jinja2 (3.1.2-1+deb12u3) bookworm; urgency=medium

  * CVE-2025-27516 (Closes: #1099690)

 -- Moritz Mühlenhoff <jmm@debian.org>  Sun, 18 May 2025 00:17:01 +0200

jinja2 (3.1.2-1+deb12u2) bookworm; urgency=medium

  * Non-maintainer upload by the LTS security team.
  * Fix CVE-2024-56201:
    In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler
    allows an attacker that controls both the content and filename of a template
    to execute arbitrary Python code, regardless of if Jinja's sandbox is used.
    To exploit the vulnerability, an attacker needs to control both the filename
    and the contents of a template. Whether that is the case depends on the type
    of application using Jinja. This vulnerability impacts users of applications
    which execute untrusted templates where the template author can also choose
    the template filename.
  * Fix CVE-2024-56326:
    Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects
    calls to str.format allows an attacker that controls the content of a
    template to execute arbitrary Python code. To exploit the vulnerability, an
    attacker needs to control the content of a template. Whether that is the
    case depends on the type of application using Jinja. This vulnerability
    impacts users of applications which execute untrusted templates. Jinja's
    sandbox does catch calls to str.format and ensures they don't escape the
    sandbox. However, it's possible to store a reference to a malicious string's
    format method, then pass that to a filter that calls it. No such filters are
    built-in to Jinja, but could be present through custom filters in an
    application. After the fix, such indirect calls are also handled by the
    sandbox.

 -- Lee Garrett <debian@rocketjump.eu>  Thu, 27 Feb 2025 22:30:54 +0100

jinja2 (3.1.2-1+deb12u1) bookworm; urgency=medium

  * Non-maintainer upload.
  * CVE-2024-22195: HTML attribute injection (Closes: #1060748)
  * CVE-2024-34064: HTML attribute injection (Closes: #1070712)

 -- Adrian Bunk <bunk@debian.org>  Sat, 07 Dec 2024 19:15:36 +0200

jinja2 (3.1.2-1) unstable; urgency=medium

  [ Thomas Goirand ]
  * Add python3-pytest as build-depends (now run tests at build time).
  * Add autopkgtest.

  [ Piotr Ożarowski ]
  * New upstream release (closes: 1025808, 1023637)
  * Add 0003-fix-nose-leftovers patch
  * Bump minimum required python3-pallets-sphinx-themes build dependency
    (closes: 1005864)

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 24 Feb 2023 16:15:45 +0100

jinja2 (3.0.3-2) unstable; urgency=medium

  * Team upload.
  * Downgrading python3-babel from depends to recommends (Closes: #1019580).

 -- Thomas Goirand <zigo@debian.org>  Tue, 13 Sep 2022 10:26:29 +0200

jinja2 (3.0.3-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 11 Feb 2022 13:50:47 +0100

jinja2 (3.0.1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 01 Oct 2021 11:22:02 +0200

jinja2 (3.0.1-1) experimental; urgency=medium

  [ Debian Janitor ]
  * Remove constraints unnecessary since stretch:
    + Build-Depends: Drop versioned constraint on python-setuptools.

  [ Thomas Goirand ]
  * Team upload.
  * New upstream release.
  * Ran wrap-and-sort -bastk.
  * Fixed (build-)depends for this release.
  * Killed the python2 package.
  * Rebase patches:
    - re-wrote py3.9-fix-collections-import.patch
    - refreshed 0002-docs-disable-sphinxcontrib.log_cabinet.patch
  * Use debian/jinja.vim instead of the one upstream, gone in this version.

 -- Thomas Goirand <zigo@debian.org>  Fri, 17 Sep 2021 23:25:00 +0200

jinja2 (2.11.3-1) unstable; urgency=medium

  * Team upload.

  [ Ondřej Nový ]
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Debian Janitor ]
  * Apply multi-arch hints.
    + python-jinja2-doc: Add Multi-Arch: foreign.

