resteasy3.0 (3.0.26-6ubuntu0.24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: Several vulnerabilities and information disclosures
    - CVE-2021-20289.patch: Endpoint information unexpectedly disclosed
    - CVE-2023-0482.patch: Temporary files created with insecure permissions
    - CVE-2024-9622.patch: Denial of service through failed http decoder state
    - switch-to-java-8.patch: Allows using newer languages futures in patches
    - pre-CVE-2020-25633.patch: Ajustments to CVE-2020-25633 backport
    - CVE-2020-25633.patch: Server information disclosure during exception

 -- Noam Nedelec-Salmon <noam.nedelecsalmon@canonical.com>  Mon, 07 Jul 2025 13:24:41 +0200

resteasy3.0 (3.0.26-6) unstable; urgency=medium

  * Team upload.
  * Depend on libservlet-api-java and libel-api-java instead of libtomcat9-java
    (Closes: #1033366)

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 14 May 2023 19:12:25 +0200

resteasy3.0 (3.0.26-5) unstable; urgency=medium

  * patches: Replace javax/activation with jakarta/activation, fixes noise
    in dogtag logs.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 22 Feb 2023 22:26:21 +0200

resteasy3.0 (3.0.26-4) unstable; urgency=medium

  * patches: Drop Log4jLogger. (Closes: #1028854)
  * Drop all modules that dogtag-pki doesn't need.
  * RESTEASY-2519-fix-CVE-2020-10688.diff: Fix an XSS flaw. (Closes:
    #1015001)
    - CVE-2020-10688
  * Restore activation api, add libjakarta-activation-java to build-
    depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 21 Jan 2023 11:55:52 +0200

resteasy3.0 (3.0.26-3) unstable; urgency=medium

  * Drop dependency on liblog4j1.2-java, and fix classpath to use
    tomcat9-el-api.jar.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 20 Oct 2021 00:57:18 +0300

resteasy3.0 (3.0.26-2) unstable; urgency=medium

  * control, maven.rules: Use tomcat for servlet & el-api, add
    libtomcat9-java to build-depends.
  * control: Migrate to debhelper-compat, bump to 12.
  * control: Bump policy to 4.5.1.
  * CVE-2020-1695: Improper validation of response header in
    MediaTypeHeaderDelegate.java class

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Dec 2020 14:51:28 +0200

resteasy3.0 (3.0.26-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2017-7561 (Closes: #908836)
    - update maven.rules & ignoreRules
    - update libresteasy3.0-java.poms
    - drop 01-ignore-tjws.patch and 02-servlet-api-compatibility.patch
    - refresh other patches
  * Replace build-dep on libtomcat8-java with
    libgeronimo-annotation-1.3-spec-java.
  * Drop libscannotation-java from build-depends and classpath, it got
    removed in 3.0.7.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 05 Dec 2018 19:10:51 +0200

resteasy3.0 (3.0.19-5) unstable; urgency=medium

  * control, jaxb-api-compatibility.diff: Fix build, add libjaxb-api-java to
    build-depends. (Closes: #912395)
  * Enable jackson2 provider.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 04 Dec 2018 14:13:02 +0200

resteasy3.0 (3.0.19-4) unstable; urgency=medium

  * classpath: Updated, drop slf4j-simple.jar, fix snakeyml and annotations-api
    jars, use el-api-3.0.jar.
  * control: Add liblog4j1.2-java to depends.
  * control: Update vcs urls.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Oct 2018 15:15:13 +0300

resteasy3.0 (3.0.19-2) unstable; urgency=medium

  * Team upload.
  * Fixed the build failure with jaxrs-api 2.1
  * Removed the build dependency on glassfish-javaee

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 14 Dec 2017 17:43:45 +0100

resteasy3.0 (3.0.19-1) unstable; urgency=medium

  * Initial packaging. (Closes: #876161)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 19 Sep 2017 12:06:03 +0300

resteasy (3.0.19-3) unstable; urgency=medium

  * Team upload.
  * Removed servlet-api-2.5.jar from the Class-Path attribute in the manifests
    (Closes: #850700)
  * Switch to debhelper level 10

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 10 Jan 2017 12:56:01 +0100

resteasy (3.0.19-2) unstable; urgency=medium

  * Team upload.
  * Ignore the dependency on javax.activation (Closes: #839345)

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 02 Oct 2016 00:42:56 +0200

resteasy (3.0.19-1) unstable; urgency=medium

  * Team upload.
  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 09 Sep 2016 22:24:31 +0200

resteasy (3.0.18-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Replaced revert-to-jsr250-api.diff with a Maven rule
    - No longer build the removed jaxrs-api module and depend
      on libjaxrs-api-java instead
    - Ignore the jboss-parent pom
    - Ignore the new resteasy-wadl module
    - Ignore the now enabled arquillian module
    - New dependencies on libjboss-logging-java and libjboss-logging-tools-java
    - Refreshed debian/copyright
  * No longer build the unused tjws module (Closes: #830819)
  * Fixed the compilation errors with the Servlet API 3.1
  * Updated debian/watch to track the releases >= 3.0.18

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 20 Jul 2016 13:48:54 +0200

resteasy (3.0.12-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Updated the Maven rules
  * Fixed the Maven rule for snakeyaml (Closes: #821158)
  * Build with the DH sequencer instead of CDBS
  * Standards-Version updated to 3.9.8 (no changes)
  * Use secure Vcs-* URLs

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 16 Apr 2016 23:14:31 +0200

resteasy (3.0.6-3) unstable; urgency=medium

  * Team upload.
  * Removed the build dependencies on glassfish-activation
    and libservlet2.5-java
  * Build depend on libtomcat8-java instead of libtomcat7-java

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 31 Jul 2015 16:03:37 +0200

resteasy (3.0.6-2) unstable; urgency=high

  * Team upload.
  * Fix CVE-2014-7839: External entities expanded by DocumentProvider
    (Closes: #770544)
  * Standards-Version updated to 3.9.6 (no changes)

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Nov 2014 23:36:45 +0100

resteasy (3.0.6-1) unstable; urgency=medium

  * Team upload.
  * revert-to-jsr250-api.diff: Revert a commit to fix build.
  * libresteasy-java.poms: Ignore json-p-ee7 and resteasy-servlet-
    initializer.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 17 Oct 2014 18:29:12 +0300

resteasy (3.0.1-1) unstable; urgency=medium

  * Initial release (Closes: #734734)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 04 Sep 2014 22:59:53 +0300
