apertium-br-fr (0.5.1-2) unstable; urgency=medium
 .
   * Team Upload
   * Rewrite d/watch in v5 format
   * Drop 'Rules-Requires-Root: no': it is the default now
   * Replace obsolete pkg-config with pkgconf
   * Fix Team name
   * Bump S.V. to 4.7.4 & drop Priority: tag
   * Rename debian/docs for future debhelper 14 compatibility
   * d/rules: --fail-missing is the default now

chasquid (1.19.0-1) unstable; urgency=medium
 .
   * New upstream release (1.19.0)
   * patch: Workaround to use GODEBUG defaults from Go 1.26
   * debhelper: Update to 14
   * Require golang-blitiri-go-spf-dev >= 1.6.0

cookidoo-api (0.19.0-1) unstable; urgency=medium
 .
   * New upstream release.
   * Add python3-firebase-messaging dependency.

createrepo-c (1.2.1-3) unstable; urgency=medium
 .
   [ Peter Pentchev ]
   * Team upload.
   * Declare compliance with Policy 4.7.4 with no changes.
   * Switch back to debhelper-compat now that debhelper 14 is out.
   * Salsa CI:
     - drop the build-twice job, debrebuild does that now
     - run the `debputy reformat` test here, not as an autopkgtest
     - also test the nocheck build profile
   * Remove myself from the Uploaders list; thanks, Federico Molara, for
     taking over this package, too.
 .
   [ Federico Molara ]
   * Adopt the package within the RPM packaging team and add myself to
     Uploaders. Closes: #1143591
   * Build the upstream C test executables before running the test suite.
   * Fix the library directory in pkg-config metadata so C consumers link
     successfully.
   * Add an autopkgtest that compiles, links and runs a C library consumer.
   * Backport the upstream Python test runner shebang fix to prevent a
     build failure with libuv 1.53.0. Closes: #1151137

exim4 (4.100.1-4) unstable; urgency=medium
 .
   * Cherry-pick another round of upstream fixes.

gnulib (20260704-3) unstable; urgency=medium
 .
   * Replace debian/clscan with debian/copyright-gen, which generates
     debian/copyright from the license notices in the source tree.
   * debian/copyright: Regenerate; document the history in gnulib.bundle.
   * debian/copyright-gen/manual.dep5: Record the FSFAP license and
     copyright notice at the end of doc/install.texi.

golang-blitiri-go-spf (1.6.0-1) unstable; urgency=medium
 .
   * New upstream release (1.6.0)
   * debian/watch: Update to version 5
   * Drop Priority and Rules-Requires-Root, as per new policy
   * debhelper-compat 14 and Standards-Version 4.7.4
   * Add upstream metadata file
   * Remove now-unnecessary Depends (after debhelper >=14)

grout (0.19.3-1) unstable; urgency=medium
 .
   * New upstream release

jellyfish (2.3.1-7) unstable; urgency=medium
 .
   [ Maximiliano Curia ]
   * Fix key claim tracking during hash resizing on carry overflow
     Closes: #1148450
 .
   [ Andreas Tille ]
   * Standards-Version: 4.7.4 (routine-update)
   * Reflow Uploaders field (cme)
   * Remove Priority field (cme)
   * Apply multi-arch hints.
     + libjellyfish-2.0-dev: Add Multi-Arch: same.
   * Fix FTBFS with make --shuffle=reverse
     Closes: #1105388

libplack-perl (1.0055-1) unstable; urgency=medium
 .
   * Import upstream version 1.0055.
     - Fix memory leak of every request env in Plack::Middleware::Recursive
       (CVE-2026-110333)
     - Plack::Request::Upload->basename never returns '', '.' or '..'
       (CVE-2026-110332)
     - Plack::App::URLMap matches SERVER_PORT literally when stripping it from
       Host (CVE-2026-110335)
     - Plack::Middleware::ErrorDocument restores the env after a subrequest, so
       outer middleware such as AccessLog sees the original request
       (CVE-2026-110334)
     - Document that Plack::Handler::FCGI and Apache2 keep dot segments in
       PATH_INFO and warn against relying on front-server path-based access
       control (CVE-2026-110336)
     Closes: #1151241

