dom4j (1.6.1+dfsg.3-2ubuntu1.2) xenial-security; urgency=medium

  * SECURITY UPDATE: XML injection attack
    - debian/patches/07_disable_xsd_support.patch: Drop patch as dom4j is in
      universe in xenial.
    - debian/patches/CVE-2018-1000632.patch: Validate QName inputs - throw
      IllegalArgumentException when qualified name contains disallowed
      character.
    - debian/patches/testng.patch: Build and test AllowedCharsTest to verify
      that CVE-2018-1000632 is correctly addressed.
    - debian/patches/fix_test_names.patch: Fix tests with invalid QNames.
    - debian/control: Add testng, libmsv-java, and librelaxng-datatype-java to
      build-deps.
    - debian/rules: Add testng to ant target and add xsdlib to debian JARs.
    - CVE-2018-1000632

 -- Avital Ostromich <avital.ostromich@canonical.com>  Mon, 26 Oct 2020 13:04:45 -0400

dom4j (1.6.1+dfsg.3-2ubuntu1.1) xenial-security; urgency=medium

  * SECURITY UPDATE: XEE attack
    - debian/patches/CVE-2020-10683.patch: set more secure defaults for
      SAXReader in src/java/org/dom4j/DocumentHelper.java
    - CVE-2020-10683

 -- Avital Ostromich <avital.ostromich@canonical.com>  Tue, 06 Oct 2020 20:55:42 -0400

dom4j (1.6.1+dfsg.3-2ubuntu1) saucy; urgency=low

  * Drop support for XSD; this requires libmsv-java which is built using
    maven2 which is not in main:
    - d/control: Remove dependencies on libmsv-java.
    - d/rules: Don't include xsdlib on build classpath.
    - d/p/07_disable_xsd_support.patch: Patch out compilation and testing
      of XSD support features.

 -- James Page <james.page@ubuntu.com>  Tue, 02 Jul 2013 13:27:34 +0100

dom4j (1.6.1+dfsg.3-2) unstable; urgency=low

  * Removed the dependency on libjaxme-java
  * Use canonical URLs for the Vcs-* fields
  * Upload to unstable

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 26 Jun 2013 23:29:47 +0200

dom4j (1.6.1+dfsg.3-1) experimental; urgency=low

  * Team upload.
  * New repacking of upstream tarball that excludes jars and generated
    api docs.  Thanks to Emmanuel Bourg.

 -- tony mancill <tmancill@debian.org>  Sat, 20 Apr 2013 11:40:33 -0700

dom4j (1.6.1+dfsg.2-7) experimental; urgency=low

  * Team upload.
  * Removed the dependency on backport-util-concurrent
  * Update Standards-Version: 3.9.4 (no changes)
  * debian/rules: Added a get-orig-source target to fetch the upstream tarball.
    The generated content, jars and non free classes are filtered on the fly.
  * Enabled XSD support by adding a dependency on libmsv-java
  * Link the Javadoc to the default JRE doc instead of the Classpath doc
  * Reorganized the patches into smaller units
  * Fixed the Debian version mangling in debian/watch

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 15 Apr 2013 17:40:26 +0200

dom4j (1.6.1+dfsg.2-6) unstable; urgency=low

  * Team upload.

  [ tony mancill ]
  * Remove Michael Koch from uploaders (Closes: #654011)
  
  [ James Page ]
  * Fix FTBFS with openjdk-7 (LP: #888121) (Closes: #673765):
    - d/patches/java7-compat.patch: Fix compareTo function in Rule class
      to ensure that comparisions are actually symmetric. 

  [ Damien Raude-Morvan ]
  * Update Standards-Version: 3.9.3
  * d/copyright: Update to copyright-format 1.0.

 -- tony mancill <tmancill@debian.org>  Fri, 03 Feb 2012 21:26:13 -0800

dom4j (1.6.1+dfsg.2-5) unstable; urgency=low

  * Team upload.
  * Remove Java runtime from Depends.
  * Switch to cdbs.

 -- Torsten Werner <twerner@debian.org>  Wed, 17 Aug 2011 18:43:40 +0200

dom4j (1.6.1+dfsg.2-4) unstable; urgency=low

  * debian/control, debian/rules: Build with default-jdk

 -- Thierry Carrez <thierry.carrez@ubuntu.com>  Thu, 03 Jun 2010 16:14:12 +0200

dom4j (1.6.1+dfsg.2-3) unstable; urgency=low

  * Team upload.
  * Update Homepage to point to sourceforge site.
  * Install POM file.
  * Ignore test failures.
  * Add missing ${misc:Depends}.
  * Switch to source format 3.0.
  * Update Standards-Version: 3.8.4.

 -- Torsten Werner <twerner@debian.org>  Thu, 27 May 2010 22:14:45 +0200

dom4j (1.6.1+dfsg.2-2) unstable; urgency=low

  * Make libdom4j-java Depend on default-jre-headless instead of kaffe.
  * Build-Depends on debhelper >= 7.
  * Use dh_prep instead of dh_clean -k.
  * Updated Standards-Version to 3.8.3.

 -- Michael Koch <konqueror@gmx.de>  Fri, 25 Sep 2009 20:21:02 +0200

dom4j (1.6.1+dfsg.2-1) unstable; urgency=low

  * Remove non-free generated files. (Closes: #529308)
  * Change section to java.
  * Remove source files from jaxen since we have (circular) build
    dependency on libjaxen-java. (Closes: #427913)
  * Re-enable test case BeansTest by running tests in headless
    mode. (Closes: #403052)
  * Build-depend on ant-optional, since we use ant in the clean target.
  * debian/copyright: Machine-readable copyright format.
  * debian/control: Bump standards-version to 3.8.2.
  * Include sample code, thanks to Mario Lang. (Closes: #536079)

 -- Marcus Better <marcus@better.se>  Thu, 09 Jul 2009 20:34:46 +0200

dom4j (1.6.1+dfsg-3) unstable; urgency=low

  * Build-Depends on openjdk-6-jdk instead of java-gcj-runtime-dev. Fixes
    ThreadingTest testcase. Closes: #427456
  * Disabled parts of MatrixConcatTest. This fails on *every* runtime.
    Closes: #439614
  * Added myself to Uploaders.
  * Added Homepage, Vcs-Svn and Vcs-Browser fields.
  * Updated Standards-Version to 3.7.3.

 -- Michael Koch <konqueror@gmx.de>  Thu, 10 Apr 2008 07:59:15 +0200

dom4j (1.6.1+dfsg-2) unstable; urgency=high

  * The two classes from jaxen in package org.jaxen.dom4j were
    accidentally left out of the previous version. (Closes: #403039)

 -- Marcus Better <marcus@better.se>  Thu, 14 Dec 2006 13:04:57 +0100

dom4j (1.6.1+dfsg-1) unstable; urgency=low

  [ Wolfgang Baer ]
  * Disabled support for STAX and datatypes (xsdlib)

  [ Marcus Better ]
  * Initial release. (Closes: #305227)
  * Removed binary third-party jars from source tarball.
  * debian/rules: Don't use cdbs.

 -- Marcus Better <marcus@better.se>  Mon,  9 Oct 2006 21:24:19 +0200
