aespipe (2.4j-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 2.4j
   * Drop "Rules-Requires-Root: no": it is the default now
   * Bump Standards-Version to 4.7.4, drop Priority: tag
   * Rewrite d/watch in v5 format
   * Add debian/upstream/metadata
 .
   [ Emanuele Rocca ]
   * Run tests as part of the build process. Upstream uses the 'tests'
     target, not 'check' or 'test' as expected by dh_auto_test.
 .
   [ наб ]
   * New upstream version 2.4i (Closes: #1104773)

bluetooth-data-tools (1.29.21-1) unstable; urgency=medium
 .
   * New upstream release.
bluetooth-data-tools (1.29.19-1) unstable; urgency=medium
 .
   * New upstream release.
   * Update to debhelper compatibility level 14.
   * Add dh-sequence-single-binary.
   * Remove debhelper compat 14 auto-applied substvars.
   * Prefix debhelper files with the binary package name.

busybox (1:1.38.0-3) unstable; urgency=medium
 .
   * fix 4 (minor) security issues (Closes: #1142472):
     - ash-fix-out-of-bounds-read-in-ifsbreakup-CVE-2026-38754.patch
     - ash-fix-stack-overflow-in-evalfun-CVE-2026-38755.patch
     - awk-fix-stack-overflow-in-evaluate-CVE-2026-38752.patch
     - awk-fix-use-after-free-in-awk_sub-CVE-2026-38753.patch
busybox (1:1.38.0-2) unstable; urgency=medium
 .
   * d/copyright: convert to DEP-5 format (initial)
   * d/busybox-syslogd.init: use full /usr/bin path to interpreter
   * d/busybox-syslogd.lintian-overrides, d/udhcpd.lintian-overrides:
     fix overrides about #! interpreters in init scripts
   * swaponoff-FreeBSD-support.patch, u-mount-FreeBSD-support.patch:
     remove (unused for long time, kfreebsd is gone meanwhile)
   * coreutils-cut.c-typo-fix-delimeter.patch: fix typo
   * d/control: Standards-Version: 4.7.4 (no changes)
   * d/control: remove now-redundrand R3: no & Priority: options
   * remove debian-installer-env-hack patch: and the revert of upstream commit.
     The only actual difference for the d-i was the set builtin, which usage
     is now fixed in preseed package.  Restore status quo for regular builds.
     See https://lists.debian.org/debian-boot/2026/07/msg00057.html
   * ash-omit-variables-with-invalid-names-in-showvars.patch: fix the `set'
     builtin to omit showing environment variables with invalid names entirely

camomile (2.0.0-4) unstable; urgency=medium
 .
   * Team upload
   * add missing header to PT, fixes compilation under dune 3.24
   * Bump debhelper compat level to 14
   * Bump Standards-Version to 4.7.4

dbeacon (0.4.0-4) unstable; urgency=medium
 .
   * Team upload.
   * Rewrite d/watch in v5 format
   * Rewrite d/watch in newer & shorter syntax
   * Remove redundant Priority: optional from source stanza.
   * Update standards version to 4.7.4, no changes needed.
   * Add debian/upstream/metadata
 .
   [ Luca Boccassi ]
   * Stop deleting system users on purge
   * Install and use sysusers.d config files

exult (1.12.1-3) unstable; urgency=medium
 .
   * debian/exult.install, debian/exult-studio.install: Fix install path of png
     icons, they are in 512x512, not scalable.
   * debian/patches/fix_missing_ghost_portraits_in_dialogue.patch.patch: New
     patch, fixes missing ghost portraits in dialogue, taken from upstream
     commit e4d707bff6.
exult (1.12.1-2) unstable; urgency=medium
 .
   * Acknowledge NMU.
   * debian/templates/zh_CN.po: New file with chinese debconf translation;
     partly addresses #1125388, thanks to Yangfl.
   * debian/rules (override_dh_auto_configure): Add --with-icondir and
     --with-svgdir directories, installing them into /usr/share rather than
     /usr/share/games (the local datadir).
   * debian/patches/metafinfo-dir.patch: New patch, forces metadir to
     /usr/share/metainfo instead of $datadir/metainfo.
   * debian/exult.install, debian/exult-studio.install: Update directories for
     png and svg icons, and install *.metadata.xml files as well.
   * debian/watch: Switch to version 4 and use api.github.com. Exult publishes a
     lot of automatically generated prereleases and the api.github.com REST call
     does not seem to support filtering, so request the maximum of 100 releases.
     This works (barely) right now, but might break again in the future.

