libheif (1.21.2-3ubuntu0.4) resolute-security; urgency=medium

  * SECURITY UPDATE: Integer underflow in Fraction constructor via double clap
    transform application
    - debian/patches/CVE-2026-62289.patch: Fix clap transform double-application
      in image tiling in libheif/box.cc, libheif/context.cc,
      libheif/image-items/image_item.cc, tests/CMakeLists.txt,
      tests/clap_zero_size.cc.
    - CVE-2026-62289
  * SECURITY UPDATE: Out-of-bounds read in uncompressed unci tile range slicing
    - debian/patches/CVE-2026-62292.patch: fix possible integer overflow in
      libheif/codecs/uncompressed/decoder_abstract.cc.
    - CVE-2026-62292

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 17 Aug 2026 13:59:51 -0400

libheif (1.21.2-3ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow in Track::get_next_sample_raw_data
    - debian/patches/CVE-2026-47254-1.patch: Validate stsc sample coverage
      in libheif/sequences/track.cc
    - debian/patches/CVE-2026-47254-2.patch: add defensive check in
      init_sample_timing_table() in libheif/sequences/track.cc
    - CVE-2026-47254
  * SECURITY UPDATE: Integer overflow when parsing uncC.
    - debian/patches/CVE-2026-47709-1.patch: Prevent integer overflow
      when parsing uncC in libheif/codecs/uncompressed/unc_boxes.cc
    - debian/patches/CVE-2026-47709-2.patch: Reject unci images with no ispe
      box in libheif/image-items/unc_image.cc
    - CVE-2026-47709
  * SECURITY UPDATE: Integer overflow in inline mask size calculation
    - debian/patches/CVE-2026-47714.patch: Fix computation of size of inline
      region mask in libheif/region.cc
    - CVE-2026-47714
  * SECURITY UPDATE: OOB read in ImageItem_Grid::decode_grid_tile.
    - debian/patches/CVE-2026-48029.patch: Fix tile coordinates validation
      in rotated images in libheif/api/libheif/heif_tiling.cc and
      libheif/image-items/image_item.cc
    - CVE-2026-48029
  * SECURITY UPDATE: Unbounded heap allocation in sequence parser.
    - debian/patches/CVE-2026-50142.patch: Fix check against security limit
      in libheif/sequences/seq_boxes.cc and ../track.cc
    - CVE-2026-50142

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 07 Jul 2026 12:04:31 -0600

libheif (1.21.2-3ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bound memory access in tiled chroma decode.
    - debian/patches/CVE-2026-47178.patch: Fix heap OOB in
      libheif/codecs/uncompressed/decoder_component_interleave.cc,
      ../decoder_mixed_interleave.cc, and tests/uncompressed_encode.cc
    - CVE-2026-47178
  * SECURITY UPDATE: Integer overflow in UNCI.
    - debian/patches/CVE-2026-49271.patch: Prevent integer overflow
      when reading compressed data in
      libheif/codecs/uncompressed/decoder_abstract.cc
    - CVE-2026-49271

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 23 Jun 2026 15:00:39 -0600

libheif (1.21.2-3ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service in Chuck construtor
    - debian/patches/CVE-2026-32738.patch: Check that 'stsc' box does not
      have zero samples per chunk in libheif/sequences/seq_boxes.cc
    - CVE-2026-32738
  * SECURITY UPDATE: Infinite loop for sequences with variable frame-rate.
    - debian/patches/CVE-2026-32739.patch: Fix infinite loop for sequences
      with variable frame-rate in libheif/api/libheif/heif_uncompressed.h
      and libheif/sequences/seq_boxes.cc
    - CVE-2026-32739
  * SECURITY UPDATE: Heap overflow in grid tile compositing.
    - debian/patches/CVE-2026-32740.patch: Fix computation of tile memory
      area for 4:2:0 chroma and odd tile sizes in libheif/pixelimage.cc
    - CVE-2026-32740
  * SECURITY UPDATE: Buffer overflow when reading mask image.
    - debian/patches/CVE-2026-32741.patch: Fix possible buffer overflow when
      reading mask image in libheif/image-items/mask_image.cc
    - CVE-2026-32741
  * SECURITY UPDATE: Information leak in decode.
    - debian/patches/CVE-2026-32814.patch: Initialize allocated memory to
      avoid information leak in
      libheif/image-items/grid.cc and libheif/pixelimage.cc
    - CVE-2026-32814
  * SECURITY UPDATE: Heap overflow in HeifPixelImage.
    - debian/patches/CVE-2026-32882.patch: Fix overlay image with alpha
      channels with stride different from color channel in
      libheif/pixelimage.cc
    - CVE-2026-32882
  * SECURITY UPDATE: Out-of-bounds read in Track::load.
    - debian/patches/CVE-2026-3950.patch: Validate stsc sample coverage
      against stsz/stts in libheif/sequences/track.cc
    - CVE-2026-3950
  * SECURITY UPDATE: Out-of-bounds read in decoder.
    - debian/patches/CVE-2026-41069.patch: Reject malformed sequence
      files with saiz samples but no chunks in libheif/sequences/track.cc
    - CVE-2026-41069
  * SECURITY UPDATE: Out-of-bounds read in SampleAuxInfoReader
    - debian/patches/CVE-2026-41071.patch: Reject malformed sequence
      files where saiz sample count exceeds actual samples in
      libheif/sequences/track.cc
    - CVE-2026-41071

