vim (2:9.2.0782-1~bpo13+1) trixie-backports; urgency=medium * Rebuild for trixie-backports. * from sid -- Mark Pryor Fri, 17 Jul 2026 14:35:51 -0700 vim (2:9.2.0782-1) unstable; urgency=medium * New upstream tag + Security fixes (Closes: #1140775) - 9.2.0561: possible code execution with python3complete (Closes: #1139728, CVE-2026-52858) - 9.2.0565: out-of-bounds read in :terminal if a cell has 5 combining marks (Closes: #1139729, CVE-2026-52859) - 9.2.0597: Allocation failure not handled when defining a dictionary function (Closes: #1139730, CVE-2026-52860) - 9.2.0653: out-of-bounds read with a crafted spell file, CVE-2026-55693 - 9.2.0662: out-of-bounds write with a crafted spell file, CVE-2026-55892 - 9.2.0663: possible code execution in netrw when deleting a file with a "|" in its name, CVE-2026-55895 - 9.2.0670: out-of-bounds read of text properties when handling a crafted undo file, CVE-2026-57451 - 9.2.0671: Possible out-of-bounds read when opening a sodium-encrypted file, CVE-2026-57452 - 9.2.0678: Possible powershell code execution when opening a zip file, CVE-2026-57453 - 9.2.0679: out-of-bounds read of text properties when handling a crafted undo file, CVE-2026-57454 - 9.2.0698: out-of-bounds write when using soundfold() on a large input, CVE-2026-57455 - 9.2.0699: possible code execution when using python complete, CVE-2026-57456 * Skip Test_clientserver_serverlist_list() and Test_remote_serverlist() -- James McCoy Tue, 07 Jul 2026 21:46:03 -0400 vim (2:9.2.0524-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0479: command injection in tar plugin (Closes: #1136803, CVE-2026-46483) - 9.2.0480: command injection in netrw via mf command (Closes: #1136828, CVE-2026-43961) * debian/rules: + Disable gtk4 configure check until new UI stabilizes + Remove obsolete --enable-sockerserver switch -- James McCoy Sat, 23 May 2026 22:34:42 -0400 vim (2:9.2.0461-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0435: backticks in 'path' may cause shell execution on completion (Closes: #1136086, CVE-2026-44656) - 9.2.0450: heap buffer overflow in spellfile SN_COMPOUND handling (Closes: #1136097, CVE-2026-45130) + syntax/autopkgtest.vim: Fix typos in breaks-testbed, build-needed, and hint-testsuite-triggers. Mark skip-not-installable as deprecated. -- James McCoy Sat, 09 May 2026 19:41:43 -0400 vim (2:9.2.0428-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0357: command injection via backticks in tag files (Closes: #1134906, CVE-2026-41411) * Remove xdg-shell.xml and primary-selection-unstable-v1.xml entries from d/copyright -- James McCoy Sat, 02 May 2026 10:39:07 -0400 vim (2:9.2.0355-1) unstable; urgency=medium * New upstream tag + 9.2.0350: New 'modelinestrict' option, enabled by default, to limit which options can be set in modelines. * Remove documentation patch about Debian disabling modeline option * Remove "set nomodeline" from debian.vim -- James McCoy Thu, 16 Apr 2026 09:10:49 -0400 vim (2:9.2.0338-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0316: command injection in netbeans interface via defineAnnoType, CVE-2026-39881 * Change libselinux1-dev Build-Depends to libselinux-dev * Change libgpmg1-dev Build-Depends to libgpm-dev -- James McCoy Sat, 11 Apr 2026 20:45:13 -0400 vim (2:9.2.0315-1) unstable; urgency=medium * New upstream tag + Security fixes - 9.2.0272: modeline security bypass for 'tabpanel' option, allowing expressions to be run from a modeline. (Closes: #1132447, CVE-2026-34714) - 9.2.0276: modeline security bypass for 'complete', 'guitabtooltip', and 'printheader' options, allowing expressions to be run from a modeline. (Closes: #1132450, CVE-2026-34982) - 9.2.0280: Fix path traversal issue in zip plugin, CVE-2026-35177 * Remove revert of v9.1.0949, since that is now causing Vim tests to fail. This reopens #1091729. * Declare compliance with Policy 4.7.4 -- James McCoy Tue, 07 Apr 2026 06:44:19 -0400 vim (2:9.2.0218-1) unstable; urgency=medium * New upstream tag + 9.2.0168: Fix invalid pointer casting in string_convert(), causing test failures on big-endian systems + runtime/syntax/python.vim: Fix E363 error when highlighting large integers (Closes: #1127816) + Security fixes - 9.2.0137: crash when composing character as end of range in a regexp collection (Closes: #1130658, CVE-2026-32249) - 9.2.0202: command injection via newline in glob(), CVE-2026-33412 -- James McCoy Sat, 21 Mar 2026 07:38:26 -0400 vim (2:9.2.0136-1) unstable; urgency=medium * Merge upstream patch v9.2.0136 + 9.2.0132: Skip Test_recover_corrupted_swap_file1 on