prosody (0.9.12-2+deb9u4) stretch-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Fix regression introduced in last upload.
    Add missing include.

 -- Anton Gladky <gladk@debian.org>  Thu, 17 Jun 2021 16:05:37 +0200

prosody (0.9.12-2+deb9u3) stretch-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Fix CVE-2021-32917: mod_proxy65: Restrict access to local
    c2s connections by default
  * Fix CVE-2021-32921: Use constant-time algorithm for string comparison

 -- Anton Gladky <gladk@debian.org>  Tue, 15 Jun 2021 22:33:37 +0200

prosody (0.9.12-2+deb9u2) stretch-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * mod_c2s: Do not allow the stream 'to' to change across stream restarts
    (CVE-2018-10847) (Closes: #900524)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 31 May 2018 22:08:52 +0200

prosody (0.9.12-2+deb9u1) stretch-security; urgency=medium

  * Add a patch by upstream which fixes prosody crashes in the c2s, s2s and
    component modules (closes: #875829).

 -- Sergei Golovan <sgolovan@debian.org>  Mon, 07 May 2018 14:41:26 +0300

prosody (0.9.12-2) unstable; urgency=medium

  * [01d44c8] fix fails to initiate s2s when lua-event 0.4.3 is installed
    backport fix from https://prosody.im/issues/issue/555
    (Closes: #863475)

 -- Victor Seva <vseva@debian.org>  Wed, 31 May 2017 09:33:41 +0200

prosody (0.9.12-1) unstable; urgency=medium

  * [e840660] New upstream version 0.9.12
  * [5bab192] remove already applied patches
  * [995f758] fix hardening warnings

 -- Victor Seva <vseva@debian.org>  Wed, 11 Jan 2017 09:56:01 +0100

prosody (0.9.11-2) unstable; urgency=medium

  * [c239fbf] fix check incoming certificates valididy (Closes: #846470)

 -- Victor Seva <vseva@debian.org>  Mon, 12 Dec 2016 09:03:29 +0100

prosody (0.9.11-1) unstable; urgency=medium

  * [f27016f] New upstream version 0.9.11
  * [8234bea] add myself to uploaders list
  * [90f1d05] update Standards-Version ( no changes needed )
  * [bf05d9a] fix package-uses-deprecated-debhelper-compat-version.
    wrap-and-sort -sat
  * [77f3d3f] fix vcs-field-uses-insecure-uri
  * [dc46868] fix init.d-script-needs-depends-on-lsb-base
  * [64946c5] fix wildcard-matches-nothing-in-dep5-copyright
    util-src/lsignal.c
  * [d57b350] fix extended-description-is-probably-too-short

 -- Victor Seva <vseva@debian.org>  Fri, 04 Nov 2016 08:53:23 +0100

prosody (0.9.10-1) unstable; urgency=medium

  * New upstream release fixing CVE-2016-0756 and a regression caused by the
    previous fix of CVE-2016-1232.
  * Turn the soft dependency on lua-sec to a hard one because using TLS
    in XMPP is essentially mandatory now (closes: #734678).

 -- Sergei Golovan <sgolovan@debian.org>  Thu, 28 Jan 2016 09:47:26 +0300

prosody (0.9.9-1) unstable; urgency=medium

  * New upstream release fixing CVE-2016-1231 and CVE-2016-1232 

 -- Enrico Tassi <gareuselesinge@debian.org>  Fri, 08 Jan 2016 21:29:20 +0100

prosody (0.9.8-1) unstable; urgency=medium

  * New upstream release.
  * Remove the patch which validates UTF-8 strings before calling libidn
    because it's already applied upstream:
      - 0005-Validate-UTF-8-strings-before-calling-libidn.patch
  * Remove from the package two patches already removed from the patch series:
      - 0005-Disable-LuaExpat-buffering-if-possible.patch
      - 0006-Also-disable-CharacterData-merging-after-stream-rest.patch
  * Do not reload prosody configuration after its log is rotated if the daemon
    is not actually running (closes: #763658).
  * Rename the default snakeoil localhost certificate to localhost.crt to
    match its name in the config file (closes: #748721).
  * Apply upstream patch which fixes CNAME DNS record resolution
    (closes: #787070):
      - 0007-Fix-CNAME-DNS-lookup.patch
  * Remove quilt from the package build dependencies.
  * Bump the standards version to 3.9.6. 