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 16 Jun 2026 15:03:55 -0600

libheif (1.21.2-3) unstable; urgency=medium

  * Team upload
  * Have libheif-dev depend on libbrotli-dev as required by the
    pkgconfig file.
  * Demote libheif-plugin-libde265 from Depends to Suggests on Ubuntu
    to avoid possible patent concerns.
  * d/rules: Fix substvar assignment syntax for libheif:Suggests and
    libheif:Recommends (colon was used instead of equals sign, causing
    the variables to expand to empty strings)

 -- Charles <charles05@canonical.com>  Sat, 21 Feb 2026 14:12:49 -0000

libheif (1.21.2-2) unstable; urgency=medium

  * Team upload
  * Don't build kvazaar plugin on loong64 because kvazaar FTBFS there

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 07 Feb 2026 11:24:57 -0500

libheif (1.21.2-1) unstable; urgency=medium

  * New upstream version 1.21.2
    - Fixes CVE-2025-68431 (Closes: #1124317).
  * Remove patches applied upstream.
  * Update symbols for new upstream version.
  * d/control: Update build dependencies for cmake AOM detection.
  * d/control: Update Standards-Version to 4.7.3 and remove optional priority.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 19 Jan 2026 16:27:41 +0100

libheif (1.20.2-2) unstable; urgency=medium

  * Upload to unstable.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 18 Aug 2025 13:26:19 +0200

libheif (1.20.2-1) experimental; urgency=medium

  * New upstream version 1.20.2

 -- Joachim Bauch <fancycode@debian.org>  Tue, 05 Aug 2025 15:44:43 +0200

libheif (1.20.1-1) experimental; urgency=medium

  * New upstream version 1.20.1
  * Add patch to fix undefined symbol in svtenc plugin.
  * Update symbols for new upstream version.
  * Add "heif-view" binary package.
  * Add patch to load (encoding) plugins earlier.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 28 Jul 2025 11:41:29 +0200

libheif (1.19.8-1) unstable; urgency=medium

  * New upstream version 1.19.8
  * d/control: Update Standards-Version to 4.7.2

 -- Joachim Bauch <fancycode@debian.org>  Tue, 29 Apr 2025 10:32:58 +0200

libheif (1.19.7-1) unstable; urgency=medium

  * New upstream version 1.19.7
  * Remove patch no longer necessary with new upstream version.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 10 Mar 2025 13:46:58 +0100

libheif (1.19.5-1) unstable; urgency=medium

  * New upstream version 1.19.5
  * d/copyright: Update entry for renamed files.

 -- Joachim Bauch <fancycode@debian.org>  Tue, 07 Jan 2025 13:23:42 +0100

libheif (1.19.3-1) unstable; urgency=medium

  * New upstream version 1.19.3
  * d/rules: Don't treat all warnings as errors (matches upstream "release"
    preset).

