xwayland (2:24.1.11-1deepin10) unstable; urgency=medium

  * fix(cve): CVE-2026-50262 (medium) - glx: fix reversed length check
    in ChangeDrawableAttributes   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/6d459e4daf715bea8abdafa8fb130be2f8a1d145
  * fix(cve): CVE-2026-93516 (unknown) - [PATCH] dix: remove passive
    grabs referencing a device on removal   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/9442a53c137bb9eb61336c6fd39627912d50cc8d.patch
  * fix(cve): CVE-2026-93518 (unknown) - xkb: widen size_syms, num_syms,
    size_acts, num_acts to unsigned int   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/558ba8f784b0f5d4d96948051b2f04c983af20cc
  * fix(cve): CVE-2026-93517 (unknown) - glx: validate dataBytes against
    cmdlen in RenderLarge first request   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a.patch
  * fix(cve): CVE-2026-93519 (unknown) - Xi: add bounds check for
    barrier events in input_constrain_cursor   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/9c3880d0745acefc98ed37e79498dfbe558a0f40
  * fix(cve): CVE-2026-93521 (unknown) - randr: fix size and offset in
    RRChangeProviderProperty PrependMode   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/00ce692c7f6ea1900888a2a24aecf6cba5544ae1
  * fix(cve): CVE-2026-93524 (unknown) - xkb: fix CheckKeySyms
    overwriting request-range symsPerKey entries   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/927ee1282d21550807619521bee909ef62ed0571
  * fix(cve): CVE-2026-93515 (unknown) - present: unlink notifies from
    window list in present_clear_window_notifies   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/a469f98bcfab50dab607ff5ac24037632b0079a3
  * fix(cve): CVE-2026-93520 (unknown) - [PATCH] xkb: allocate names-
    >keys to MAP_LENGTH in XkbAllocNames   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/5ec0535af2bcc93381666dc110abebba8975f8ae
  * fix(cve): CVE-2026-93536 (unknown) - Xi: clean up gesture sprite
    traces in WindowGone   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/4c9c345d2a10baf956fdefa83bb88681f7c840cf.patch
  * fix(cve): CVE-2026-93523 (unknown) - [PATCH] Xi: validate modifier
    values in ProcXIPassiveUngrabDevice   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/aa56160fa213d8767e7da0c076b5c8242703313b.patch
  * fix(cve): CVE-2026-88812 (unknown) - xkb: NULL text pointer after
    free in _CheckSetDoodad error path   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/c724006ee76fb002add50fcb4d97e8c96c279f09.patch
  * fix(cve): CVE-2026-93522 (unknown) - glamor: size tmp_bits buffer
    for source coordinate range in upload_boxes   Upstream:
    https://gitlab.freedesktop.org/xorg/xserver/-
    /commit/d6deb27b655abae79396bf3aedc2937a10ae2d4f.patch