ezurio-qcacld-2.0-dkms (0.0~git20240408.aa96a9f+dfsg-10) unstable; urgency=medium
 .
   * debian/patches: add 0011-Linux-7.1.patch

focuswriter (1.9.1-1) unstable; urgency=medium
 .
   [ Graeme Gott ]
   * New upstream release
 .
   [ Barak A. Pearlmutter ]
   * Bump policy

freedombox (26.10) unstable; urgency=medium
 .
   [ Coool ]
   * Translated using Weblate (Latvian)
 .
   [ bittin1ddc447d824349b2 ]
   * Translated using Weblate (Swedish)
 .
   [ Grayson Wolf ]
   * d/t/access-web-interface: make ready check more robust
 .
   [ James Valleroy ]
   * debian/tests: Drop redundant status check
   * tor, torproxy: Avoid error if defaults file missing during uninstall
   * locale: Update strings for translation
 .
   [ Dietmar ]
   * Translated using Weblate (German)
 .
   [ Frederico Gomes ]
   * luanti: Add more detail to description
   * apps: Change header title from Disabled to Available for install
 .
   [ Coucouf ]
   * Translated using Weblate (French)
 .
   [ reducedradius ]
   * Translated using Weblate (Chinese (Simplified Han script))
 .
   [ Sunil Mohan Adapa ]
   * css: Fix sizing for icons in custom shortcuts
   * log: Set simpler syslog identifier instead of full binary path
   * ssh: Don't fail on page load when SSH host key can't be read
   * first_boot: Move first wizard secret generation to this app

gammu (1.43.3-1) unstable; urgency=medium
 .
   * New upstream release
     - includes a fix for command injection in the SMSD run hooks
   * Update watch file to track GH releases and convert to v5
   * Drop patches applied upstream:
     - 01-change_pid_file_location.patch
     - 03-bufsz.patch
     - 07-use_posix_shell_only.patch
     - 09-uname-buffer-overflow.patch
   * Drop 10-cmake-4.patch, upstream now requires cmake 3.10
   * Add 09-mysql_errmsg_include.patch to fix FTBFS: the new SMSD MySQL
     reconnect handling uses the CR_* client error codes without including
     <errmsg.h>
   * Add 10-no_remote_images_in_docs.patch, the manual now includes
     README.rst and its remote badge images caused a privacy breach
   * Refresh patches
   * Update libgsmsd8t64.symbols +SMSD_SetExitOnFailure
   * Add dep on python3-sphinx-rtd-theme
   * Drop unused package-name-doesnt-match-sonames lintian overrides
   * Bump up standards to 4.7.4, no changes
   * Drop Priority
   * Bump dh to 14
   * Add 11-fix_api_docs_lookup.patch: work around breathe skipping
     doxygen >= 1.9.7 group members, which left all C API pages with
     "Cannot find function" warnings instead of documentation and
     embedded the build path in gammu-doc, breaking reproducibility

gappa (1.8.2-1) unstable; urgency=medium
 .
   * New upstream release.
   * Bump standards-version to 4.7.4.
   * Rewrite d/watch.

gcc-15-cross (18) unstable; urgency=medium
 .
   * Build using gcc 15.3.0-2.

gcc-15-cross-ports (18) unstable; urgency=medium
 .
   * Build using gcc 15.3.0-2.