 -- Joachim Bauch <fancycode@debian.org>  Mon, 11 Nov 2024 16:04:55 +0100

libheif (1.19.1-1) unstable; urgency=medium

  * Explicitly Build-Depend on libz-dev instead of pulling automagically.
  * New upstream version 1.19.1
  * d/rules: Enabled uncompressed codec (fixed upstream, Closes: #1077762).
  * Update symbols for new upstream version.
  * Adjust name of define to enable header compression.
  * Update patch for new upstream version.
  * d/rules: Check DEB_BUILD_OPTIONS in "override_dh_auto_test".

 -- Joachim Bauch <fancycode@debian.org>  Mon, 04 Nov 2024 09:56:34 +0100

libheif (1.18.2-2) unstable; urgency=medium

  * d/control: Only depend on rav1e plugin on architectures where it exists.

 -- Joachim Bauch <fancycode@debian.org>  Thu, 26 Sep 2024 09:05:32 +0200

libheif (1.18.2-1) unstable; urgency=medium

  * Change to use my @debian.org address.
  * New upstream version 1.18.2
  * d/control: Add metapackage "libheif-plugins-all" depending on all plugins.
  * d/control: Update dependencies of -dev package for plugin packages.
  * No need to manually symlink example, done by upstream.

 -- Joachim Bauch <fancycode@debian.org>  Tue, 24 Sep 2024 10:45:02 +0200

libheif (1.18.1-2) unstable; urgency=medium

  * Fix trailing comma in description.
  * d/control: Add reason for architecture list of librav1e-dev dependency.
  * d/rules: Disable uncompressed codec which doesn't work correctly on big-endian systems.
  * d/control: Add links to used libraries to plugin package descriptions.
  * Add decoding smoke test.

 -- Joachim Bauch <bauch@struktur.de>  Wed, 28 Aug 2024 11:33:20 +0200

libheif (1.18.1-1) unstable; urgency=medium

  * New upstream version 1.18.1
  * Remove patches now part of the upstream release.
  * Add patch to fix detection of OpenJPEG 2 in Debian.
  * Update libheif-examples for renamed and symlinked tool.
  * Update symbols for new upstream version.
  * d/copyright: Add more details and update for new upstream version.
  * Add symlink for manpage of renamed and symlinked tool from libheif-examples.
  * Update package descriptions.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 01 Aug 2024 12:13:56 +0200

libheif (1.17.6-4) unstable; urgency=medium

  * Add kvazaar plugin (Closes: #1072007).
  * d/copyright: Update DEP-5 license ids, add missing exceptions.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 24 Jun 2024 09:43:29 +0200

libheif (1.17.6-3) unstable; urgency=medium

  * Team upload
  * Stop building rav1e plugin on i386
  * On Ubuntu, demote libheif-plugin-x265 to Suggests
    and prefer libheif-plugin-aomdec to libheif-plugin-dav1d (LP: #2061089)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 06 Jun 2024 10:10:36 -0400

libheif (1.17.6-2) unstable; urgency=medium

  [ Dylan Aïssi ]
  * Cherry-pick upstream patches:
      - a911b26: Fix compilation with libsvtav1 2.0.0 (Closes: #1072335)
      - 877de6b: fix memory leaks (CVE-2024-25269)

  [ Joachim Bauch ]
  * d/control: Update "Standards-Version" to 4.7.0
  * Migrate from "pkg-config" to "pkgconf".

 -- Joachim Bauch <bauch@struktur.de>  Mon, 03 Jun 2024 13:28:11 +0200

libheif (1.17.6-1) unstable; urgency=medium

  * New upstream version 1.17.6
  * Fixes CVE-2023-49460, CVE-2023-49462, CVE-2023-49463,
    CVE-2023-49464 (Closes: #1059151).
  * Remove patch now applied upstream.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 21 Dec 2023 10:45:41 +0100

libheif (1.17.4-1) unstable; urgency=medium

  * New upstream version 1.17.4
  * Add patch to fix installing thumbnailer file.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 21 Nov 2023 10:03:52 +0100

libheif (1.17.1-1) unstable; urgency=medium

  * New upstream version 1.17.1

 -- Joachim Bauch <bauch@struktur.de>  Mon, 23 Oct 2023 11:04:57 +0200

libheif (1.17.0-1) unstable; urgency=medium

  * New upstream version 1.17.0
    - Fix loading of plugins in some cases (Closes: #1041242, #1043506)
  * Update symbols for new upstream version.
  * Update codec selection for new upstream version.
  * Build new codec plugins (ffmpegdec, jpeg{dec,enc}, j2k{dec,enc}).
  * Pass path to plugins when running tests.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 16 Oct 2023 14:30:23 +0200