  [ Sandro Tosi ]
  * Use the new Debian Python Team contact name and address

  [ Hans-Christoph Steiner ]
  * New upstream release

 -- Hans-Christoph Steiner <hans@eds.org>  Mon, 01 Mar 2021 12:05:52 +0100

jinja2 (2.11.2-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 04 Jun 2020 19:31:21 +0200

jinja2 (2.11.1-1) unstable; urgency=medium

  [ Thomas Goirand ]
  * py3.9-fix-collections-import.patch: correctly "except ImportError:"
    everywhere in the patch.

  [ Salman Mohammadi ]
  * d/control: change python-jinja2-doc to recommend python3-jinja2
    (closes: 951672)


  [ Piotr Ożarowski ]
  * New upstream release
  * Add python3-pallets-sphinx-themes and python3-sphinx-issues to Build-Depends
  * Add patch to disable sphinxcontrib.log_cabinet for now as it's not
    packaged in Debian yet (versionadded, versionchanged, deprecated
    directives in changelog will not be used)
  * Move Vim syntax files to python3-jinja2 package
  * Standards-version bumped to 4.5.0 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 02 Apr 2020 13:35:21 +0200

jinja2 (2.10.1-2) unstable; urgency=medium

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.
  * Bump Standards-Version to 4.4.1.

  [ Thomas Goirand ]
  * Team upload.
  * Add py3.9-fix-collections-import.patch (Closes: #949018).

 -- Thomas Goirand <zigo@debian.org>  Thu, 27 Feb 2020 11:49:32 +0100

jinja2 (2.10.1-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/control: Set Vcs-* to salsa.debian.org
  * d/changelog: Remove trailing whitespaces
  * d/control: Remove ancient X-Python-Version field
  * d/control: Remove ancient X-Python3-Version field
  * Convert git repository from git-dpm to gbp layout

  [ Piotr Ożarowski ]
  * New upstream release
  * Standards-version bumped to 4.4.0 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 10 Jul 2019 22:34:15 +0200

jinja2 (2.10-2) unstable; urgency=high

  [ Thomas Goirand ]
  * CVE-2019-10906: In Pallets Jinja before 2.10.1, str.format_map allows a
    sandbox escape. Applied upstream patch: sandbox_str.format_map.patch
    (Closes: #926602).

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 09 Apr 2019 21:58:20 +0200

jinja2 (2.10-1) unstable; urgency=medium

  * New upstream release
  * Add python3-sphinx to Build-Depends and invoke dh_sphinxdoc after building
    documentation
  * Standards-version bumped to 4.1.1
    - -doc package's Priority changed to optional

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 30 Nov 2017 10:54:37 +0100

jinja2 (2.9.6-1) unstable; urgency=medium

  [ Piotr Ożarowski ]
  * New upstream release
  * Install CHANGES file as upstream changelog (closes: 857722)
  * Standards-version bumped to 4.0.0 (no other changes needed)

  [ Michael Hudson-Doyle ]
  * Install asyncsupport.py and asyncfilters.py now that Python 3.6 is a
    supported version (but do not compile them on install with Python 3.5).
    (closes: 862699)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 20 Jun 2017 15:21:18 +0200

jinja2 (2.9.5-1) unstable; urgency=medium

  * New upstream release
    - restores original repr of the internal _GroupTuple which fixes ansible
    (closes: 851741)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 07 Feb 2017 22:27:54 +0100

jinja2 (2.9.4-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * Fixed VCS URL (https)

  [ Piotr Ożarowski ]
  * New upstream release
    - do not install async* files, they require Python >= 3.6
  * Standards-version bumped to 3.9.8 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 10 Jan 2017 20:28:57 +0100

jinja2 (2.8-1) unstable; urgency=medium

  * New upstream release
    - drop jinja2-typos and drop_next_import_from_docs-jinjaext patches - both
      applied upstream
  * rewrite debian/rules to dh sequencer and pybuild buildsystem
  * Standards-version bumped to 3.9.6 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Sat, 01 Aug 2015 14:15:36 +0200

jinja2 (2.7.3-1) unstable; urgency=medium

  * New upstream release
  * Drop fix_CVE-2014-0012.patch (better fix applied upstream)
  * Homepage updated

