valkey (9.1.1-1) unstable; urgency=medium

  [ Lena Voytek ]
  * New upstream version 9.1.1 (Closes: #1144957, #1144956).
    - Fix CVE-2026-63639 and CVE-2026-56684.
  * Update patches.
    - Remove d/p/CVE-2025-67733.patch and CVE-2026-21863.patch already applied
      by upstream.
    - Refresh 0002-Add-CPPFLAGS-to-upstream-makefiles.patch.
    - Use defined() instead of == yes for USE_SYSTEM_JEMALLOC in
      0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch.
    - Add 0005-Map-je_posix_memalign-for-system-jemalloc.patch to map
      je_posix_memalign to posix_memalign for system jemalloc.
    - Add 0006-support-openssl4-tlsS-tests.patch to fix TLS unit test failures
      and test certificate generation.
  * Update watch file.
    - Use version 5.
    - Remove repack suffix - no longer needed.
    - Add uversion-mangle to watch for rc versions.
  * Update copyright file for new version.
  * Add Lena Voytek as an uploader.
  * Update standards version and remove unnecessary fields.
  * Remove libhiredis-dev dependency - no longer needed.

  [ Luca Boccassi ]
  * Use sysusers to manage the valkey system user and group.

 -- Lena Voytek <lena@debian.org>  Fri, 21 Aug 2026 18:00:08 -0400

valkey (8.1.4+dfsg1-2) unstable; urgency=medium

  * Fix CVE-2025-67733 (Closes: #1130911).
    A malicious user can use scripting commands to inject arbitrary
    information into the response stream for the given client, potentially
    corrupting or returning tampered data to other users on the same
    connection. The error handling code for lua scripts does not properly
    handle null characters.
    - d/p/CVE-2025-67733.patch
  * Fix CVE-2026-21863 (Closes: #1130911).
    A malicious actor with access to the Valkey clusterbus port can send an
    invalid packet that may cause an out bound read, which might result in
    the system crashing. The Valkey clusterbus packet processing code does
    not validate that a clusterbus ping extension packet is located within
    buffer of the clusterbus packet before attempting to read it.
    - d/p/CVE-2026-21863.patch

 -- Lucas Kanashiro <kanashiro@debian.org>  Mon, 30 Mar 2026 18:47:11 -0300

valkey (8.1.4+dfsg1-1) unstable; urgency=medium

  * New upstream release.
    - Fixes CVE-2025-49844, CVE-2025-46817, CVE-2025-46818 and CVE-2025-46819
      (Closes: #1117687)
  * Update patches.
    Remove d/p/CVE-2025-*.patch already applied by upstream

 -- Lucas Kanashiro <kanashiro@debian.org>  Thu, 23 Oct 2025 21:30:33 -0300

valkey (8.1.1+dfsg1-3) unstable; urgency=medium

  * Fix CVE-2025-32023 (Closes: #1108978)
    An authenticated user may use a specially crafted string to trigger a
    stack/heap out of bounds write on hyperloglog operations, potentially
    leading to remote code execution. The bug likely affects all Valkey
    versions with hyperloglog operations implemented.
    An additional workaround to mitigate the problem without patching the
    valkey-server executable is to prevent users from executing hyperloglog
    operations. This can be done using ACL to restrict HLL commands.
    - d/p/CVE-2025-32023.patch
  * Fix CVE-2025-48367 (Closes: #1108982)
    An unauthenticated connection can cause repeated IP protocol errors,
    leading to client starvation and, ultimately, a denial of service.
    - d/p/CVE-2025-48367.patch
  * d/copyright: fix path of the lua files, thanks to lintian!

 -- Lucas Kanashiro <kanashiro@debian.org>  Wed, 09 Jul 2025 05:53:22 -0300

valkey (8.1.1+dfsg1-2) unstable; urgency=medium

  * Fix CVE-2025-49112 (Closes: #1107210)
    setDeferredReply in networking.c in Valkey through 8.1.1 has an integer
    underflow for prev->size - prev->used.
    - d/p/CVE-2025-49112.patch

 -- Lucas Kanashiro <kanashiro@debian.org>  Thu, 12 Jun 2025 14:42:42 -0300

valkey (8.1.1+dfsg1-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Check length of AOF file name in valkey-check-aof (CVE-2025-27151)
    (Closes: #1106824)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 09 Jun 2025 10:47:39 +0200

valkey (8.1.1+dfsg1-1) unstable; urgency=medium

  * New upstream release.
    + Fix CVE-2025-21605 (Closes: #1104012)
  * Refresh patches
  * Declare compliance with Debian Policy 4.7.2

 -- Lucas Kanashiro <kanashiro@debian.org>  Mon, 28 Apr 2025 15:49:27 -0300

valkey (8.0.2+dfsg1-1) unstable; urgency=medium

  [ Christian Göttsche ]
  * 0003-Use-get_current_dir_name-over-PATHMAX.patch: free allocated memory
  * d/rules: enable LTO
  * valkey-tools.postinst: create directories with default SELinux context

  [ Lucas Kanashiro ]
  * New upstream version 8.0.2+dfsg1
    - Fixes CVE-2024-46981 and CVE-2024-51741 (Closes: #1092371)

 -- Lucas Kanashiro <kanashiro@debian.org>  Mon, 13 Jan 2025 23:55:00 -0300

valkey (8.0.1+dfsg1-1) unstable; urgency=medium

  [ Lena Voytek ]
  * New upstream release 8.0.1
  * Refresh patches against new version:
    - d/p/debian-packaging/0001-Set-Debian-configuration-defaults.patch
    - d/p/0002-Add-CPPFLAGS-to-upstream-makefiles.patch
    - d/p/0003-Use-get_current_dir_name-over-PATHMAX.patch
    - d/p/0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch
  * d/valkey-server.docs: Remove MANIFESTO
  * d/valkey-tools.examples: Remove redis-trib.rb

  [ Lucas Kanashiro ]
  * d/copyright: remove superfluous file pattern

 -- Lucas Kanashiro <kanashiro@debian.org>  Fri, 18 Oct 2024 19:23:21 -0300

valkey (7.2.5+dfsg1-2) unstable; urgency=medium

  * d/copyright: remove the excluded files paragraph.
  * d/copyright: add missing License field.
  * d/watch: add version mangle and repack suffix because of dfsg.

 -- Lucas Kanashiro <kanashiro@debian.org>  Fri, 09 Aug 2024 19:01:26 -0300

valkey (7.2.5+dfsg1-1) unstable; urgency=medium

  * Initial packaging (Closes: #1068342).

 -- Lucas Kanashiro <kanashiro@debian.org>  Wed, 26 Jun 2024 18:35:47 -0300