libheif (1.16.2-3) unstable; urgency=medium

  * Team upload
  * Explicitly enable sharpyuv and have libheif-dev depend on libsharpyuv-dev
    per its pkgconfig file. Previously this was an automagic dependency
    and the pkgconfig file broke with a binNMU (Closes: #1052932)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 30 Sep 2023 05:23:55 -0400

libheif (1.16.2-2) unstable; urgency=medium

  [ Pino Toscano ]
  * Enable the rav1e plugin only on archs where librav1e is available

  [ Fabian Greffrath ]
  * Let the libheif1 package depend on at least one HEIF and AVIF decoder plugin
    (Closes: #1040520)

 -- Joachim Bauch <bauch@struktur.de>  Mon, 17 Jul 2023 09:21:51 +0200

libheif (1.16.2-1) unstable; urgency=medium

  [ Sebastian Ramacher ]
  * Use libgdk-pixbuf-2.0-dev
  * Set MA for heif-gdk-pixbuf and heif-thumbnailer (Closes: #981551)

  [ Joachim Bauch ]
  * New upstream version 1.16.2
  * Update symbols for new upstream version.
  * Build codecs as plugins and separate packages that are pulled using
    "Recommends".
  * Add codec plugins using "rav1e" and "svtenc".
  * Remove duplicate MA entry in heif-gdk-pixbuf.
  * d/rules: No need to override "dh_autoreconf", no longer used.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 20 Jun 2023 11:37:08 +0200

libheif (1.15.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.15.1
    - Fix CVE-2023-0996 (Closes: #1032101)
    - Do not fail if no plugin directory is available (Closes: #1029668)
  * debian/libheif1.symbols: Add new symbols
  * debian/*.install: Update for new upstream release

 -- Sebastian Ramacher <sramacher@debian.org>  Thu, 02 Mar 2023 00:09:34 +0100

libheif (1.14.2-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Apply multi-arch hints. + heif-gdk-pixbuf: Add Multi-Arch: same.

  [ Joachim Bauch ]
  * New upstream version 1.14.2
  * Update symbols for new upstream version.
  * Switch to cmake and use arch-dependent include directory.
  * Update "Standards-Version" to 4.6.2

 -- Joachim Bauch <bauch@struktur.de>  Tue, 17 Jan 2023 10:17:32 +0100

libheif (1.13.0-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Joachim Bauch ]
  * New upstream version 1.13.0
  * Update symbols for new upstream version.
  * Update "Standards-Version" to 4.6.1

 -- Joachim Bauch <bauch@struktur.de>  Fri, 02 Sep 2022 13:20:39 +0200

libheif (1.12.0-2) unstable; urgency=medium

  * Team upload
  * Upload to unstable

 -- Sebastian Ramacher <sramacher@debian.org>  Tue, 31 Aug 2021 22:37:31 +0200

libheif (1.12.0-1) experimental; urgency=medium

  * New upstream version 1.12.0
  * Update symbols for new upstream version.
  * Bump watch file to version 4.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 10 May 2021 15:51:05 +0200

libheif (1.11.0-1) unstable; urgency=medium

  * Imported Upstream version 1.11.0
  * Remove patch applied upstream.
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 02 Feb 2021 10:28:05 +0100

libheif (1.10.0-2) unstable; urgency=medium

  * Team upload
  * debian/control: Add missing Depends to libheif-dev (Closes: #978176)
  * debian/patches: Initialize valid_values to nullptr

 -- Sebastian Ramacher <sramacher@debian.org>  Sat, 02 Jan 2021 15:23:12 +0100

libheif (1.10.0-1) unstable; urgency=medium

  * Imported Upstream version 1.10.0
  * Update "Standards-Version" to 4.5.1
  * Remove patch applied upstream.
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Wed, 16 Dec 2020 17:23:17 +0100

libheif (1.9.1-1) unstable; urgency=medium

  * Imported Upstream version 1.9.1
  * Update symbols for new upstream version.
  * Build with libde265 >= 1.0.7 to get NCLX API.
  * Update to debhelper compat level 13.
  * Add patch to support building against system-installed dav1d.
  * Build with "libdav1d-dev" to get faster AVIF decoder.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 28 Sep 2020 09:27:40 +0200

libheif (1.8.0-1) unstable; urgency=medium

  * Add "Rules-Requires-Root", no root necessary.
  * Imported Upstream version 1.8.0
  * Update symbols for new upstream version.
  * Build with "libaom-dev" to get AVIF support.
  * Update "Standards-Version" to 4.5.0