 -- deepin-ci-robot <packages@deepin.org>  Sat, 19 Sep 2026 10:40:42 +0800

xwayland (2:24.1.11-1deepin9) unstable; urgency=medium

  * fix(cve): CVE-2026-55999

 -- deepin-ci-robot <packages@deepin.org>  Thu, 06 Aug 2026 04:11:37 +0800

xwayland (2:24.1.11-1deepin8) unstable; urgency=medium

  * fix(cve): CVE-2026-56000

 -- deepin-ci-robot <packages@deepin.org>  Thu, 06 Aug 2026 04:04:51 +0800

xwayland (2:24.1.11-1deepin7) unstable; urgency=medium

  * GLX/DIX memory safety fixes

 -- deepin-ci-robot <packages@deepin.org>  Tue, 09 Jun 2026 10:22:12 +0800

xwayland (2:24.1.11-1deepin6) unstable; urgency=medium

  * Composite/GLX/Saver use-after-free

 -- deepin-ci-robot <packages@deepin.org>  Tue, 09 Jun 2026 10:22:12 +0800

xwayland (2:24.1.11-1deepin5) unstable; urgency=medium

  * XkbChangeKeycodeRange use-after-free

 -- deepin-ci-robot <packages@deepin.org>  Tue, 09 Jun 2026 10:22:12 +0800

xwayland (2:24.1.11-1deepin4) unstable; urgency=medium

  * XkbChangeKeycodeRange out-of-bounds access

 -- deepin-ci-robot <packages@deepin.org>  Tue, 09 Jun 2026 10:22:12 +0800

xwayland (2:24.1.11-1deepin3) unstable; urgency=medium

  * XkbSetDeviceInfo signedness buffer overflow

 -- deepin-ci-robot <packages@deepin.org>  Tue, 09 Jun 2026 10:22:12 +0800

xwayland (2:24.1.11-1deepin2) unstable; urgency=medium

  * XkbSetDeviceInfo heap buffer overflow

 -- deepin-ci-robot <packages@deepin.org>  Tue, 09 Jun 2026 10:22:12 +0800

xwayland (2:24.1.11-1deepin1) unstable; urgency=medium

  * XkbSetMap keyboard geometry buffer overflow

 -- deepin-ci-robot <packages@deepin.org>  Tue, 09 Jun 2026 10:22:12 +0800

xwayland (2:24.1.11-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 28 Apr 2026 09:11:08 +0300

xwayland (2:24.1.10-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
    - CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
    - CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
    - CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
    - CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()
  * control: Bump build-depends on x11proto-dev.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Apr 2026 17:16:12 +0300

xwayland (2:24.1.9-1) unstable; urgency=medium

  [ Alessandro Astone ]
  * Enable input emulation through XDG Desktop Portal (LP: #2075962)
  * Actually set debian builder string

  [ Timo Aaltonen ]
  * New upstream release.
    - CVE-2025-62229
    - CVE-2025-62230
    - CVE-2025-62231

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 24 Nov 2025 19:17:29 +0200

xwayland (2:24.1.8-1) unstable; urgency=medium

  * Add README.Debian.security to clarify how the security issues are
    inherited from the shared codebase with xorg-server, and don't
    actually apply to xwayland. Thanks, Moritz Muehlenhoff!
  * New upstream release. (Closes: #1108369)
    - CVE-2025-49175
    - CVE-2025-49176
    - CVE-2025-49177
    - CVE-2025-49178
    - CVE-2025-49179
    - CVE-2025-49180

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 27 Aug 2025 10:25:23 +0300

xwayland (2:24.1.6-1) unstable; urgency=medium

  * New upstream release. Fixes:
    - CVE-2025-26594: use-after-free of the root cursor
    - CVE-2025-26595: buffer overflow in XkbVModMaskText
    - CVE-2025-26596: heap overflow in XkbWriteKeySyms
    - CVE-2025-26597: buffer overflow in XkbChangeTypesOfKey
    - CVE-2025-26598: out-of-bounds write in CreatePointerBarrierClient
    - CVE-2025-26599: use of uninitialized pointer in compRedirectWindow
    - CVE-2025-26600: use-after-free in PlayReleasedEvents
    - CVE-2025-26601: use-after-free in SyncInitTrigger
    (Closes: #1098907).

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Wed, 26 Feb 2025 10:22:59 +0100

xwayland (2:24.1.5-1) unstable; urgency=medium

  * New upstream release.
  * patches: Drop upstreamed patches.
  * xwayland-Detect-gbm_bo_get_fd_for_plane-at-runtime.patch: Dropped,
    likely unneeded by now for Xilinx.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 06 Feb 2025 09:56:57 +0200

xwayland (2:24.1.4-3) unstable; urgency=medium

  [ Alessandro Astone ]
  * Add patch to fix possible crash after the previous backport
    (LP: #2096653)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 27 Jan 2025 13:17:11 +0200

xwayland (2:24.1.4-2) unstable; urgency=medium

  [ Alessandro Astone ]
  * Backport patch to fix busy-loop on inactive VT (LP: #2043517)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 16 Dec 2024 14:27:57 +0200

xwayland (2:24.1.4-1) unstable; urgency=medium

  * New upstream release
    + CVE-2024-9632: Heap-based buffer overflow privilege escalation in
      _XkbSetCompatMap (closes: #1086244)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 30 Oct 2024 12:01:08 +0200

xwayland (2:24.1.3-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Oct 2024 13:13:19 +0300

xwayland (2:24.1.2-1) unstable; urgency=medium

  * New upstream release.
  * control: Bump libdrm-dev build-dependency. (Closes: #1076005)
  * patches: Refreshed.
  * control: Migrate to pkgconf.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 08 Aug 2024 09:56:38 +0300

xwayland (2:24.1.0-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 15 May 2024 16:57:31 +0300

xwayland (2:24.0.99.901-1) experimental; urgency=medium

  * New upstream release candidate.
  * patches: Refreshed.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 26 Apr 2024 13:27:37 +0300

xwayland (2:23.2.6-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2024-31080
    - CVE-2024-31081
    - CVE-2024-31083
  * control: Add libtirpc-dev to build-depends. (Closes: #1065184)

