vim (2:9.2.0858-1+deb14u2.1) forky; urgency=medium * rebuild for forky -- Mark Pryor Wed, 05 Aug 2026 16:34:49 -0700 vim (2:9.2.0858-1) unstable; urgency=medium * New upstream tag - 9.2.0831: Adjust diff highlighting so it's more readable in terminals with < 256 colors (Closes: #1140942) * Add historical changelog entry for fix of bash array syntax highlighting, #977141, which was closed in 2:9.1.0199-1 * Add historical changelog entry for fix of make syntax highlighting, when a string has a closing paren (#987060), which was fixed by 2:9.1.2103-1 * salsa-ci: Remove obsolete DISABLE_REPROTEST: 1 setting -- James McCoy Mon, 27 Jul 2026 06:11:18 -0400 vim (2:9.2.0782-1) unstable; urgency=medium * New upstream tag + Security fixes (Closes: #1140775) - 9.2.0561: possible code execution with python3complete (Closes: #1139728, CVE-2026-52858) - 9.2.0565: out-of-bounds read in :terminal if a cell has 5 combining marks (Closes: #1139729, CVE-2026-52859) - 9.2.0597: Allocation failure not handled when defining a dictionary function (Closes: #1139730, CVE-2026-52860) - 9.2.0653: out-of-bounds read with a crafted spell file, CVE-2026-55693 - 9.2.0662: out-of-bounds write with a crafted spell file, CVE-2026-55892 - 9.2.0663: possible code execution in netrw when deleting a file with a "|" in its name, CVE-2026-55895 - 9.2.0670: out-of-bounds read of text properties when handling a crafted undo file, CVE-2026-57451 - 9.2.0671: Possible out-of-bounds read when opening a sodium-encrypted file, CVE-2026-57452 - 9.2.0678: Possible powershell code execution when opening a zip file, CVE-2026-57453 - 9.2.0679: out-of-bounds read of text properties when handling a crafted undo file, CVE-2026-57454 - 9.2.0698: out-of-bounds write when using soundfold() on a large input, CVE-2026-57455 - 9.2.0699: possible code execution when using python complete, CVE-2026-57456 * Skip Test_clientserver_serverlist_list() and Test_remote_serverlist() -- James McCoy Tue, 07 Jul 2026 21:46:03 -0400 vim (2:9.2.0524-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0479: command injection in tar plugin (Closes: #1136803, CVE-2026-46483) - 9.2.0480: command injection in netrw via mf command (Closes: #1136828, CVE-2026-43961) * debian/rules: + Disable gtk4 configure check until new UI stabilizes + Remove obsolete --enable-sockerserver switch -- James McCoy Sat, 23 May 2026 22:34:42 -0400 vim (2:9.2.0461-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0435: backticks in 'path' may cause shell execution on completion (Closes: #1136086, CVE-2026-44656) - 9.2.0450: heap buffer overflow in spellfile SN_COMPOUND handling (Closes: #1136097, CVE-2026-45130) + syntax/autopkgtest.vim: Fix typos in breaks-testbed, build-needed, and hint-testsuite-triggers. Mark skip-not-installable as deprecated. -- James McCoy Sat, 09 May 2026 19:41:43 -0400 vim (2:9.2.0428-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0357: command injection via backticks in tag files (Closes: #1134906, CVE-2026-41411) * Remove xdg-shell.xml and primary-selection-unstable-v1.xml entries from d/copyright -- James McCoy Sat, 02 May 2026 10:39:07 -0400 vim (2:9.2.0355-1) unstable; urgency=medium * New upstream tag + 9.2.0350: New 'modelinestrict' option, enabled by default, to limit which options can be set in modelines. * Remove documentation patch about Debian disabling modeline option * Remove "set nomodeline" from debian.vim -- James McCoy Thu, 16 Apr 2026 09:10:49 -0400 vim (2:9.2.0338-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0316: command injection in netbeans interface via defineAnnoType, CVE-2026-39881 * Change libselinux1-dev Build-Depends to libselinux-dev * Change libgpmg1-dev Build-Depends to libgpm-dev -- James McCoy Sat, 11 Apr 2026 20:45:13 -0400 vim (2:9.2.0315-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0272: modeline security bypass for 'tabpanel' option, allowing expressions to be