gnome-console (50.0-3) unstable; urgency=medium
 .
   * Update debhelper compat to 14

gnome-taquin (3.38.1-6) unstable; urgency=medium
 .
   * Update debhelper compat to 14

gnome-tetravex (1:3.38.3-3) unstable; urgency=medium
 .
   * Add Build-Depends: libxml2-utils for xmllint
   * Update debhelper compat to 14
   * Update Standards Version to 4.7.4

go-spdx (2.7.0-1) unstable; urgency=medium
 .
   * Use compat 14
   * Drop --buildsystem=golang

golang-github-cavaliergopher-rpm (1.3.0-1) unstable; urgency=medium
 .
   * Drop redundant `Priority: optional`
   * Drop redundant `Rules-Requires-Root: no`
   * Bump Debian Policy version to 4.7.4
   * Use dh-sequence-golang
   * Use watch v5
   * Use compat 14
   * Use gbp sign-tags and upstream-vcs-tag
   * Bump debian/* copyright years

golang-github-cyberdelia-go-metrics-graphite (0.0~git20161219.39f87cc-1) unstable; urgency=medium
 .
   * Team upload
   * Apply consistent formatting to packaging files
   * Drop redundant `Priority: optional`
   * Bump Debian Policy version to 4.7.4
   * Fix spelling
   * Use dh-sequence-golang
   * Modernize gbp.conf
   * Use compat 14
   * Use Section:golang for source package too
   * Improve Description:
   * Bump debian/* copyright years
   * Revert "Ignore quilt dir .pc via .gitignore"
   * Add d/watch
   * Use Multi-Arch:foreign
   * Use Testsuite:autopkgtest-pkg-go

golang-github-go-git-go-billy (5.9.1-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream

ibus-typing-booster (2.30.11-1) unstable; urgency=medium
 .
   * New upstream version 2.30.11.

jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3) unstable; urgency=medium
 .
   * Upload to unstable
   * Do not run slow test on slow arch
   * Fix CVE-2026-40171:
     Command linker attributes chained with help command enable
     one-click authentication token theft
   * Fix CVE-2026-42266:
     JupyterLab has an Extension Manager API/GUI Policy Discrepancy,
     allowing 3rd party (malicious) extensions install via POST request
   * Fix CVE-2026-42557:
     Command linker attributes in HTML enable one-click command
     execution from untrusted content
jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2) experimental; urgency=medium
 .
   * Increase timeout for test
jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium
 .
   * New upstream release
   * Fix CVE-2026-40171:
     Command linker attributes chained with help command enable
     one-click authentication token theft
   * Fix CVE-2026-42266:
     JupyterLab has an Extension Manager API/GUI Policy Discrepancy,
     allowing 3rd party (malicious) extensions install via POST request
   * Fix CVE-2026-42557:
     Command linker attributes in HTML enable one-click command
     execution from untrusted content
jupyterlab (4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium
 .
   * New upstream release
   * Fix CVE-2025-59842:
     Links generated with LaTeX typesetters in Markdown files and
     Markdown cells in JupyterLab and Jupyter Notebook did not include
     the noopener attribute.
     (Closes: #1118967)
jupyterlab (4.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1) experimental; urgency=medium
 .
   * New upstream release

kew (4.2.7+ds-1) unstable; urgency=medium
 .
   * New upstream release
   * Refresh patches for new upstream

led-ble (1.1.12-1) unstable; urgency=medium
 .
   * New upstream release.
   * Update to debhelper compatibility level 14.
   * Add dh-sequence-single-binary.
   * Remove debhelper compat 14 auto-applied substvars.
   * Prefix debhelper files with the binary package name.

