jinja2 (3.0.3-1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Arbitrary code execution via |attr filter bypass
    - debian/patches/CVE-2025-27516.patch: attr filter uses env.getattr
    - CVE-2025-27516

 -- John Breton <john.breton@canonical.com>  Mon, 10 Mar 2025 12:56:34 -0400

jinja2 (3.0.3-1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: arbitrary code execution issue in jinja compiler
    - debian/patches/CVE-2024-56201.patch: f-string syntax handling in code
      generation improved in src/jinja2/compiler.py.
    - debian/patches/CVE-2024-56326.patch: oversight on calls to str.format
      adjusted in src/jinja2/sandbox.py.
    - CVE-2024-56201
    - CVE-2024-56326

 -- Evan Caville <evan.caville@canonical.com>  Mon, 06 Jan 2025 15:27:20 +1000

jinja2 (3.0.3-1ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Cross-Site scripting in xmlattr filter
    - debian/patches/CVE-2024-34064.patch: disallow invalid characters 
      in keys to xmlattr filter
    - CVE-2024-34064

 -- Nick Galanis <nick.galanis@canonical.com>  Tue, 21 May 2024 13:05:09 +0100

jinja2 (3.0.3-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Cross-Site scripting
    - debian/patches/CVE-2024-22195.patch: disallow keys with spaces
      in src/jinja2/filters.py, tests/test_filters.py.
    - CVE-2024-22195

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Fri, 19 Jan 2024 07:56:33 -0300

jinja2 (3.0.3-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 11 Feb 2022 13:50:47 +0100

jinja2 (3.0.1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 01 Oct 2021 11:22:02 +0200

jinja2 (3.0.1-1) experimental; urgency=medium

  [ Debian Janitor ]
  * Remove constraints unnecessary since stretch:
    + Build-Depends: Drop versioned constraint on python-setuptools.

  [ Thomas Goirand ]
  * Team upload.
  * New upstream release.
  * Ran wrap-and-sort -bastk.
  * Fixed (build-)depends for this release.
  * Killed the python2 package.
  * Rebase patches:
    - re-wrote py3.9-fix-collections-import.patch
    - refreshed 0002-docs-disable-sphinxcontrib.log_cabinet.patch
  * Use debian/jinja.vim instead of the one upstream, gone in this version.

 -- Thomas Goirand <zigo@debian.org>  Fri, 17 Sep 2021 23:25:00 +0200

jinja2 (2.11.3-1) unstable; urgency=medium

  * Team upload.

  [ Ondřej Nový ]
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Debian Janitor ]
  * Apply multi-arch hints.
    + python-jinja2-doc: Add Multi-Arch: foreign.

  [ Sandro Tosi ]
  * Use the new Debian Python Team contact name and address

  [ Hans-Christoph Steiner ]
  * New upstream release

 -- Hans-Christoph Steiner <hans@eds.org>  Mon, 01 Mar 2021 12:05:52 +0100

jinja2 (2.11.2-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 04 Jun 2020 19:31:21 +0200

jinja2 (2.11.1-1) unstable; urgency=medium

  [ Thomas Goirand ]
  * py3.9-fix-collections-import.patch: correctly "except ImportError:"
    everywhere in the patch.

  [ Salman Mohammadi ]
  * d/control: change python-jinja2-doc to recommend python3-jinja2
    (closes: 951672)


  [ Piotr Ożarowski ]
  * New upstream release
  * Add python3-pallets-sphinx-themes and python3-sphinx-issues to Build-Depends
  * Add patch to disable sphinxcontrib.log_cabinet for now as it's not
    packaged in Debian yet (versionadded, versionchanged, deprecated
    directives in changelog will not be used)
  * Move Vim syntax files to python3-jinja2 package
  * Standards-version bumped to 4.5.0 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 02 Apr 2020 13:35:21 +0200

jinja2 (2.10.1-2) unstable; urgency=medium

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.
  * Bump Standards-Version to 4.4.1.

  [ Thomas Goirand ]
  * Team upload.
  * Add py3.9-fix-collections-import.patch (Closes: #949018).

 -- Thomas Goirand <zigo@debian.org>  Thu, 27 Feb 2020 11:49:32 +0100

jinja2 (2.10.1-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/control: Set Vcs-* to salsa.debian.org
  * d/changelog: Remove trailing whitespaces
  * d/control: Remove ancient X-Python-Version field
  * d/control: Remove ancient X-Python3-Version field
  * Convert git repository from git-dpm to gbp layout

  [ Piotr Ożarowski ]
  * New upstream release
  * Standards-version bumped to 4.4.0 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 10 Jul 2019 22:34:15 +0200

jinja2 (2.10-2) unstable; urgency=high

  [ Thomas Goirand ]
  * CVE-2019-10906: In Pallets Jinja before 2.10.1, str.format_map allows a
    sandbox escape. Applied upstream patch: sandbox_str.format_map.patch
    (Closes: #926602).