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 10 Jun 2014 20:44:26 +0200

jinja2 (2.7.2-2) unstable; urgency=high

  * Add fix_CVE-2014-1402 patch which uses tempfile.mkdtemp to create
    cache dir (closes: 734956)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 12 Jan 2014 15:09:04 +0100

jinja2 (2.7.2-1) unstable; urgency=high

  * New upstream release
    - changes default folder for the filesystem cache (closes: 734747,
      CVE-2014-1402)

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 10 Jan 2014 20:56:20 +0100

jinja2 (2.7.1-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 08 Aug 2013 22:25:01 +0200

jinja2 (2.7-3) unstable; urgency=low

  [ Jakub Wilk ]
  * Restore Python 3.2 compatibility (closes: #709638)
  * Fix bunch of typos in the documentation (closes: #679534)

 -- Piotr Ożarowski <piotr@debian.org>  Sat, 25 May 2013 23:07:10 +0200

jinja2 (2.7-2) unstable; urgency=low

  * Relax build dependency on python3-all and hardcode python3-jinja2's
    Depends and postinst maintainer script (temporary fix, closes: #709390)

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 23 May 2013 18:42:20 +0200

jinja2 (2.7-1) unstable; urgency=low

  [ Jakub Wilk ]
  * Use canonical URIs for Vcs-* fields.

  [ Piotr Ożarowski ]
  * New upstream release
    - minimum required Python version bumped to 2.6 and 3.3
  * debugsupport extension no longer available, Architecture changed to "all"
  * Bump minimum required python3-all version in Build-Depends (to generate
    versioned py3compile -V in maintainer script)
  * Add patches/drop_next_import_from_docs-jinjaext.patch to fix building docs
  * Use dh_sphinxdoc to handle JavaScript libraries used in -doc package
  * Standards-Version bumped to 3.9.4
    - add build-arch and build-indep targets
  * debian/compat changed to 9

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 20 May 2013 21:15:37 +0200

jinja2 (2.6-1) unstable; urgency=low

  * New upstream release
  * add_version_placeholder patch removed (no longer needed)
  * htmljinja.vim is no longer available, use jinja.vim instead
  * python3-jinja2 suggests python-jinja2-doc instead of python3-jinja2-doc
  * Standards-version bumped to 3.9.2 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 25 Jul 2011 10:31:24 +0200

jinja2 (2.5.5-5) unstable; urgency=low

  * Drop hardcoded python3.1 from Depends (closes: #621816)
  * Do not compress objects.inv file (closes: #608757)

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 15 Apr 2011 22:05:53 +0200

jinja2 (2.5.5-4) unstable; urgency=low

  * Upload to unstable (closes: 621001)
  * Lower versions of build dependencies (to the ones from 2.5.5-1)
  * Convert from dh_pysupport to dh_python2
  * Change source format to 3.0 (quilt), drop quilt build dependency

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 05 Apr 2011 23:21:21 +0200

jinja2 (2.5.5-3) experimental; urgency=low

  * Bump minimum required python-support version to the one in experimental
    to get Python 2.7 support (closes: 608149)

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 27 Dec 2010 23:15:04 +0100

jinja2 (2.5.5-2) experimental; urgency=low

  * Rebuild for Python 2.7 and 3.2 extension (minimum required python-all's
    version temporary bumped to 2.6.6-4, python-setuptools' to 0.6.14-5
    and python3-all's to 3.1.2-14 to make sure the right version from
    experimental will be used). Closes: 607450.
  * Update debian/rules to handle Python >= 3.2

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 21 Dec 2010 20:58:19 +0100

jinja2 (2.5.5-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 19 Oct 2010 08:34:49 +0200

jinja2 (2.5.4-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 17 Oct 2010 20:48:21 +0200

jinja2 (2.5.2-3) unstable; urgency=low

  * Rebuild against newer python3-all-dev package (python3.1 now uses
    /usr/lib/python3/), minimum python3-all version bumped to 3.1.2-10
  * Use python3's python.mk
  * Drop python3-jinja2.{postinst,prerm} maintainer scripts, dh_python3 will
    generate them

