commons-io (2.5-1+deb9u1) stretch-security; urgency=high

  * Team upload.
  * Fix CVE-2021-29425:
    When invoking the method FileNameUtils.normalize with an improper input
    string, like "//../foo", or "\\..\foo", the result would be the same
    value, thus possibly providing access to files in the parent directory,
    but not further above (thus "limited" path traversal), if the calling code
    would use the result to construct a path value.
  * Ignore the test failures because the code works correct. (manually tested)

 -- Markus Koschany <apo@debian.org>  Thu, 12 Aug 2021 21:29:09 +0200

commons-io (2.5-1) unstable; urgency=medium

  [ Kumar Appaiah ]
  * debian/control:
    + Remove Kumar Appaiah from uploaders

  [ Emmanuel Bourg ]
  * New upstream release
  * Build with maven-debian-helper instead of Ant
  * Changed the install path of the API documentation
    to /usr/share/doc/libcommons-io-java
  * Install the upstream changelog
  * Moved the package to Git
  * Standards-Version updated to 3.9.8 (no changes)
  * Converted debian/copyright to the Copyright Format 1.0
  * Use XZ compression for the upstream tarball
  * Switch to debhelper level 9

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 26 Apr 2016 12:49:10 +0200

commons-io (2.4-2) unstable; urgency=low

  * Team upload.
  * Upload to unstable.

 -- tony mancill <tmancill@debian.org>  Sat, 18 May 2013 10:40:54 -0700

commons-io (2.4-1) experimental; urgency=low

  * Team upload
  * New upstream release (Closes: #623368)
  * Bump Standards-Version to 3.9.4 (no changes)
  * Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 28 Mar 2013 17:43:17 +0100

commons-io (1.4-4) unstable; urgency=low

  * Add OSGi metadata to jar manifest
  * Update Standards-Version: 3.9.2
  * Bump up debhelper to 8

 -- Jakub Adam <jakub.adam@ktknet.cz>  Sun, 16 Oct 2011 22:58:29 +0200

commons-io (1.4-3) unstable; urgency=low

  * Team upload
  * Remove Arnaud and Trygve from uploaders list.
  * Switch to source format 3.0.
  * Update Standards-Version: 3.8.4.

 -- Torsten Werner <twerner@debian.org>  Mon, 03 May 2010 19:43:18 +0200

commons-io (1.4-2) unstable; urgency=low

  * Upload to unstable.

 -- Torsten Werner <twerner@debian.org>  Sun, 09 Aug 2009 10:45:25 +0200

commons-io (1.4-1.1) experimental; urgency=low

  * Non-maintainer upload.
  * Change section to java, bump up Standards-Version to 3.8.1
  * Bump up debhelper to 6
  * Add the Maven POM to the package
  * Add a Build-Depends-Indep dependency on maven-repo-helper
  * Use mh_installpom and mh_installjar to install the POM and the jar to the
    Maven repository
  * Change the build dependency on java-gcj to default-jdk
  * Add ${misc:Depends} to Depends to clear Lintian warnings
  * Remove Depends on Java runtimes as it is a library

  [ Emmanuel Bourg and Sylvestre Ledru]
  * Update of the URLs
  * Rename Jakarta Commons to Apache Commons

 -- Ludovic Claude <ludovic.claude@laposte.net>  Thu, 02 Jul 2009 23:28:09 +0100

commons-io (1.4-1) unstable; urgency=low

  * New upstream release
  * Bump Standards-Version to 3.7.3
  * Bump up debhelper compat to 6
  * Replace XS-Vcs headers with Vcs
  * debian/patches:
    - remove 01_no_ext_links.dpatch - not required
    - remove 02_no_mkdir_in_homedir.dpatch - not required
  * Remove dpatch from Build-Depends
  * Update debian/rules and debian/libcommons-io-java-doc.install
    with new target dirs
  * debian/copyright: add copyright notice

 -- Varun Hiremath <varun@debian.org>  Thu, 21 Feb 2008 13:26:43 +0530

commons-io (1.3.2-2) unstable; urgency=low

  * debian/patches: Add 02_no_mkdir_in_homedir.dpatch to stop creating
    .maven directory in user homedir (Closes: #445804)

 -- Varun Hiremath <varunhiremath@gmail.com>  Mon, 08 Oct 2007 18:40:07 +0530

commons-io (1.3.2-1) unstable; urgency=low

  [ Kumar Appaiah ]
  * Update watch file.
  * debian/control:
    + Add XS-Vcs-Svn, XS-Vcs-Browser
    + Add Homepage field.
    + Fix Build-Depends-Indep to depend only on ant-optional and not ant.
    + libcommons-io-java suggests the doc package and vice-versa.
  
  [ Varun Hiremath ]
  * New upstream release
  * debian/control:
    + add myself and Kumar Appaiah to Uploaders.
    + move cdbs and debhelper to Build-Depends.
    + add dpatch to Build-Depends.
    + modify Description.
    + add a separate doc package.
  * debian/compat: switch to 5
  * remove unnecessary links and dirs files from debian dir.
  * debian/rules:
    + build javadoc
    + create a versioned symbolic link to the jar.
    + implement get-orig-source
  * Add debian/orig-tar.sh to remove CRLF line terminators from upstream files.
  * Add debian/libcommons-io-java-doc.doc-base and
    debian/libcommons-io-java-doc.install to install the docs.
  * Update debian/watch to call debian/orig-tar.sh
  * debian/patches:
    + remove old patches which are no longer required.
    + add a patch to remove external links from build.xml
  * Remove debian/README.Debian - not required.

 -- Kumar Appaiah <akumar@ee.iitm.ac.in>  Fri, 21 Sep 2007 17:14:03 +0530

commons-io (1.3.1.dfsg.1-1) unstable; urgency=low

  * New upstream (closes: #418973)
  * java-gcj-compat-dev and cdbs transition
  * Removed junit at the moment (closes: #397567)
  * No javadoc at the moment

 -- Arnaud Vandyck <avdyk@debian.org>  Fri, 13 Apr 2007 08:20:49 +0200

commons-io (1.0-3) unstable; urgency=low

  * kaffe compiler transition

 -- Wolfgang Baer <WBaer@gmx.de>  Sun, 15 Jan 2006 18:12:06 +0100

commons-io (1.0-2) unstable; urgency=low

  * Added ant-optional to build-deps - fixes FTBS (closes: #332564)
  * Added myself to uploaders
  * Removed classpath, libgcj6 from build-deps - not needed

 -- Wolfgang Baer <WBaer@gmx.de>  Sun, 16 Oct 2005 13:44:21 +0200

commons-io (1.0-1) unstable; urgency=low

  * Initial Release (closes: #321475).

 -- Trygve Laugstøl <trygvis@inamo.no>  Tue,  2 Aug 2005 07:12:24 +0200