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 09 Apr 2019 21:58:20 +0200

jinja2 (2.10-1) unstable; urgency=medium

  * New upstream release
  * Add python3-sphinx to Build-Depends and invoke dh_sphinxdoc after building
    documentation
  * Standards-version bumped to 4.1.1
    - -doc package's Priority changed to optional

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 30 Nov 2017 10:54:37 +0100

jinja2 (2.9.6-1) unstable; urgency=medium

  [ Piotr Ożarowski ]
  * New upstream release
  * Install CHANGES file as upstream changelog (closes: 857722)
  * Standards-version bumped to 4.0.0 (no other changes needed)

  [ Michael Hudson-Doyle ]
  * Install asyncsupport.py and asyncfilters.py now that Python 3.6 is a
    supported version (but do not compile them on install with Python 3.5).
    (closes: 862699)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 20 Jun 2017 15:21:18 +0200

jinja2 (2.9.5-1) unstable; urgency=medium

  * New upstream release
    - restores original repr of the internal _GroupTuple which fixes ansible
    (closes: 851741)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 07 Feb 2017 22:27:54 +0100

jinja2 (2.9.4-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * Fixed VCS URL (https)

  [ Piotr Ożarowski ]
  * New upstream release
    - do not install async* files, they require Python >= 3.6
  * Standards-version bumped to 3.9.8 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 10 Jan 2017 20:28:57 +0100

jinja2 (2.8-1) unstable; urgency=medium

  * New upstream release
    - drop jinja2-typos and drop_next_import_from_docs-jinjaext patches - both
      applied upstream
  * rewrite debian/rules to dh sequencer and pybuild buildsystem
  * Standards-version bumped to 3.9.6 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Sat, 01 Aug 2015 14:15:36 +0200

jinja2 (2.7.3-1) unstable; urgency=medium

  * New upstream release
  * Drop fix_CVE-2014-0012.patch (better fix applied upstream)
  * Homepage updated

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 10 Jun 2014 20:44:26 +0200

jinja2 (2.7.2-2) unstable; urgency=high

  * Add fix_CVE-2014-1402 patch which uses tempfile.mkdtemp to create
    cache dir (closes: 734956)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 12 Jan 2014 15:09:04 +0100

jinja2 (2.7.2-1) unstable; urgency=high

  * New upstream release
    - changes default folder for the filesystem cache (closes: 734747,
      CVE-2014-1402)

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 10 Jan 2014 20:56:20 +0100

jinja2 (2.7.1-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 08 Aug 2013 22:25:01 +0200

jinja2 (2.7-3) unstable; urgency=low

  [ Jakub Wilk ]
  * Restore Python 3.2 compatibility (closes: #709638)
  * Fix bunch of typos in the documentation (closes: #679534)

 -- Piotr Ożarowski <piotr@debian.org>  Sat, 25 May 2013 23:07:10 +0200

jinja2 (2.7-2) unstable; urgency=low

  * Relax build dependency on python3-all and hardcode python3-jinja2's
    Depends and postinst maintainer script (temporary fix, closes: #709390)

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 23 May 2013 18:42:20 +0200

jinja2 (2.7-1) unstable; urgency=low

  [ Jakub Wilk ]
  * Use canonical URIs for Vcs-* fields.

  [ Piotr Ożarowski ]
  * New upstream release
    - minimum required Python version bumped to 2.6 and 3.3
  * debugsupport extension no longer available, Architecture changed to "all"
  * Bump minimum required python3-all version in Build-Depends (to generate
    versioned py3compile -V in maintainer script)
  * Add patches/drop_next_import_from_docs-jinjaext.patch to fix building docs
  * Use dh_sphinxdoc to handle JavaScript libraries used in -doc package
  * Standards-Version bumped to 3.9.4
    - add build-arch and build-indep targets
  * debian/compat changed to 9

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 20 May 2013 21:15:37 +0200

jinja2 (2.6-1) unstable; urgency=low

  * New upstream release
  * add_version_placeholder patch removed (no longer needed)
  * htmljinja.vim is no longer available, use jinja.vim instead
  * python3-jinja2 suggests python-jinja2-doc instead of python3-jinja2-doc
  * Standards-version bumped to 3.9.2 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 25 Jul 2011 10:31:24 +0200

jinja2 (2.5.5-5) unstable; urgency=low

  * Drop hardcoded python3.1 from Depends (closes: #621816)
  * Do not compress objects.inv file (closes: #608757)

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 15 Apr 2011 22:05:53 +0200

jinja2 (2.5.5-4) unstable; urgency=low

  * Upload to unstable (closes: 621001)
  * Lower versions of build dependencies (to the ones from 2.5.5-1)
  * Convert from dh_pysupport to dh_python2
  * Change source format to 3.0 (quilt), drop quilt build dependency

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 05 Apr 2011 23:21:21 +0200

jinja2 (2.5.5-3) experimental; urgency=low

  * Bump minimum required python-support version to the one in experimental
    to get Python 2.7 support (closes: 608149)

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 27 Dec 2010 23:15:04 +0100

jinja2 (2.5.5-2) experimental; urgency=low

  * Rebuild for Python 2.7 and 3.2 extension (minimum required python-all's
    version temporary bumped to 2.6.6-4, python-setuptools' to 0.6.14-5
    and python3-all's to 3.1.2-14 to make sure the right version from
    experimental will be used). Closes: 607450.
  * Update debian/rules to handle Python >= 3.2