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 13 Apr 2024 16:58:45 +0300

xwayland (2:23.2.4-1) unstable; urgency=medium

  * New upstream release
    - CVE-2023-6816
    - CVE-2024-0229
    - CVE-2024-21885
    - CVE-2024-21886
    - CVE-2024-0408
    - CVE-2024-0409

 -- Julien Cristau <jcristau@debian.org>  Wed, 17 Jan 2024 11:20:05 +0100

xwayland (2:23.2.3-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-6377
    - CVE-2023-6478

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Dec 2023 10:35:39 +0200

xwayland (2:23.2.2-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-5367
    - CVE-2023-5380
    - CVE-2023-5574
  * control: Add libdecor-0-dev to build-depends. (Closes: #1054529)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 Oct 2023 10:51:36 +0300

xwayland (2:23.2.1-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 20 Sep 2023 16:09:23 +0300

xwayland (2:23.2.0-1) unstable; urgency=medium

  * New upstream release.
  * patches: Refreshed.
  * control: Bump x11proto-dev depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Aug 2023 15:27:59 +0300

xwayland (2:23.1.1-1) experimental; urgency=medium

  * New upstream release.
  * control: Fix cross-building, add libwayland-dev:native to build-
    depends. (Closes: #1002515)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 11 May 2023 13:10:04 +0300

xwayland (2:23.1.0-1) experimental; urgency=medium

  * New upstream release.
  * patches: Refreshed.
  * install: Add desktop file.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 24 Mar 2023 11:26:25 +0200

xwayland (2:22.1.8-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-0494

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 07 Feb 2023 15:14:38 +0200

xwayland (2:22.1.7-1) unstable; urgency=medium

  * New upstream release.
  * rules, install: Ship the .pc file. (Closes: #1025742)
  * rules: Enable full hardening flags. (Closes: #1026168)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 24 Jan 2023 09:37:32 +0200

xwayland (2:22.1.6-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-46340, CVE-2022-46341, CVE-2022-46342, CVE-2022-46343,
      CVE-2022-46344, CVE-2022-4283
  * Add signing-key from Peter Hutterer.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Dec 2022 16:26:30 +0200

xwayland (2:22.1.5-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 03 Nov 2022 15:38:36 +0100

xwayland (2:22.1.3-2) unstable; urgency=medium

  [ Daniel van Vugt ]
  * Add xwayland-Detect-gbm_bo_get_fd_for_plane-at-runtime.patch

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 25 Aug 2022 13:03:43 +0300

xwayland (2:22.1.3-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-2319, CVE-2022-2320

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 26 Jul 2022 14:39:48 +0300

xwayland (2:22.1.2-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 02 Jun 2022 15:16:00 +0300

xwayland (2:22.1.1-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 01 Apr 2022 09:40:47 +0300

xwayland (2:22.1.0-1) unstable; urgency=medium

  * New upstream release.
  * control: Bump policy to 4.6.0.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Feb 2022 20:20:06 +0200

xwayland (2:22.0.99.902-1) unstable; urgency=medium

  * New upstream release candidate.
  * control: Add libxcvt-dev to build-depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 03 Feb 2022 12:56:33 +0200

xwayland (2:21.1.4-1) unstable; urgency=medium

  * New upstream release.
  * render: Fix out of bounds access in SProcRenderCompositeGlyphs()
    [CVE-2021-4008]
  * xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
    [CVE-2021-4009]
  * Xext: Fix out of bounds access in SProcScreenSaverSuspend()
    [CVE-2021-4010]
  * record: Fix out of bounds access in SwapCreateRegister()
    [CVE-2021-4011]

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Dec 2021 16:19:18 +0200

xwayland (2:21.1.3-1) unstable; urgency=medium

  * Initial release. (Closes: #981841, #992146)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 08 Nov 2021 16:39:28 +0200