 -- Joachim Bauch <bauch@struktur.de>  Thu, 27 Aug 2020 16:07:58 +0200

libheif (1.6.1-1) unstable; urgency=medium

  * Imported Upstream version 1.6.1

 -- Joachim Bauch <bauch@struktur.de>  Fri, 20 Dec 2019 10:31:19 +0100

libheif (1.6.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * Bump Standards-Version to 4.4.1

  [ Joachim Bauch ]
  * Imported Upstream version 1.6.0
  * Update symbls for new upstream version.
  * Install man pages.

 -- Joachim Bauch <bauch@struktur.de>  Fri, 08 Nov 2019 14:23:21 +0100

libheif (1.5.1-1) unstable; urgency=medium

  * Imported Upstream version 1.5.1
  * Update to debhelper compat level 12 and add debian/not-installed
  * Enable hardening.
  * Stop parsing changelog manually.
  * Fix "get-head-source" and don't include date in filename.
  * Specify "Build-Depends-Package" in symbols.

 -- Joachim Bauch <bauch@struktur.de>  Fri, 30 Aug 2019 10:30:36 +0200

libheif (1.5.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat
  * Bump Standards-Version to 4.4.0

  [ Joachim Bauch ]
  * Imported Upstream version 1.5.0
  * Update symbols for new upstream version.
  * Add copyright entries for new files in test/
  * Add missing copyright entry for files in scripts/
  * The examples are MIT licensed since 1.4.0
  * Remove patches no longer needed (fixed upstream).

  [ Mattia Rizzolo ]
  * Drop now unneeded debian/source/include-binaries

 -- Joachim Bauch <bauch@struktur.de>  Fri, 16 Aug 2019 16:29:09 +0200

libheif (1.4.0-2) unstable; urgency=medium

  * Team upload.
  * Upload to unstable.
  * debian/patches: Apply upstream fixes for CVE-2019-11471. (Closes: #928210)

 -- Sebastian Ramacher <sramacher@debian.org>  Sat, 06 Jul 2019 15:37:07 +0200

libheif (1.4.0-1) experimental; urgency=medium

  * Imported Upstream version 1.4.0
  * Add new package containing the gdk-pixbuf loader.
  * Update "Standards-Version" to 4.3.0
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 02 Apr 2019 10:17:10 +0200

libheif (1.3.2-1) unstable; urgency=medium

  * Imported Upstream version 1.3.2
  * Update "Standards-Version" to 4.1.4
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 21 Jun 2018 15:40:05 +0200

libheif (1.2.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/copyright: Use https protocol in Format field

  [ Joachim Bauch ]
  * Imported Upstream version 1.2.0
  * Remove patch now in upstream.
  * Update symbols for new upstream version.
  * Add new package "heif-thumbnailer".

 -- Joachim Bauch <bauch@struktur.de>  Mon, 28 May 2018 16:12:56 +0200

libheif (1.1.0-2) unstable; urgency=medium

  * Add patch to fix compile errors on mips, ppc and other platforms.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 19 Apr 2018 09:04:15 +0200

libheif (1.1.0-1) unstable; urgency=medium

  [ Joachim Bauch ]
  * d/control: Set Maintainer to Debian Multimedia Maintainers
  * d/control: Set Vcs-* to salsa.debian.org

  [ Felipe Sateler ]
  * Change maintainer address to debian-multimedia@lists.debian.org

  [ Joachim Bauch ]
  * Use default branch/tag names.
  * Imported Upstream version 1.1.0
  * Add dependency on "libx265-dev".
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Wed, 18 Apr 2018 16:28:10 +0200

libheif (1.0.0-1) unstable; urgency=medium

  * Initial release. (Closes: #888278)

 -- Joachim Bauch <bauch@struktur.de>  Sun, 18 Mar 2018 14:55:50 +0100