libuv1 (1.53.0-1) unstable; urgency=medium
 .
   * New upstream version 1.53.0
   * dh-exec not needed
   * Update symbols
   * Upstream patch, closes: #1149904.
   * Standards-Version bump
   * Build-Depends python3-sphinx-copybutton for doc.
   * Use lrc, simplify a bit copyright

luksmeta (10-2) unstable; urgency=high
 .
   * Cherry-pick "fix gap allocator bounds checking".
     Closes: #1151196 [CVE-2026-111555]

matplotlib (3.10.9+dfsg1-2) unstable; urgency=medium
 .
   * Mark even move packages as <!nocheck>:
     python3-cairocffi, python3-cycler, python3-pil, python3-kiwisolver
   * d/rules: drop support of mips64*
 .
   [ Nilesh Patra ]
   * Drop removed lintian override

minpack (19961126+dfsg1-6) unstable; urgency=medium
 .
   * Team Upload
   * Drop 'Rules-Requires-Root: no': it is the default now
 .
   [ Sébastien Villemot ]
   * d/control: move minpack-dev to section libdevel
   * d/control: use proper team name in Maintainer field
   * Drop “Priority: optional”, which is now the default

mpi4py (4.1.2-2) unstable; urgency=medium
 .
   * update deprecated PRTE_MCA_rmaps_default_mapping_policy to
     PRTE_MCA_mapby in debian build and test scripts
   * deactivate UCX (OMPI_MCA_osc=^ucx) during tests to avoid failure
     warnings, see mpi4py PR#780 and openmpi issue#12517

node-jspath (0.4.0+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1149193)

pkg-js-tools (0.17.14) unstable; urgency=medium
 .
   [ Jérémy Lal ]
   * Support package.json#bin and debian/nodejs/bins
   * Drop executables that are not linked to usr/bin
 .
   [ Yadd ]
   * dh_nodejs_fixperms: don't remove unlinked node scripts
   * Don't auto-link package.json#bin entries already linked

poetry (2.3.4-3) unstable; urgency=medium
 .
   * Team upload.
   * Backport upstream commit f47e6b2f: handle importlib.metadata raising
     MetadataNotFound for a dist-info directory without METADATA on
     Python 3.15+ (Closes: #1147234)
   * debian/patches/fix-tests.patch: accept the version reported by
     Python.get_system_python() in test_python_get_preferred_default,
     which drops the pre-release suffix (e.g. 3.15.0rc1).

pupnp (1:22.1.8-2) unstable; urgency=medium
 .
   * Upload to unstable
pupnp (1:22.1.8-1) experimental; urgency=medium
 .
   * New upstream version 22.1.8
     - Fixes CVE-2026-77630, CVE-2026-57488, CVE-2026-57487, CVE-2026-57486,
       and CVE-2026-55862 (Closes: #1151082)
   * SONAME bump:
     - libupnp20 -> libupnp22
     - libixml11 -> libixml22
   * debian/control:
     - Bump debhelper compat to 14
     - Bump Standards-Version
   * debian/copyright: Update copyright info for 22.1.8
pupnp (1:1.18.5-1) experimental; urgency=medium
 .
   * New upstream version 1.18.5
     - Fix CVE-2026-41682
pupnp (1:1.18.4-1) experimental; urgency=medium
 .
   * New upstream version 1.18.4
     - Fix cmake export (Closes: #1130914)
pupnp (1:1.18.0-1) experimental; urgency=medium
 .
   * New upstream version 1.18.0
   * SONAME bump: libupnp17 -> libupnp20
   * debian/copyright:
     - Update copyright years
     - Remove FSF address
   * debian/control:
     - Bump Standards-Version
     - Drop RRR: no
     - Drop Priority: optional

pwndck (1.1-1) unstable; urgency=medium
 .
   * Test fixes/improvements.
pwndck (1.0-1) unstable; urgency=medium
 .
   * Add internationalization, and a French translation.
   * Additional/improved testing.
   * Convert to Python /src layout.

