golang-golang-x-net-dev (1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2) xenial-security; urgency=medium

  * SECURITY UPDATE: Denial of Service in startGracefulShutdownInternal
    - debian/patches/CVE-2022-27664.patch: Set appropriate return code
      when closing server in http2/server.go
    - CVE-2022-27664
  * SECURITY UPDATE: Denial of service in HPACK decoding.
    - debian/patches/CVE-2022-41723.patch: Verify data before decoding
      Huffman-encoded strings in http2/hpack/hpack.go
    - CVE-2022-41723
  * SECURITY UPDATE: XSS Attack in text rendering
    - debian/patches/CVE-2023-3978.patch: Treat render content literally
      in html/render.go
    - CVE-2023-3978
  * SECURITY UPDATE: Erroneous interpretation of tags in readStartTag
    - debian/patches/CVE-2025-22872.patch: Properly check for self-closing
      HTML tags in html/token.go
    - CVE-2025-22872
  * SECURITY UPDATE: Denial of service in HTML Parsing
    - debian/patches/CVE-2025-47911.patch: Enforce upper-bound on stack
      size of open elements in html/parse.go
    - debian/patches/CVE-2025-58190.patch: Adhere to HTML specification
      to fix infinite loop when parsing two adjacent closing tags in
      html/parse.go
    - CVE-2025-47911
    - CVE-2025-58190

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 25 Mar 2026 15:23:23 -0600

golang-golang-x-net-dev (1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1) xenial-security; urgency=medium

  * SECURITY UPDATE: Denial of service in parse function.
    - debian/patches/CVE-2024-45338.patch: Use strings.EqualFold instead of
      direct comparison and strings.ToLower in html/doctype.go,
      html/foreign.go, and html/parse.go.
    - CVE-2024-45338

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 07 Jan 2025 11:21:58 -0330

golang-golang-x-net-dev (1:0.0+git20160110.4fd4a9f-1) unstable; urgency=medium

  * Team upload.
  * New upstream snapshot. (Closes: #810775).
  * Add additional B-Ds to upgrade golang-x-text-dev and add
    golang-golang-x-crypto-dev.

 -- Tim Potter <tpot@hpe.com>  Tue, 12 Jan 2016 11:59:48 +1100

golang-golang-x-net-dev (1:0.0+git20150817.66f0418-1) unstable; urgency=medium

  * Bump epoch to bring back the proper binary package (Re: #807002)

 -- Tianon Gravi <tianon@debian.org>  Sat, 05 Dec 2015 09:42:14 -0800

golang-golang-x-net-dev (0.0+git20150817.66f0418-1) unstable; urgency=medium

  * New upstream snapshot. Closes: #798649.

 -- Martín Ferrari <tincho@debian.org>  Sat, 10 Oct 2015 12:26:10 +0000

golang-golang-x-net-dev (0.0+git20150226.3d87fd6-3) unstable; urgency=high

  * Document copyright info for html/testdata/go1.html (Closes: #790313)

 -- Martín Ferrari <tincho@debian.org>  Mon, 06 Jul 2015 07:26:21 +0200

golang-golang-x-net-dev (0.0+git20150226.3d87fd6-2) unstable; urgency=medium

  * Rename source and binary package from golang-go.net-dev to
    golang-golang-x-net-dev, following the policy outlined at
    http://pkg-go.alioth.debian.org/packaging.html

 -- Michael Stapelberg <stapelberg@debian.org>  Mon, 22 Jun 2015 21:54:09 +0200

golang-go.net-dev (0.0+git20150226.3d87fd6-1) unstable; urgency=medium

  * Update to last working version in upstream's repository
    (https://github.com/golang/go/issues/10904 breaks x/net/webdav with golang
    1.4.2).
  * Revamp package: version numbering, switch to upstream's new git repo, move
    package to pkg-go, update metadata and debian/rules.

 -- Martín Ferrari <tincho@debian.org>  Tue, 19 May 2015 01:41:35 +0000

golang-go.net-dev (0.0~hg20131201-1) unstable; urgency=low

  [ Michael Stapelberg ]
  * update Vcs-Git location to point to alioth

  [ Jonathan Dray ]
  * new version number pattern for the package

 -- Jonathan Dray <jonathan.dray@gmail.com>  Mon, 02 Dec 2013 20:02:16 +0100

golang-go.net-dev (0.0~hg67397a11592e-1) unstable; urgency=low

  * Initial release (Closes: #726146)

 -- Jonathan Dray <jonathan.dray@gmail.com>  Sat, 23 Nov 2013 16:48:04 +0100