libjjml-java (1.1.18-4) unstable; urgency=medium
 .
   * Apply upstream commit to work around llama.cpp b10108 API breakage

libmicrohttpd (1.0.7-1) unstable; urgency=medium
 .
   * [ada7e89] New upstream version 1.0.7
   * [c413adb] d/patches/: adjust MHD_VERSION to match current release

libmojolicious-perl (9.48+dfsg-1) unstable; urgency=medium
 .
   * Import upstream version 9.48+dfsg.
     - Fixed a security issue where CSRF tokens were vulnerable to BREACH
       attacks. Tokens are now masked with a fresh random value on every
       request, instead of being reused for the whole lifetime of a session.
       (CVE-2026-15747)

libssh (0.12.2-1) unstable; urgency=medium
 .
   * New upstream release:
     - CVE-2026-59843: Denial of service via zero advertised channel packet
       size (already applied in 0.12.1-1 with a Debian patch)
     - Some bug fixes, see
       https://www.libssh.org/2026/07/28/libssh-0-12-2-security-release/
libssh (0.12.1-1) unstable; urgency=medium
 .
   * New upstream security release:
     - CVE-2026-15370: Stack buffer overflow in SFTP server longname
       construction
     - CVE-2026-59842: Information disclosure via short GSSAPI Curve25519
       public key
     - CVE-2026-59844: Denial of service via oversized SFTP read length
     - CVE-2026-59845: Denial of service via unchecked ProxyCommand fork()
       failure
     - CVE-2026-59846: Information disclosure via ProxyCommand %r username
       expansion
     - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
     - CVE-2026-59848: Denial of service via SFTP responses with unknown
       request IDs
     - CVE-2026-59849: Denial of service via automatic certificate
       authentication loop
     - CVE-2026-59850: Use-after-free via data callbacks on closed channels
     - CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
     - Zero-initialize every ssh_string
   * channels: Fail when receiving max packet size 0.
     Backported from master commit 44b186fa17af. Add a corresponding unit
     test (forwarded upstream). CVE-2026-59843
   * Bump Standards-Version to 4.7.4.  No changes necessary.

libxmlb (0.3.29-1) unstable; urgency=medium
 .
   * New upstream version

lxqt-panel (2.3.2-4) unstable; urgency=medium
 .
   * revert-239349f.patch: revert upstream regression commit.
     (Closes: #1124685)
   * debian/control: bump to Standards-version to 4.7.4.
   * debian/copyright: update.
   * Revert d/install: Update install file
   * debian/control: depends on lxqt-theme-debian as panel icon depends
     on it.

maildrop (4.0.4-1) unstable; urgency=medium
 .
   * New upstream release.

menhir (20260209+ds-3) unstable; urgency=medium
 .
   * Team upload
   * Fix installation of manpage (Closes: #1142901)

monzopy (1.6.0-1) unstable; urgency=medium
 .
   * New upstream release.
   * Remove debian/gbp.conf, switch to dgit.
   * Remove defaults from debian/control.
   * Update Standards-Version.
   * Update to debhelper compatibility level 14.
   * Add dh-sequence-single-binary.
   * Remove debhelper compat 14 auto-applied substvars.
   * Prefix debhelper files with the binary package name.
   * Update copyright year.
   * Update debian/watch to format version 5.
   * Add debian/salsa-ci.yml.

ocaml-dune (3.24.1-4) unstable; urgency=medium
 .
   * Add libmdx-ocaml-dev (<< 2.6.0) to Breaks
ocaml-dune (3.24.1-3) unstable; urgency=medium
 .
   * Add libppx-optcomp-ocaml-dev to autopkgtest Depends
ocaml-dune (3.24.1-2) unstable; urgency=medium
 .
   * Fix build on hurd
ocaml-dune (3.24.1-1) unstable; urgency=medium
 .
   * New upstream release
   * Bump debhelper compat level to 14

ocaml-dune-configurator-builder (3.24.1+1) unstable; urgency=medium
 .
   * Build-depend on ocaml-dune 3.24.1
   * Bump debhelper compat level to 14