run from a modeline. (Closes: #1132447, CVE-2026-34714) - 9.2.0276: modeline security bypass for 'complete', 'guitabtooltip', and 'printheader' options, allowing expressions to be run from a modeline. (Closes: #1132450, CVE-2026-34982) - 9.2.0280: Fix path traversal issue in zip plugin, CVE-2026-35177 * Remove revert of v9.1.0949, since that is now causing Vim tests to fail. This reopens #1091729. * Declare compliance with Policy 4.7.4 -- James McCoy Tue, 07 Apr 2026 06:44:19 -0400 vim (2:9.2.0218-1) unstable; urgency=medium * New upstream tag + 9.2.0168: Fix invalid pointer casting in string_convert(), causing test failures on big-endian systems + runtime/syntax/python.vim: Fix E363 error when highlighting large integers (Closes: #1127816) + Security fixes - 9.2.0137: crash when composing character as end of range in a regexp collection (Closes: #1130658, CVE-2026-32249) - 9.2.0202: command injection via newline in glob(), CVE-2026-33412 -- James McCoy Sat, 21 Mar 2026 07:38:26 -0400 vim (2:9.2.0136-1) unstable; urgency=medium * Merge upstream patch v9.2.0136 + 9.2.0132: Skip Test_recover_corrupted_swap_file1 on big-endian systems -- James McCoy Wed, 11 Mar 2026 11:11:47 -0400 vim (2:9.2.0119-1) unstable; urgency=medium * New upstream release + See ":help vim-9.2" for new features + Security fixes - 9.1.2148: buffer overflow in netbeans special_keys() handling (Closes: #1127930, CVE-2026-26269) * Merge upstream tag v9.2.0119 + Security fixes - 9.2.0073: possible command injection using netrw (Closes: #1129427, CVE-2026-28417) - 9.2.0074: crash with overlong emacs tag file (Closes: #1129428, CVE-2026-28418) - 9.2.0075: buffer underflow with emacs tag file (Closes: #1129429, CVE-2026-28419) - 9.2.0076: buffer-overflow with combining characters in terminal handling (Closes: #1129430, CVE-2026-28420) - 9.2.0077: crash when recovering a corrupted swap file (Closes: #1129431, CVE-2026-28421) - 9.2.0078: stack buffer overflow when rendering a statusline with a multi-byte fill character on a very wide terminal (Closes: #1129432, CVE-2026-28422) -- James McCoy Mon, 09 Mar 2026 06:50:59 -0400 vim (2:9.1.2141-1) unstable; urgency=medium * Merge upstream tag v9.1.2141 + Security fixes - 9.1.2132: Fix buffer-overflow in 'helpfile' option handling, CVE-2026-25749 -- James McCoy Mon, 09 Feb 2026 07:06:42 -0500 vim (2:9.1.2103-1) unstable; urgency=medium * Merge upstream patch v9.1.2103 + syntax/debcontrol.vim: - Only highlight email addresses in Maintainer / Uploaders fields - Add support for highlighting build profiles and architecture restrictions (Closes: #1124089) + syntax/make.vim: Fix syntax highlighting when a string contains a closing paren. (Closes: #987060) * Disable flaky Test_client_server_stopinsert test * Remove Rules-Requires-Root, since no is the default value * Remove Priority field, since optional is the default value * Declare compliance with Policy 4.7.3 -- James McCoy Fri, 23 Jan 2026 06:27:15 -0500 vim (2:9.1.1882-1) unstable; urgency=medium * Merge upstream patch v9.1.1882 * Build without wayland on hurd -- James McCoy Mon, 27 Oct 2025 20:41:30 -0400 vim (2:9.1.1846-1) unstable; urgency=medium * Merge upstream tag v9.1.1845 + 9.1.1843: Extend searchcount() timeout if the test is being re-run due to flakiness, fixes test failure on slower architectures. -- James McCoy Fri, 10 Oct 2025 14:33:33 -0400 vim (2:9.1.1829-1) unstable; urgency=medium * Upload to unstable * Merge upstream tag v9.1.1829 * Remove src/LICENSE, src/README.txt, and runtime/doc/tags.ref during clean * Skip tests for termdebug, since they currently fail on 32-bit architectures -- James McCoy Mon, 06 Oct 2025 14:48:55 -0400 vim (2:9.1.1766-1) experimental; urgency=medium * Merge upstream tag v9.1.1766 (Closes: #1115819) + Security fixes: - 9.1.1400: use-after-free when evaluating tuple fails, (Closes: #1110898, CVE-2025-55157) - 9.1.1406: crash when importing invalid