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 26 Sep 2010 21:19:54 +0200

jinja2 (2.5.2-2) unstable; urgency=low

  * Really remove _markupsafe

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 19 Aug 2010 09:24:47 +0200

jinja2 (2.5.2-1) unstable; urgency=low

  * New upstream release
    - speedups module moved to separate package: MarkupSafe
  * python-markupsafe added to Depends (jinja2._markupsafe removed from the
    package)
  * debian/control: python3-jinja2 binary package updated to latest changes in
    dh_python3
  * Standards-version bumped to 3.9.1 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 18 Aug 2010 11:29:44 +0200

jinja2 (2.5-1) unstable; urgency=low

  * New upstream release
  * python3_builtins.patch removed, no longer needed
  * add python3.1 to python3-jinja2's Depends

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 30 May 2010 11:01:51 +0200

jinja2 (2.4.1-1) unstable; urgency=low

  * New upstream release
  * Add python3_builtins.patch taken from upstream repo (Different name for
    builtins in Python 3)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 20 Apr 2010 19:51:16 +0200

jinja2 (2.4-3) unstable; urgency=low

  * Add missing maintainer scripts in python3-jinja2 package

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 18 Apr 2010 17:15:49 +0200

jinja2 (2.4-2) unstable; urgency=low

  * Add Python 3 support, new binary packages:
    python3-jinja2 and python3-jinja2-dbg

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 13 Apr 2010 20:44:43 +0200

jinja2 (2.4-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 13 Apr 2010 19:52:05 +0200

jinja2 (2.3.1-1) unstable; urgency=low

  * New upstream release
  * Move python-pybabel from Recommends to Enhances

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 19 Feb 2010 18:31:52 +0100

jinja2 (2.3-1) unstable; urgency=low

  * New upstream release
  * Hardcode __version__ at build time, no need to use pkg_resources
    (Closes: #548062)
  * Standards-version bumped to 3.8.4 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 10 Feb 2010 22:06:28 +0100

jinja2 (2.2.1-1) unstable; urgency=low

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 15 Sep 2009 19:38:47 +0200

jinja2 (2.2-1) unstable; urgency=low

  [ Jakub Wilk ]
  * Build depend on Sphinx >= 0.6 (due to changes_for_sphinx_0.6 patch)

  [ Piotr Ożarowski ]
  * New upstream release (Closes: #536227)
  * No longer needed patches:
    - changes_for_sphinx_0.6.patch
    - dont_install_docs_via_setup_py.patch
  * pass --with-speedups to setup.py (building extension is now disabled by
    default in upstream code)
  * debian/copyright file updated
  * Standards-version bumped to 3.8.3 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 13 Sep 2009 16:44:18 +0200

jinja2 (2.1.1-3) unstable; urgency=low

  * Documentation builds fine with new Sphinx now, thanks to
    Jakub Wilk for the patch (Closes: #527486)
  * Standards-version bumped to 3.8.2:
    - python-jinja2-dbg's section changed to debug
  * Support /usr/local/*/dist-packages in debian/rules (python2.6 will need it)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 08 Jul 2009 21:40:46 +0200

jinja2 (2.1.1-2) unstable; urgency=low

  * Install Vim syntax files in /usr/share/vim/addons/syntax/
    Use `vim-addons install jinja` to enable it (Closes: 514046)
  * Upload to unstable

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 10 Feb 2009 19:59:56 +0100

jinja2 (2.1.1-1) experimental; urgency=low

  * New upstream release
  * Build depend on Sphinx >= 0.5.1
    + remove_non_ascii_char patch removed

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 25 Dec 2008 19:10:36 +0100

jinja2 (2.1-1) experimental; urgency=low

  [ Sandro Tosi ]
  * Switch Vcs-Browser field to viewsvn

  [ Piotr Ożarowski ]
  * New upstream release
  * Bump required python-sphinx version to >= 0.5 (needed to build docs)
    + upload to experimental (Sphinx 0.5 is in experimental for now)
  * Add remove_non_ascii_char patch (to workaround docutils/Sphinx bug)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 30 Nov 2008 20:14:33 +0100

jinja2 (2.0-2) unstable; urgency=low

  * Recommend python-pybabel instead of python-babel (Closes: #501725)

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 09 Oct 2008 22:43:11 +0200

jinja2 (2.0-1) unstable; urgency=low

  * Initial release (this package is an successor of jinja package)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 20 Jul 2008 23:01:02 +0200