ocaml-dune-full-builder (3.24.1+1) unstable; urgency=medium
 .
   * Bump dune version to 3.24.1
ocaml-dune-full-builder (3.23.1+3) unstable; urgency=medium
 .
   [ Julien Puydt ]
   * Package dune-glob (Closes: #1142347).
 .
   [ Stéphane Glondu ]
   * Bump debhelper compat level to 14
   * Set dune_layout_version to 1

osslsigncode (2.14-1) unstable; urgency=medium
 .
   * New upstream release, now shipping documentation.
   * Mark test dependency with the nocheck build profile.
   * Wrap and sort the control files.
   * Switch to debhelper compatibility level 14.

pgbackrest (2.59.0-1) unstable; urgency=medium
 .
   * New upstream release.

planetfilter (0.13.0-1) unstable; urgency=medium
 .
   [ Luca Boccassi ]
   * Stop deleting system users on purge
   * Install and use sysusers.d/tmpfiles.d config files
 .
   [ Francois Marier ]
   * New upstream version 0.13.0
   * Bump Standards-Version up to 4.7.4
   * Bump copyright year in debian/copyright
   * Bump debhelper-compat up to 14
   * Remove unnecessary priority field from debian/control
   * Fix issues found by Shellcheck
   * Add dh-sequence-single-binary to build-depends

py3status (3.64-1) unstable; urgency=medium
 .
   [ Sébastien Delafond ]
   * New upstream version 3.64
   * Bump-up Standards-Version

pyeconet (0.2.5-1) unstable; urgency=medium
 .
   * New upstream release.

python-mrcz (0.5.9-3) unstable; urgency=medium
 .
   * Bug fix: "autopkgtest regression with NumPy 2.4", thanks to
     roehling@debian.org</a>; (Closes: #1131076).
python-mrcz (0.5.9-2) unstable; urgency=medium
 .
   * Team Upload
   * Add build-dep on python3-setuptools-scm to generate correct dist-info
python-mrcz (0.5.9-1) unstable; urgency=medium
 .
   * Bug fix: "Python SyntaxWarning", thanks to Graham Inggs (Closes: #1086853).
   * New upstream release.
python-mrcz (0.5.7-5) unstable; urgency=medium
 .
   * Team Upload
   * Document debhelper level in d/control & switch to level 13
   * Bump Standards-Version to 4.7.3, drop Priority: tag
   * Add debian/salsa-ci.yml
   * Rewrite d/watch in v5 format
python-mrcz (0.5.7-4) unstable; urgency=medium
 .
   * Actually exclude s390x from autopkgtests…
python-mrcz (0.5.7-3) unstable; urgency=medium
 .
   * Exclude s390x from autopkgtests for now.
python-mrcz (0.5.7-2) unstable; urgency=medium
 .
   * Force versioned dependency on numpy >= 2.2 to fix testing migration.
python-mrcz (0.5.7-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release:
     - Rename np.product to np.prod (closes: #1095373).
   * Explicitly depend on python3-setuptools, for distutils.version.
   * Use HTTPS in Homepage field.
   * Use pybuild-plugin-pyproject.
   * Use dh-sequence-python3.
   * Enable autopkgtest-pkg-pybuild.
python-mrcz (0.5.6-2) unstable; urgency=medium
 .
   * Source-only upload for migration to testing.
python-mrcz (0.5.6-1) unstable; urgency=low
 .
   * Source package automatically created by stdeb 0.10.0 then tweaked by hand.

python-pebble (5.2.1-1) unstable; urgency=medium
 .
   * New upstream version.
   * Bump standards version.

python-vtracer (0.6.15-1) unstable; urgency=medium
 .
   * Initial Debian release. (Closes: #1141512)

qt6-5compat (6.10.2-4) unstable; urgency=medium
 .
   [ Patrick Franz ]
   * Backport patch to fix CVE-2026-9499 (Closes: #1142690).