pyfibaro (0.8.4-1) unstable; urgency=medium
 .
   * New upstream release.
   * Remove debian/gbp.conf, switch to dgit.
   * Add dh-sequence-single-binary.
   * Prefix debhelper files with the binary package name.
   * Update copyright year.

pyrail (0.5.0-1) unstable; urgency=medium
 .
   * New upstream release.
   * Remove debian/gbp.conf, switch to dgit.
   * Update to debhelper compatibility level 14.
   * Add dh-sequence-single-binary.
   * Upstream switched build system from poetry-core to hatchling.
   * Remove debhelper compat 14 auto-applied substvars.
   * Update copyright year.
   * Add examples to debian/pybuild.testfiles.
   * Add python3-hatch-vcs to Build-Depends.
   * Set SETUPTOOLS_SCM_PRETEND_VERSION in debian/rules.
 .
 pyrail (0.4.1-3) unstable; urgency=medium
 .
   * Add myself as Uploader
   * Add debian/salsa-ci.yml
   * Drop "Rules-Requires-Root: no": it is the default now
   * Remove redundant Priority: optional from source stanza.
   * Update standards version to 4.7.4, no changes needed.
   * Set upstream metadata fields: Documentation.
   * Rename files under debian/ for debhelper 14 compatibility
   * Rewrite d/watch in v5 format

python-airos (0.6.13-1) unstable; urgency=medium
 .
   * New upstream release.

python-filelock (4.1.1-1) unstable; urgency=medium
 .
   * New upstream release.
   * Add patch to backdate stale lock markers in two race tests, which
     failed on ext4 due to inode number reuse.
python-filelock (4.0.12-1) unstable; urgency=medium
 .
   * New upstream release.

python-generic (1.1.7-2) unstable; urgency=medium
 .
   * Move the package to team maintenance. (Closes: #1142246)

python-jaconv (0.5.0-3) unstable; urgency=medium
 .
   * Upgrade Debian standards to 4.7.4

python-netaddr (1.3.0-3) unstable; urgency=medium
 .
   * Team Upload
   * Rewrite d/copyright in machine-parsable format

python-qnapstats (0.6.2-1) unstable; urgency=medium
 .
   * New upstream release.
   * Remove defaults from debian/control.
   * Update Standards-Version.
   * Update to debhelper compatibility level 14.
   * Add dh-sequence-single-binary.
   * Remove debhelper compat 14 auto-applied substvars.
   * Prefix debhelper files with the binary package name.
   * Update copyright year.
   * Update debian/watch to format version 5.
   * Add debian/salsa-ci.yml.

python-sphinx-jinja (2.0.2-4) unstable; urgency=medium
 .
   * Team upload.
   * Trim autopkgtest dependencies
   * Use declarative dh-sequence-python3
   * Drop "Rules-Requires-Root: no": it is the default now
   * Rewrite d/watch in v5 format
   * Bump Standards-Version to 4.7.4, drop Priority: tag
   * Add debian/salsa-ci.yml
   * Drop unused python3-setuptools build-dependency
   * Mark python3-pytest as <!nocheck>

ros2-colcon-core (0.20.1-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Backport upstream fixes for recent setuptools. (Closes: #1146464)

ruby-domain-name (0.7.20261007-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Lucas Nussbaum ]
   * debian/gbp.conf: Add for DEP-14
   * debian/gbp.conf: remove trailing empty lines
   * debian/.gitattributes: remove
   * debian/salsa-ci.yml: use team-specific include
 .
   [ Simon Quigley ]
   * Upgrade the watch file to version 5.
   * New upstream release.
   * Use --gem-install layout in rules.
   * Update Standards-Version to 4.7.4.
   * Bump debhelper-compat to 14, dropping ${misc:Depends},
     ${shlibs:Depends}, and ${ruby:Depends} from runtime dependencies.
   * Add a build dependency on ruby-minitest.
   * Refresh the copyright file.
   * List gem files without calling git.