 -- Sergei Golovan <sgolovan@debian.org>  Tue, 02 Jun 2015 18:27:08 +0300

prosody (0.9.7-2) unstable; urgency=high

  * Apply upstream patch to validate UTF-8 strings before calling libidn
    (related to CVE-2015-2059)

 -- Enrico Tassi <gareuselesinge@debian.org>  Sat, 28 Mar 2015 16:20:07 +0100

prosody (0.9.7-1) unstable; urgency=medium

  * New upstream release, really a minor fix over 0.9.6 

 -- Enrico Tassi <gareuselesinge@debian.org>  Sat, 25 Oct 2014 10:42:14 +0200

prosody (0.9.6-1) unstable; urgency=medium

  * New upstream release 
  * Remove patches integrate upstream:
      - 0005-Disable-LuaExpat-buffering-if-possible.patch
      - 0006-Also-disable-CharacterData-merging-after-stream-rest.patch

 -- Enrico Tassi <gareuselesinge@debian.org>  Fri, 24 Oct 2014 22:07:31 +0200

prosody (0.9.4-1) unstable; urgency=high

  * New upstream release
  * Additional patches fixing a DOS:
      - 0005-Disable-LuaExpat-buffering-if-possible.patch
      - 0006-Also-disable-CharacterData-merging-after-stream-rest.patch

 -- Enrico Tassi <gareuselesinge@debian.org>  Sat, 05 Apr 2014 12:53:47 +0200

prosody (0.9.3-1) unstable; urgency=medium

  * New upstream release
  * Fix ejabberd2prosody path (LP: #1109051)
  * Add Provides: xmpp-server (Closes: #737761) 

 -- Enrico Tassi <gareuselesinge@debian.org>  Fri, 14 Mar 2014 16:26:25 +0100

prosody (0.9.2-1) unstable; urgency=medium

  * New upstream release (Closes: #737260)
  * Patches refreshed
  * Copyright rewritten following format 1.0

 -- Enrico Tassi <gareuselesinge@debian.org>  Fri, 10 Jan 2014 18:11:25 +0100

prosody (0.9.1-1) unstable; urgency=low

  * New upstream release including ipv6 support (Closes: #721970, #562161)
  * Packaging moved to git (still collab maint)
  * Add Vcs-* fields to control file
  * Standards-Version bumped to 3.9.4, no changes needed 
  * Add delaycompress to logrotate file (Closes: #718703) 
  * Allow user to override IO/CPU scheduler and nice level using
    /etc/default/prosody, as the upstream does 
  * Fix LSB init info adding $local_fs as a dependency
  * Align package description with the one used by the upstream

 -- Enrico Tassi <gareuselesinge@debian.org>  Fri, 16 Aug 2013 16:18:43 +0200

prosody (0.9.0~rc5-2) unstable; urgency=low

  * Configure prosody using --ostype=debian 
  * New patch to use dpkg-buildflags (activates hardening flags) 

 -- Enrico Tassi <gareuselesinge@debian.org>  Mon, 12 Aug 2013 09:58:27 +0200

prosody (0.9.0~rc5-1) unstable; urgency=low

  * New upstream release candidate

 -- Enrico Tassi <gareuselesinge@debian.org>  Thu, 27 Sep 2012 18:22:53 +0200

prosody (0.8.2-4) unstable; urgency=low

  [ Matthew James Wild ]
  * Fix init script to expect 'lua5.1' as a process name

 -- Enrico Tassi <gareuselesinge@debian.org>  Fri, 29 Jun 2012 20:26:21 +0200

prosody (0.8.2-3) unstable; urgency=low

  * Add patch prosody-lua51.patch to make prosody work even if lua5.2
    is installed

 -- Enrico Tassi <gareuselesinge@debian.org>  Fri, 29 Jun 2012 19:04:46 +0200

prosody (0.8.2-2) unstable; urgency=low

  [ Sergei Golovan ]
  * Switched to the snakeoil SSL certificate for localhost server instead of
    generating a separate one. This moves the responsibility of creating SSL
    certificate and private key to the ssl-cert package (Closes: #638027,
    #645853).
  * Create localhost.cfg.lua symlink in /etc/prosody/conf.d directory in
    postinstallation script and only on a new install to allow the local
    admin removing it completely.
  * Added lua-zlib, lua-dbi-postgresql, lua-dbi-mysql and lua-dbi-sqlite3 to
    the suggested packages list. lua-zlib allows prosody to use XMPP stream
    compression, the others let prosody store its data in an external
    relational database.
  * Bumped standards version to 3.9.3 (no changes needed).