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 21 Dec 2010 20:58:19 +0100

jinja2 (2.5.5-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 19 Oct 2010 08:34:49 +0200

jinja2 (2.5.4-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 17 Oct 2010 20:48:21 +0200

jinja2 (2.5.2-3) unstable; urgency=low

  * Rebuild against newer python3-all-dev package (python3.1 now uses
    /usr/lib/python3/), minimum python3-all version bumped to 3.1.2-10
  * Use python3's python.mk
  * Drop python3-jinja2.{postinst,prerm} maintainer scripts, dh_python3 will
    generate them

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 26 Sep 2010 21:19:54 +0200

jinja2 (2.5.2-2) unstable; urgency=low

  * Really remove _markupsafe

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 19 Aug 2010 09:24:47 +0200

jinja2 (2.5.2-1) unstable; urgency=low

  * New upstream release
    - speedups module moved to separate package: MarkupSafe
  * python-markupsafe added to Depends (jinja2._markupsafe removed from the
    package)
  * debian/control: python3-jinja2 binary package updated to latest changes in
    dh_python3
  * Standards-version bumped to 3.9.1 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 18 Aug 2010 11:29:44 +0200

jinja2 (2.5-1) unstable; urgency=low

  * New upstream release
  * python3_builtins.patch removed, no longer needed
  * add python3.1 to python3-jinja2's Depends

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 30 May 2010 11:01:51 +0200

jinja2 (2.4.1-1) unstable; urgency=low

  * New upstream release
  * Add python3_builtins.patch taken from upstream repo (Different name for
    builtins in Python 3)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 20 Apr 2010 19:51:16 +0200

jinja2 (2.4-3) unstable; urgency=low

  * Add missing maintainer scripts in python3-jinja2 package

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 18 Apr 2010 17:15:49 +0200

jinja2 (2.4-2) unstable; urgency=low

  * Add Python 3 support, new binary packages:
    python3-jinja2 and python3-jinja2-dbg

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 13 Apr 2010 20:44:43 +0200

jinja2 (2.4-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 13 Apr 2010 19:52:05 +0200

jinja2 (2.3.1-1) unstable; urgency=low

  * New upstream release
  * Move python-pybabel from Recommends to Enhances

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 19 Feb 2010 18:31:52 +0100

jinja2 (2.3-1) unstable; urgency=low

  * New upstream release
  * Hardcode __version__ at build time, no need to use pkg_resources
    (Closes: #548062)
  * Standards-version bumped to 3.8.4 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 10 Feb 2010 22:06:28 +0100

jinja2 (2.2.1-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 15 Sep 2009 19:38:47 +0200

jinja2 (2.2-1) unstable; urgency=low

  [ Jakub Wilk ]
  * Build depend on Sphinx >= 0.6 (due to changes_for_sphinx_0.6 patch)

  [ Piotr Ożarowski ]
  * New upstream release (Closes: #536227)
  * No longer needed patches:
    - changes_for_sphinx_0.6.patch
    - dont_install_docs_via_setup_py.patch
  * pass --with-speedups to setup.py (building extension is now disabled by
    default in upstream code)
  * debian/copyright file updated
  * Standards-version bumped to 3.8.3 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 13 Sep 2009 16:44:18 +0200

jinja2 (2.1.1-3) unstable; urgency=low

  * Documentation builds fine with new Sphinx now, thanks to
    Jakub Wilk for the patch (Closes: #527486)
  * Standards-version bumped to 3.8.2:
    - python-jinja2-dbg's section changed to debug
  * Support /usr/local/*/dist-packages in debian/rules (python2.6 will need it)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 08 Jul 2009 21:40:46 +0200

jinja2 (2.1.1-2) unstable; urgency=low

  * Install Vim syntax files in /usr/share/vim/addons/syntax/
    Use `vim-addons install jinja` to enable it (Closes: 514046)
  * Upload to unstable

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 10 Feb 2009 19:59:56 +0100

jinja2 (2.1.1-1) experimental; urgency=low

  * New upstream release
  * Build depend on Sphinx >= 0.5.1
    + remove_non_ascii_char patch removed

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 25 Dec 2008 19:10:36 +0100

jinja2 (2.1-1) experimental; urgency=low

  [ Sandro Tosi ]
  * Switch Vcs-Browser field to viewsvn

  [ Piotr Ożarowski ]
  * New upstream release
  * Bump required python-sphinx version to >= 0.5 (needed to build docs)
    + upload to experimental (Sphinx 0.5 is in experimental for now)
  * Add remove_non_ascii_char patch (to workaround docutils/Sphinx bug)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 30 Nov 2008 20:14:33 +0100

jinja2 (2.0-2) unstable; urgency=low

  * Recommend python-pybabel instead of python-babel (Closes: #501725)

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 09 Oct 2008 22:43:11 +0200

jinja2 (2.0-1) unstable; urgency=low

  * Initial release (this package is an successor of jinja package)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 20 Jul 2008 23:01:02 +0200