ruby-fog-aliyun (0.4.1-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Lucas Nussbaum ]
   * debian/gbp.conf: Add for DEP-14
   * debian/.gitattributes: remove
   * debian/salsa-ci.yml: use team-specific include
 .
   [ Simon Quigley ]
   * Upgrade the watch file to version 5.
   * New upstream release.
   * Use --gem-install layout in rules.
   * Update Standards-Version to 4.7.4.
   * Refresh the copyright file.
   * Bump debhelper-compat to 14, dropping ${misc:Depends},
     ${shlibs:Depends}, and ${ruby:Depends} from runtime dependencies.
   * Drop old Breaks.

ruby-fog-json (1.5.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-http-accept (2.2.2-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Lucas Nussbaum ]
   * debian/gbp.conf: Add for DEP-14
   * debian/gbp.conf: remove trailing empty lines
   * debian/.gitattributes: remove
   * debian/salsa-ci.yml: use team-specific include
 .
   [ Simon Quigley ]
   * Upgrade the watch file to version 5.
   * New upstream release.
   * Update the Homepage URL and refresh the upstream metadata.
   * Update Standards-Version to 4.7.4.
   * Bump debhelper-compat to 14, dropping ${misc:Depends},
     ${shlibs:Depends}, and ${ruby:Depends} from runtime dependencies.
   * Refresh the copyright file.
   * Add no-release-pem.patch and drop-covered-sus.patch for buildability.
   * Enable the test suite.

ruby-ipaddr (1.3.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.
   * Bump debhelper-compat to 14, dropping ${misc:Depends},
     ${shlibs:Depends}, and ${ruby:Depends} from runtime dependencies.
   * Enable the test suite.

ruby-jekyll-relative-links (0.9.1-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Lucas Nussbaum ]
   * debian/gbp.conf: Update for DEP-14
   * debian/.gitattributes: remove
   * debian/salsa-ci.yml: use team-specific include
 .
   [ Simon Quigley ]
   * Upgrade the watch file to version 5.
   * New upstream release.
   * Refresh the copyright file.
   * Drop {XS,XB}-Ruby-Versions from control.
   * Update Standards-Version to 4.7.4.
   * Bump debhelper-compat to 14, dropping ${misc:Depends},
     ${shlibs:Depends}, and ${ruby:Depends} from runtime dependencies.

ruby-json (3.1.0+dfsg-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-mixlib-versioning (1.2.26-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.
   * Mark as Multi-Arch: foreign.

ruby-tins (1.61.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release.

ruby-view-component (4.16.0-1) unstable; urgency=medium
 .
   * New upstream release.
   * Enable the test suite.

rust-cargo-util (0.2.31-1) unstable; urgency=medium
 .
   * Team upload.
   * Package cargo-util 0.2.31 from crates.io using debcargo 2.8.4