tuple, CVE-2025-55158 - 9.1.1551: path traversal issue in zip.vim if files have leading '../', (Closes: #1109374, CVE-2025-53906) - 9.1.1552: path traversal issue in tar.vim if files have leading '/', CVE-2025-53905 - 9.1.1616: xxd: possible buffer overflow with bitwise output, CVE-2025-9390 * Enable socketserver for vim-nox, vim-basic, and vim-gtk3 * Enable wayland support only for GUI builds * Drop obsolete transitional package, vim-athena -- James McCoy Tue, 23 Sep 2025 21:13:05 -0400 vim (2:9.1.1385-1) experimental; urgency=medium [ James McCoy ] * Merge upstream tag v9.1.1385 [ Kirill Rekhov ] * d/upstream/metadata: add metadata * Fix day-of-week for changelog entries 1:6.3-015+1, 1:6.3-010+1, 4.6-2. -- James McCoy Thu, 15 May 2025 20:28:48 -0400 vim (2:9.1.1230-2) unstable; urgency=medium * Backport v9.1.1242 and v9.1.1244 to fix crash when evaluating a variable name. (Closes: #1106133) -- James McCoy Thu, 22 May 2025 20:48:59 -0400 vim (2:9.1.1230-1) unstable; urgency=medium * Merge upstream tag v9.1.1230 + Security fixes: - 9.1.1115: use-after-free in str_to_reg(), CVE-2025-26603 - 9.1.1164: editing a specially crafted tar file allows code execution, (Closes: #1099610, CVE-2025-27423) - 9.1.1198: potential data loss with zip.vim and crafted zip files, (Closes: #1101016, CVE-2025-29768) -- James McCoy Mon, 24 Mar 2025 20:59:06 -0400 vim (2:9.1.1113-1) unstable; urgency=medium [ James McCoy ] * Merge upstream tag v9.1.1113 + Security fixes: - 9.1.1003: heap-buffer overflow with visual mode when using :all, CVE-2025-22134 - 9.1.1043: segfault in win_line(), CVE-2025-24014 - 9.1.1097: crash when using --log with non-existent path, CVE-2025-1215 [ Andrea Pappacoda ] * Drop backspace and history from debian.vim (Closes: #1095155) -- James McCoy Sat, 15 Feb 2025 20:43:27 -0500 vim (2:9.1.0967-2) unstable; urgency=medium * Revert "patch 9.1.0949: popups inconsistently shifted to the left", since it breaks vim-youcompleteme's autopkgtests. (Closes: #1091729) -- James McCoy Fri, 10 Jan 2025 06:30:59 -0500 vim (2:9.1.0967-1) unstable; urgency=medium * Merge upstream tag v9.1.0967 + 9.1.0862: Change default for 'wildmenu' to true + 9.1.0895: Change default for 'history' to 200 + 9.1.0899: Change default for 'backspace' to "indent,eol,start" + 9.1.0915: Change default GTK font size from 10 to 12 + Update German manpage and fix formatting issues (Closes: #1087431) * Revert "Skip Test_display_registers after 9.1.0852", fixed upstream * Remove tags-* / tags.ref from debian/clean, since the upstream Makefile now handles this cleanup. -- James McCoy Sat, 28 Dec 2024 23:18:43 -0500 vim (2:9.1.0861-1) unstable; urgency=medium [ James McCoy ] * Merge upstream tag v9.1.0861 * salsa: Re-enable the crossbuild job [ Kirill Rekhov ] * d/copyright: update links (http -> https) * d/copyright: fix superfluous-file-pattern warning [ James McCoy ] * Skip GetLatestVimScripts tests since they require network access * Skip Test_display_registers after 9.1.0852 since it now fails when run without a GUI environment available -- James McCoy Wed, 13 Nov 2024 06:33:02 -0500 vim (2:9.1.0777-1) unstable; urgency=medium * Merge upstream patch v9.1.0777 + Security fixes: - 9.1.0764: Fix use-after-free when closing a buffer in a BufWinLeave autocmd, CVE-2024-47814 * Make autopkgtests validate the language bindings. The previous autopkgtests ran the entire upstream test suite whose flakiness made it useless as a marker for whether a package update broke Vim. Since the language bindings are the most likely to be affected by package updates, just test those in autopkgtests and remove the "flaky" restriction. * Declare compliance with Policy 4.7.0, no changes required -- James McCoy Sun, 13 Oct 2024 12:17:49 -0400 vim (2:9.1.0709-2) unstable; urgency=medium * Build with -O1 on s390x to workaround #1082125 -- James McCoy Sat, 21 Sep 2024 11:03:13 -0400 vim (2:9.1.0709-1) unstable; urgency=medium * Merge upstream patch v9.1.0709 + Security fixes: - 9.1.0707: Fix possibility of invalid cursor position, CVE-2024-45306 + 9.1.0706: Fix test_gettext tests when building in a shadow directory + 9.1.0709: Fix lookup of GUIEnter autocmd name in Turkish locale (Closes: #1074174) * Build-Depend on locales-all package to test new gettext() vimscript function * Delete runtime/doc/tags-* (language specific tags) during clean -- James McCoy Tue, 03 Sep 2024 10:30:28 -0400 vim (2:9.1.0698-1) unstable; urgency=medium * Merge upstream tag v9.1.0698 + Security fixes: - 9.1.0647: Fix use-after-free in tagstack_clear_entry(), CVE-2024-41957 - 9.1.0648: Fix double free in dialog_changed(), CVE-2024-41965 - 9.1.0678: Fix use-after-free in alist_add(), CVE-2024-43374 - 9.1.0689: Fix buffer-overflow in do_search() when 'rightleft' is set, CVE-2024-43790 - 9.1.0697: Fix heap-buffer-overflow in ins_typebuf(), CVE-2024-43802 + 9.1.0568: Add support for completing paths from 'cdpath' in :cd (Closes: #509940) * Clarify defaults.vim instructions in system vimrc when wanting to source defaults.vim to build on top of its settings. * Adjust make parameter used to specify vim binary, since upstream changed the expected variable name in multiple makefiles -- James McCoy Wed, 28 Aug 2024 06:41:08 -0400 vim (2:9.1.0496-1) unstable; urgency=medium * Merge upstream tag v9.1.0496 * Refresh patches; drop backported test_codestyle patch -- James McCoy Wed, 19 Jun 2024 21:07:11 -0400 vim (2:9.1.0377-1) unstable; urgency=medium * Merge upstream tag v9.1.0377 * Add ncurses-term Build-Depends for tests requiring vt420 TERM definition * Backport fix for test_codestyle failure -- James McCoy Sat, 27 Apr 2024 11:01:43 -0400 vim (2:9.1.0374-1) unstable; urgency=medium * Team upload. * New upstream tag v9.1.0374. * runtime(debversions): Add oracular (24.10) as Ubuntu release name. -- Simon Quigley Fri, 26 Apr 2024 16:34:19 -0500 vim (2:9.1.0199-1) unstable; urgency=medium * Merge upstream tag v9.1.0199 + 9.1.0064: Wayland support, which can be enabled by setting $GVIM_ENABLE_WAYLAND + 9.1.0162: Fix error handling when saving a file with xattrs (Closes: #1065978) + syntax/deb822sources.vim: Fix erroneous highlighting of keywords in field values. (Closes: #1061630) + syntax/sh.vim: Fix highlight of multi-line array statement. (Closes: #977141) -- James McCoy Sun, 24 Mar 2024 09:16:49 -0400 vim (2:9.1.0016-1) unstable; urgency=medium * Team upload. * New upstream release: - Fix high-contrast diff highlighting introduced in 2:9.0.2189-1. -- Simon Quigley Thu, 11 Jan 2024 14:38:16 -0600 vim (2:9.1.0-1) unstable; urgency=medium * Team upload. * New upstream release, dedicated to the memory of Bram Moolenaar, Vim's lead developer for more than 30 years, who passed away half a year ago. The Vim project wouldn't exist without his work! -- Simon Quigley Tue, 02 Jan 2024 19:25:17 -0600 vim (2:9.0.2189-1) unstable; urgency=medium [ Simon Quigley ] * Merge upstream patch v9.0.2184: - Security fixes: + 9.0.2121: use-after-free in ex_substitute, CVE-2023-48706 - Update copyright years. [ James McCoy ] * Merge upstream patch v9.0.2189 - syntax/debcontrol.vim: Add support for loong64 keyword. Thanks to zhangjialing@loongson.cn for the patch. -- James McCoy Mon, 01 Jan 2024 09:23:58 -0500 vim (2:9.0.2116-1) unstable; urgency=medium * Merge upstream patch v9.0.2116 + Security fixes - 9.0.2106: Use-after-free in win_close(), CVE-2023-48231 - 9.0.2107: FPE in adjust_plines_for_skipcol, CVE-2023-48232 - 9.0.2108: overflow with count for :s command. Abort command if count is too large, CVE-2023-48233 - 9.0.2109: overflow in nv_z_get_count. Limit max value of count, CVE-2023-48234 - 9.0.2110: overflow in ex address parsing. Verify lnum is positive before subtracting from LONG_MAX, CVE-2023-48235 - 9.0.2111: overflow in get_number. Return 0 when the count gets too large, CVE-2023-48236 - 9.0.2112: overflow