r-cran-rcpparmadillo (15.4.2-1-1) unstable; urgency=medium
 .
   * New upstream release
 .
   * debian/control: Set Build-Depends: to current R version

rgbds (1.0.2+hotfix-1) unstable; urgency=medium
 .
   * New upstream release.

rime-cantonese (0.0~git20260702.c99b16e-1) unstable; urgency=medium
 .
   * New upstream snapshot.

rime-essay (0.0~git20260713.e9b1a37-1) unstable; urgency=medium
 .
   * New upstream release.

rime-luna-pinyin (0.0~git20260712.56b934b-1) unstable; urgency=medium
 .
   * New upstream release.

rime-prelude (0.0~git20260509.082425e-1) unstable; urgency=medium
 .
   * New upstream snapshot.

rust-arcstr (1.2.0-3) unstable; urgency=medium
 .
   * Package arcstr 1.2.0 from crates.io using debcargo 2.8.4+alpha.0
   * Disable loom based tests as they don't work on all architectures.
rust-arcstr (1.2.0-2) unstable; urgency=medium
 .
   * Team upload
   * Package arcstr 1.2.0 from crates.io using debcargo 2.8.3

rust-globset (0.4.19-1) unstable; urgency=medium
 .
   * Team upload.
   * Package globset 0.4.19 from crates.io using debcargo 2.8.4

rust-libglycin-rebind (0.1.0-3) unstable; urgency=medium
 .
   * Team upload
   * Package libglycin-rebind 0.1.0 from crates.io using debcargo 2.8.4

rust-nettle-sys (2.3.2-1) unstable; urgency=medium
 .
   * Team upload.
   * Package nettle-sys 2.3.2 from crates.io using debcargo 2.8.4

rust-stderrlog (0.6.0+ds-1) unstable; urgency=medium
 .
   * Team upload.
   * Package stderrlog 0.6.0 from crates.io using debcargo 2.8.4

rust-unicode-properties (0.1.4-1) unstable; urgency=medium
 .
   * Team upload.
   * Package unicode-properties 0.1.4 from crates.io using debcargo 2.8.4

rust-vm-fdt (0.2.0-2) unstable; urgency=medium
 .
   * Package vm-fdt 0.2.0 from crates.io using debcargo 2.8.3
   * Skip long-running experimental tests that can break autopkgtests
rust-vm-fdt (0.2.0-1) unstable; urgency=medium
 .
   * Package vm-fdt 0.2.0 from crates.io using debcargo 2.8.3

rust-xshell (0.3.0~pre.2-1) unstable; urgency=medium
 .
   * Package xshell 0.3.0-pre.2 from crates.io using debcargo 2.8.3

saldo (0.8.4-2) unstable; urgency=medium
 .
   * Update debhelper compat to 14
   * Update Standards Version to 4.7.4

subunit (1.4.6-2) unstable; urgency=medium
 .
   * Don't mark python3-iso8601 and python3-testtools build-dependencies
     as nocheck. Closes: #1141750

tecla (50.0-2) unstable; urgency=medium
 .
   * Update debhelper compat to 14

terminus (3.11.0-1) unstable; urgency=medium
 .
   * New upstream version
terminus (3.10.0-1) unstable; urgency=medium
 .
   * New upstream version

timescaledb (2.29.0+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 2.29.0+dfsg, supports PG 16+.

tvoe (0.1+git20190112.9ff09d9-3) unstable; urgency=medium
 .
   * Team upload.
   * Switch to debhelper 14
   * Rewrite d/watch in v5 format
   * Bump Standards-Version to 4.7.4, drop Priority: tag
   * Add debian/salsa-ci.yml
 .
   [ Luca Boccassi ]
   * Stop deleting system users on purge
   * Install and use sysusers.d config files

valijson (1.1.0+repack-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Add debian/salsa-ci.yml to test the nocheck profile
   * Mark json-schema-test-suite as <!nocheck>
   * Rewrite d/watch in v5 format
   * Use correct machine-readable copyright file URI.