickjs-ng-dev, which
     drops the need to link the engine statically.
   * docs: Install the upstream markdown documentation.
 .
   [ Sebastian Humenda ]
   * new upstream version
   * control: Add Jérémy Lal to Uploaders.
   * control, rules: Drop the Static-Built-Using machinery, unused now that
     quickjs-ng is linked dynamically.
   * rules: Install through upstream's install target, so that the plugin
     config fragments and scripts added in 3.8.16, and emojis.txt, are shipped
     at all; override INSTALLBASE so the install stays inside DESTDIR.
   * docs, examples: Adapt to upstream file renames (FTBFS).
   * patches/plugin-dir-name: Look for the plugin fragments in the directory
     they are installed to.
   * patches/man-page-update: Refresh the Debian man page for 3.8.x.
   * manpages: Document the four plugin helper scripts.
   * edbrowse.alternatives: Register the editor and www-browser alternatives,
     as Policy 11.4 requires of anything providing the editor virtual package.
   * control: Drop the obsolete cmake build dependency, depend on python3 for
     the new chrome plugin, suggest the programs the shipped plugins invoke,
     bump Standards-Version to 4.7.4 and debhelper compat to 14, and drop the
     now redundant Priority and Rules-Requires-Root fields.
   * rules: Keep debug symbols with STRIP= rather than EBDEBUG, which upstream
     asks distributors not to set.
   * copyright: Rewrite; add the missing debian/* stanza, document the third
     party polyfills compiled into every binary, correct the GPL version and
     the common-licenses paths, and follow the replacement of
     esprima/escodegen with js-beautify.
   * tests: Replace the superficial test with offline JavaScript and plugin
     tests, and declare needs-internet on the one that fetches a web page. The
     network test bootstraps the config first, since edbrowse writes a default
     one and exits on first start.
   * salsa-ci.yml: Retry test-uscan; the GitHub API the watch file queries
     answers 504 often enough to fail the pipeline on its own.
   * lintian-overrides: Refresh; the source overrides had stopped matching.
   * Tidy gbp.conf, upstream/metadata and doc-base; replace README.testing
     with a README.source.

elfeed (4.2.0-1) unstable; urgency=medium
 .
   * New upstream release

erofs-utils (1.9.4-1) unstable; urgency=medium
 .
   * New upstream release 1.9.4.

fluidsynth (2.6.0+dfsg-1) unstable; urgency=medium
 .
   [ Dennis Braun ]
   * New upstream version 2.6.0+dfsg
 .
   [ Fabian Greffrath ]
   * Update libfluidsynth3.symbols.in for added symbols
   * Bump to debhelper compat 14
   * Rename debian/docs to debian/fluidsynth.docs

freedombox (26.11.1) unstable; urgency=medium
 .
   [ James Valleroy ]
   * d/tests: Re-arrange test steps to help with debugging
   * doc: Fetch latest manual
 .
   [ Oğuz Ersen ]
   * Translated using Weblate (Turkish)
 .
   [ Hosted Weblate user 54392 ]
   * Translated using Weblate (Chinese (Simplified Han script))
 .
   [ Sunil Mohan Adapa ]
   * apache: Stop installing uwsgi by default (Closes: #1144740)
 .
   [ Dietmar ]
   * Translated using Weblate (German)
freedombox (26.11) unstable; urgency=medium
 .
   [ Burak Yavuz ]
   * Translated using Weblate (Turkish)
 .
   [ Hosted Weblate user 54392 ]
   * Translated using Weblate (Chinese (Simplified Han script))
 .
   [ Jiří Podhorecký ]
   * Translated using Weblate (Czech)
 .
   [ Sunil Mohan Adapa ]
   * homeassistant: App is stable, remove experimental warning
   * d/postinst: Remove unnecessary file
   * tests: Use class methods for class scoped fixtures
   * mypy: Add support for version 2.1
   * settings: Drop support for Django < 4.0
   * pyproject: Declare support for Django 6.0
   * dynamicdns: Drop old migration code shipped in bookworm
   * dynamicdns: Allow updating both IPv4 and IPv6 records together
   * views: Add a separate page for adding new apps
   * firstboot: Link from next steps page to add apps page
   * views: Link to apps-add page from a tag click in app page
 .
   [ Coucouf ]
   * Translated using Weblate (French)
 .
   [ Priit Jõerüüt ]
   * Translated using Weblate (Estonian)
 .
   [ Pierfrancesco Passerini ]
   * Translated using Weblate (Italian)
 .
   [ James Valleroy ]
   * debian: Trim list of Uploaders
   * locale: Update strings for translation
   * doc: Fetch latest manual

open62541 (1.4.18-1) unstable; urgency=medium
 .
   * New upstream release.
   * Add autopkgtests for the upstream CMake test suite, including the
     libcrypt development dependency required by check_server_password.
   * Mark libopen62541-1.4-tools as Multi-Arch: foreign.
   * Keep Debian stack protection enabled for the generated Namespace 0 source.
   * Drop hardened_build.diff, which is included in the upstream release.
   * Mark the retained hardening patch as Forwarded: not-needed.
   * Configure gbp and uscan for the independently versioned nodeset component.
   * Update Standards-Version to 4.7.4 and drop the redundant source Priority
     field.
   * Enable pristine-tar in gbp.
   * Update the watch file to version 5.
   * Replace the obsolete pkg-config test dependency with pkgconf.
   * Update to debhelper compatibility level 14 and remove the redundant
     Rules-Requires-Root field.
   * Audit and consolidate copyright and license information for the complete
     upstream source tree, including bundled third-party files.

python-eventlet (0.40.4-4) unstable; urgency=medium
 .
   * Removed useless setuptools build-depends (Closes: #1140725).
   * Set some build-depends as !nocheck or !nodoc (Closes: #1140726).
python-eventlet (0.40.4-3) unstable; urgency=medium
 .
   * Rebuild source-only.
python-eventlet (0.40.4-2) unstable; urgency=medium
 .
   * Add Breaks: python3-trio (Closes: #1128500).



REMOVED: python-py 1.11.0-6