rust-lamfold (0.1.5-1) unstable; urgency=medium
 .
   * Package lamfold 0.1.5 from crates.io using debcargo 2.8.4
   * Refresh relax-deps.patch: Drop the lzma-rust2 hunk, since 0.1.5 already
     requires 0.19, and relax ruzstd 0.9.1 to >=0.8.3, <0.10 until ruzstd 0.9.1
     reaches unstable.
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamfold-cpio (0.1.2-1) unstable; urgency=medium
 .
   * Package lamfold-cpio 0.1.2 from crates.io using debcargo 2.8.4
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamfold-cramfs (0.1.0-2) unstable; urgency=medium
 .
   * Package lamfold-cramfs 0.1.0 from crates.io using debcargo 2.8.4
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamfold-erofs (0.1.3-1) unstable; urgency=medium
 .
   * Package lamfold-erofs 0.1.3 from crates.io using debcargo 2.8.4
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamfold-iso (0.1.2-1) unstable; urgency=medium
 .
   * Package lamfold-iso 0.1.2 from crates.io using debcargo 2.8.4
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamfold-romfs (0.1.1-1) unstable; urgency=medium
 .
   * Package lamfold-romfs 0.1.1 from crates.io using debcargo 2.8.4
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamfold-squash (0.1.1-1) unstable; urgency=medium
 .
   * Package lamfold-squash 0.1.1 from crates.io using debcargo 2.8.4
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamfold-udf (0.1.1-1) unstable; urgency=medium
 .
   * Package lamfold-udf 0.1.1 from crates.io using debcargo 2.8.4
   * debian/copyright: Indent the first line of the Expat license text, which
     didn't parse, and note in Files: * that the Cargo.toml authors field
     records authorship.

rust-lamzfs (0.1.4-1) unstable; urgency=medium
 .
   * Package lamzfs 0.1.4 from crates.io using debcargo 2.8.4
   * Add relax-deps.patch: ruzstd 0.9.1 -> >=0.8.3, <0.10 until ruzstd 0.9.1
     reaches unstable.
   * debian/copyright: Note in Files: * that the Cargo.toml authors field
     records authorship.

rust-nu-ansi-term (0.50.3-1) unstable; urgency=medium
 .
   * Team upload.
   * Package nu-ansi-term 0.50.3 from crates.io using debcargo 2.8.4
   * Drop remove-windows-dep.diff in favor of filter_targets.
   * Drop the unused fix-build-issue patch.
   * Run gnu_legacy tests with the std feature.

rust-struct-patch (0.14.4-1) unstable; urgency=medium
 .
   * Package struct-patch 0.14.4 from crates.io using debcargo 2.8.4

rust-struct-patch-derive (0.14.4-1) unstable; urgency=medium
 .
   * Package struct-patch-derive 0.14.4 from crates.io using debcargo 2.8.4

squid-deb-proxy (0.9.3) unstable; urgency=medium
 .
   * d/control: dh compat 14 is now stable; X-Dh-Compat -> debhelper-compat
   * squid-deb-proxy.conf: fix copy-and-paste error in visible_hostname.
     Thanks to Christoph Biedl
   * Replace dpkg-vendor calls wwith reading /etc/dpkg/origins/default.
     Thanks to Christoph Biedl
   * Drop incorrect NEWS entry about squid-deb-proxy-client removal

tclx (8.6.3+dfsg-4) unstable; urgency=medium
 .
   * Switch dependencies from Tcl 9.0 to Tcl 9.1.
   * Bump debhelper compatibility level to 14.

tdiary (5.6.0-3) unstable; urgency=medium
 .
   * Team upload.
   * Actually provide a version with ruby-tdiary.

vlc (3.0.24-4) unstable; urgency=medium
 .
   * debian/patches: Backport upstream fix for pupnp 22.x (Closes: #1151172)

xlsx2csv (1:0.8.6-1) unstable; urgency=medium
 .
   * Team Upload
   * Fix Team name
   * Drop 'Rules-Requires-Root: no': it is the default now
   * Rename debian/docs for future debhelper 14 compatibility
   * Bump S.V. to 4.7.4 & drop Priority: tag
   * Rewrite d/watch in v5 format
   * New upstream version 0.8.6

yabasic (1:2.92.1-1) unstable; urgency=medium
 .
   * New upstream release
     - New function 'replace$' to replace substrings within a string
     - New peeks 'screenposx' and y to get cursor position
     - Bugfix in replace$
   * Update debian/copyright
   * Bump Standards-Version to 4.7.4, no changes