in shift_line. Limit indent to INT_MAX, CVE-2023-48237 + 9.0.2116: Crash when callback function aborts because of recursiveness. - Fixes FTBFS on armel -- James McCoy Mon, 20 Nov 2023 11:05:25 -0500 vim (2:9.0.2103-1) unstable; urgency=medium * Merge upstream patch v9.0.2103 + 9.0.2103: Fix FTBFS on 32-bit architectures due to recursive callback test. Limit recursiveness to 20 levels, rather than 100. -- James McCoy Mon, 13 Nov 2023 08:48:31 -0500 vim (2:9.0.2087-1) unstable; urgency=medium * Merge upstream patch v9.0.2087 (Closes: #1055287) + Security fixes - 9.0.2068: overflow in :history, CVE-2023-46246 -- James McCoy Sat, 04 Nov 2023 13:55:54 -0400 vim (2:9.0.2018-1) unstable; urgency=medium * Merge upstream patch v9.0.2018 + Security fixes - 9.0.1969: buffer-overflow in trunc_string() (Closes: #1053694, CVE-2023-5344) - 9.0.1992: segfault in exmode when redrawing, CVE-2023-5441 - 9.0.2010: use-after-free from buf_contents_changed(), CVE-2023-5535 * xxd: Remove obsolete Breaks/Replaces on vim-common -- James McCoy Fri, 13 Oct 2023 15:54:12 -0400 vim (2:9.0.1894-1) unstable; urgency=medium * The "Farewell, Bram" upload * Merge upstream patch v9.0.1894 + Vulnerability fixes - 9.0.1664: Divide by zero when scrolling with 'smoothscroll' set, CVE-2023-3896 - 9.0.1840: Use after free in do_ecmd, CVE-2023-4733 - 9.0.1846: Crash when fullcommand() is called with an invalid argument, CVE-2023-4734 - 9.0.1847: Out of bounds write in do_addsub(), CVE-2023-4735 - 9.0.1848: Buffer overflow in vim_regsub_both(), CVE-2023-4738 - 9.0.1857: Heap use after free in is_qf_win(), CVE-2023-4750 - 9.0.1858: Heap use after free in ins_compl_get_exp(), CVE-2023-4752 - 9.0.1873: Heap buffer overflow in vim_regsub_both(), CVE-2023-4781 + 9.0.1682: Use little-endian byte order for sodium encrypted files. This allows re-enabling the crypt tests on big-endian platforms. + 9.0.1683: Use Lua 5.1 compatible numeric escapes to fix if_lua tests with Lua 5.1. + 9.0.1739: Ensure all libvterm files are cleaned during "make clean" + Ship an "editorconfig" plugin as an optional package. * Adjust copyright years and license text for Bram's passing * Fix the check for when to run "make distclean" (Closes: #1045719) * Build against Lua 5.1 instead of Lua 5.2 (Closes: #1050637) * Re-enable Test_uncrypt_xchacha20 tests on big-endian systems * Skip flaky test Test_crash1 -- James McCoy Mon, 11 Sep 2023 09:22:50 -0400 vim (2:9.0.1672-1) unstable; urgency=medium * Merge upstream patch v9.0.1672 * Remove check for DEB_BUILD_OPTIONS=nocheck, since dh_auto_test handles it now * Skip Test_uncrypt_xchacha20 tests on big endian systems -- James McCoy Tue, 04 Jul 2023 09:02:26 -0400 vim (2:9.0.1658-1) unstable; urgency=medium * Merge upstream patch v9.0.1658 + Vulnerability fixes - 9.0.1392: Using NULL pointer with nested :open command, CVE-2023-1264 - 9.0.1402: Crash when using null_class, CVE-2023-1355 - 9.0.1531: Crash when register contents ends up being invalid, CVE-2023-2609 - 9.0.1532: Crash when expanding "~" in substitute causes very long text, (Closes: #1035955, CVE-2023-2610) + 9.0.1409: Racket files are recognized as their own filetype, rather than as scheme + 9.0.1619: Always recognize the codes for focus gained/lost, even if Vim doesn't expect the terminal to support them. (Closes: #1038401) + Document behavior of C-x / C-a on numbers outside the range of a 64-bit value. (Closes: #1031256) * Refresh patches, dropping backport of v9.0.1499 * Include uganda.txt, sponsor.txt, and versionX.txt in vim-common so the intro screen has functional help links when only vim-tiny and vim-common are installed * Declare compliance with Policy 4.6.2, no changes needed * Remove non-functional diversion handling in vim-runtime.postinst -- James McCoy Sat, 24 Jun 2023 11:08:58 -0400 # Older entries have been removed from this changelog. # To read the complete changelog use `apt changelog vim-nox`.