starlette (0.26.1-1+deb12u2) bookworm-security; urgency=medium

  * Non-maintainer upload by the Debian LTS team.
  * d/patches/CVE-2026-48817.patch: Add patch to fix CVE-2026-48817.
    - Fix a vulnerability where an HTTPEndpoint subclass is registered through
      Route() without an explicit methods argument, and the route does not
      constrain the method and every method reaches the endpoint.
  * d/patches/CVE-2026-54282.patch: Add patch to fix CVE-2026-54282.
    - Fix a vulnerability where the HTTP request path is not validated before
      being used to reconstruct request.url which can poison
      request.url.hostname and request.url.netloc (closes: #1140632).
  * d/patches/Add-max_part_size-parameter-to-MultiPartParser.patch,
    d/patches/CVE-2026-54283.patch: Add patches to fix CVE-2026-54283.
    - Fix that the max_fields and max_part_size limits for request.form() are
      enforced for multipart/form-data, but silently ignored for
      application/x-www-form-urlencoded (closes: #1140631).

 -- Daniel Leidert <dleidert@debian.org>  Sat, 01 Aug 2026 01:27:26 +0200

starlette (0.26.1-1+deb12u1) bookworm-security; urgency=medium

  * Team upload.
  * d/gbp.conf: Update to Bookworm
  * d/patches: (Closes: #1085295, #1109805, #1137375)
    - CVE-2023-29159: Import upstream patch
      (directory traversal vulnerability in StaticFiles)
    - CVE-2024-47874: Import and backport upstream patch
      (DoS via unlimited multipart/form-data field buffering)
    - CVE-2025-54121: Import and backport upstream patch
      (event loop blocking on large multipart uploads to disk)
    - CVE-2026-48710: Import and backport upstream patch
      (Ignore malformed Host when constructing request.url)

 -- Matheus Polkorny <mpolkorny@gmail.com>  Fri, 22 May 2026 13:26:42 -0300

starlette (0.26.1-1) unstable; urgency=medium

  * New upstream release
  * Set Testsuite: autopkgtest-pkg-pybuild

 -- Piotr Ożarowski <piotr@debian.org>  Sat, 01 Apr 2023 15:33:33 +0200

starlette (0.25.0-2) unstable; urgency=medium

  * Breaks: python3-fastapi (<< 0.91.0-1~) closes: 1031898

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 24 Feb 2023 22:14:04 +0100

starlette (0.25.0-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Fri, 17 Feb 2023 14:04:31 +0100

starlette (0.24.0-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 09 Feb 2023 15:32:29 +0100

starlette (0.23.1-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Bump debhelper from old 12 to 13.
  * Update standards version to 4.6.1, no changes needed.
  * Remove constraints unnecessary since buster (oldstable):
    + Build-Depends: Drop versioned constraint on python3-all.

  [ Sandro Tosi ]
  * New upstream release
  * debian/control
    - replace b-d on dh-python with pybuild-plugin-pyproject
    - add hatchling to b-d, needed by pyproject.toml
    - add httpx to b-d, needed by tests
    - drop requests from b-d, replaced by httpx

 -- Sandro Tosi <morph@debian.org>  Fri, 09 Dec 2022 16:15:21 -0500

starlette (0.20.4-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 15 Sep 2022 21:35:23 +0200

starlette (0.18.0-1) unstable; urgency=medium

  * New upstream release
    - add python3-typing-extensions to Build-Depends
    - GraphQL support removed

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 09 Feb 2022 17:35:18 +0100

starlette (0.16.0-1) unstable; urgency=medium

  [ Sandro Tosi ]
  * Use the new Debian Python Team contact name and address

  [ Piotr Ożarowski ]
  * New upstream release
  * Add python3-anyio to Build-Depends (used by tests)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 17 Aug 2021 15:04:44 +0200

starlette (0.14.1-1) unstable; urgency=medium

  * New upstream release
    - UJSONResponse no longer supported - python3-ujson removed from Recommends

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 12 Nov 2020 19:51:13 +0100

starlette (0.13.8-1) unstable; urgency=low

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Ondřej Nový ]
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Piotr Ożarowski ]
  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 24 Sep 2020 10:45:41 +0200

starlette (0.13.7-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 11 Aug 2020 12:54:28 +0200

starlette (0.13.4-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Sat, 02 May 2020 00:06:35 +0200

starlette (0.13.3-1) unstable; urgency=medium

  * New upstream release

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 27 Apr 2020 14:44:24 +0200

starlette (0.13.2-1) unstable; urgency=low

  * Initial release (closes: 954102)

 -- Piotr Ożarowski <piotr@debian.org>  Mon, 16 Mar 2020 18:07:04 +0000