  [ Enrico Tassi ]
  * Fix build dependency using the new Lua packages names

 -- Sergei Golovan <sgolovan@debian.org>  Wed, 16 May 2012 22:07:24 +0400

prosody (0.8.2-1) unstable; urgency=low

  * New upstream bugfix release
  * Fixed ssl cert generation in postinst (Closes: #596433)
  * Bumped standards version to 3.9.2, no changes
  * source format 3.0 (quilt) 

 -- Enrico Tassi <gareuselesinge@debian.org>  Thu, 21 Jul 2011 21:55:57 +0200

prosody (0.8.1-1) unstable; urgency=high

  * New upstream release (Closes: #622638)
  * Depend on lua-expat >= 1.2.0 to fix DoS attack (Closes: #629234)

 -- Enrico Tassi <gareuselesinge@debian.org>  Sat, 04 Jun 2011 18:42:47 +0200

prosody (0.8.0-1) unstable; urgency=low

  [ Matthew James Wild ]
  * New upstream release. (closes: #614175, #620882)
  * Relocate all Prosody modules into /usr/lib/prosody. (closes: #600370)

  [ Enrico Tassi ]
  * Removed prosody.dirs, usr/lib/lua/5.1/util/ not needed
  * Bumped standards version to 3.9.1. no changes needed 
  * Added watch file

 -- Enrico Tassi <gareuselesinge@debian.org>  Mon, 23 May 2011 10:07:42 +0200

prosody (0.7.0-1) unstable; urgency=low

  * New upstream release.
  * Check username and process name along with pidfile before stopping
    prosody daemon (closes: #580185).
  * Strictened dependency on liblua5.1-filesystem0 to versions with fixed
    umask bug in mkdir procedure (closes: #579087).
  * Use an absolute SSL certificate and key paths in config example
    /etc/prosody/conf.avail/example.com.cfg.lua (closes: #581682).
  * Added $syslog dependency to the prosody init script.
  * Added liblua5.1-event0 (which provides support for a large number of
    network connections) to recommended dependencies.
  * Bumped standards version to 3.9.0.

 -- Sergei Golovan <sgolovan@debian.org>  Mon, 05 Jul 2010 20:55:28 +0400

prosody (0.6.2-2) unstable; urgency=low

  * Fixed changing ownership and permissions of the old prosody config
    file (closes: #578837).
  * Added required-stop dependency on $remote_fs for prosody init script
    because it requires /usr/bin/prosody existence to run. Also, removed
    unnecessary dependency on $local_fs.
  * Bumped standards version to 3.8.4.

 -- Sergei Golovan <sgolovan@debian.org>  Sun, 25 Apr 2010 10:37:20 +0400

prosody (0.6.2-1) unstable; urgency=low

  [ Enrico Tassi ]
  * Fixed typo in config file. Thanks  Tollef Fog Heen (Closes: #563795)

  [ Sergei Golovan ]
  * New upstream release.
  * Remove prosody group on package purge.
  * Make /etc/prosody directory readable, so the config filename can be
    completed in case user enters 'sudo vi /etc/prosody/pr<TAB>'. The config
    file itself is world-unreadable now.
  * Don't change ownership and permissions of prosody config, log and
    database directories if they are overridden by dpkg-statoverride.

 -- Sergei Golovan <sgolovan@debian.org>  Sun, 18 Apr 2010 11:57:22 +0400

prosody (0.6.1-1) unstable; urgency=low

  * New upstream release.
  * Replaced no_daemonize option by daemonize in the prosody config file.

 -- Sergei Golovan <sgolovan@debian.org>  Sun, 13 Dec 2009 16:23:07 +0300

prosody (0.5.2-2) unstable; urgency=low

  [ Enrico Tassi ]
  * recommend liblua5.1-sec1 instead of liblua5.1-sec0

 -- Enrico Tassi <gareuselesinge@debian.org>  Tue, 17 Nov 2009 10:11:50 +0100

prosody (0.5.2-1) unstable; urgency=low

  [ Sergei Golovan ]
  * New upstream release.
  * Change log rotating frequency to weekly, compress logs, and create log
    files with adm group instead of prosody and with permissions 640.
  * Added copyright note for util-src/lsignal.c file to debian/copyright
    and reformatted it to fit 80 character lines.
  * Added README.source which explains how to get patched source given the
    pristine source and the series of patches in debian/patches.
  * Bumped standards version to 3.8.3.

  [ Matthew James Wild ]
  * Suppress output of reload during logrotate, avoiding emails from cron.

 -- Sergei Golovan <sgolovan@debian.org>  Wed, 30 Sep 2009 20:44:14 +0400

prosody (0.5.1-1) unstable; urgency=low

  * Initial release (closes: #538130).

 -- Sergei Golovan <sgolovan@debian.org>  Fri, 31 Jul 2009 13:43:15 +0400