big-endian systems -- James McCoy Wed, 11 Mar 2026 11:11:47 -0400 vim (2:9.2.0119-1) unstable; urgency=medium * New upstream release + See ":help vim-9.2" for new features + Security fixes - 9.1.2148: buffer overflow in netbeans special_keys() handling (Closes: #1127930, CVE-2026-26269) * Merge upstream tag v9.2.0119 + Security fixes - 9.2.0073: possible command injection using netrw (Closes: #1129427, CVE-2026-28417) - 9.2.0074: crash with overlong emacs tag file (Closes: #1129428, CVE-2026-28418) - 9.2.0075: buffer underflow with emacs tag file (Closes: #1129429, CVE-2026-28419) - 9.2.0076: buffer-overflow with combining characters in terminal handling (Closes: #1129430, CVE-2026-28420) - 9.2.0077: crash when recovering a corrupted swap file (Closes: #1129431, CVE-2026-28421) - 9.2.0078: stack buffer overflow when rendering a statusline with a multi-byte fill character on a very wide terminal (Closes: #1129432, CVE-2026-28422) -- James McCoy Mon, 09 Mar 2026 06:50:59 -0400 vim (2:9.1.2141-1) unstable; urgency=medium * Merge upstream tag v9.1.2141 + Security fixes - 9.1.2132: Fix buffer-overflow in 'helpfile' option handling, CVE-2026-25749 -- James McCoy Mon, 09 Feb 2026 07:06:42 -0500 vim (2:9.1.2103-1) unstable; urgency=medium * Merge upstream patch v9.1.2103 + syntax/debcontrol.vim: - Only highlight email addresses in Maintainer / Uploaders fields - Add support for highlighting build profiles and architecture restrictions (Closes: #1124089) * Disable flaky Test_client_server_stopinsert test * Remove Rules-Requires-Root, since no is the default value * Remove Priority field, since optional is the default value * Declare compliance with Policy 4.7.3 -- James McCoy Fri, 23 Jan 2026 06:27:15 -0500 vim (2:9.1.1882-1) unstable; urgency=medium * Merge upstream patch v9.1.1882 * Build without wayland on hurd -- James McCoy Mon, 27 Oct 2025 20:41:30 -0400 vim (2:9.1.1846-1) unstable; urgency=medium * Merge upstream tag v9.1.1845 + 9.1.1843: Extend searchcount() timeout if the test is being re-run due to flakiness, fixes test failure on slower architectures. -- James McCoy Fri, 10 Oct 2025 14:33:33 -0400 vim (2:9.1.1829-1) unstable; urgency=medium * Upload to unstable * Merge upstream tag v9.1.1829 * Remove src/LICENSE, src/README.txt, and runtime/doc/tags.ref during clean * Skip tests for termdebug, since they currently fail on 32-bit architectures -- James McCoy Mon, 06 Oct 2025 14:48:55 -0400 vim (2:9.1.1766-1) experimental; urgency=medium * Merge upstream tag v9.1.1766 (Closes: #1115819) + Security fixes: - 9.1.1400: use-after-free when evaluating tuple fails, (Closes: #1110898, CVE-2025-55157) - 9.1.1406: crash when importing invalid tuple, CVE-2025-55158 - 9.1.1551: path traversal issue in zip.vim if files have leading '../', (Closes: #1109374, CVE-2025-53906) - 9.1.1552: path traversal issue in tar.vim if files have leading '/', CVE-2025-53905 - 9.1.1616: xxd: possible buffer overflow with bitwise output, CVE-2025-9390 * Enable socketserver for vim-nox, vim-basic, and vim-gtk3 * Enable wayland support only for GUI builds * Drop obsolete transitional package, vim-athena -- James McCoy Tue, 23 Sep 2025 21:13:05 -0400 vim (2:9.1.1385-1) experimental; urgency=medium [ James McCoy ] * Merge upstream tag v9.1.1385 [ Kirill Rekhov ] * d/upstream/metadata: add metadata * Fix day-of-week for changelog entries 1:6.3-015+1, 1:6.3-010+1, 4.6-2. -- James McCoy Thu, 15 May 2025 20:28:48 -0400 vim (2:9.1.1230-2) unstable; urgency=medium * Backport v9.1.1242 and v9.1.1244 to fix crash when evaluating a variable name. (Closes: #1106133) -- James McCoy Thu, 22 May 2025 20:48:59 -0400 vim (2:9.1.1230-1) unstable; urgency=medium * Merge upstream tag v9.1.1230 + Security fixes: - 9.1.1115: use-after-free in str_to_reg(), CVE-2025-26603 - 9.1.1164: editing a specially crafted tar file allows code execution, (Closes: #1099610, CVE-2025-27423) - 9.1.1198: potential data loss with zip.vim and crafted zip files, (Closes: #1101016, CVE-2025-29768) -- James McCoy Mon, 24 Mar 2025 20:59:06 -0400 vim (2:9.1.1113-1) unstable; urgency=medium [ James McCoy ] * Merge upstream tag v9.1.1113 + Security fixes: - 9.1.1003: heap-buffer overflow with visual mode when using :all, CVE-2025-22134 - 9.1.1043: segfault in win_line(), CVE-2025-24014 - 9.1.1097: crash when using --log with non-existent path, CVE-2025-1215 [ Andrea Pappacoda ] * Drop backspace and history from debian.vim (Closes: #1095155) -- James McCoy Sat, 15 Feb 2025 20:43:27 -0500 vim (2:9.1.0967-2) unstable; urgency=medium * Revert "patch 9.1.0949: popups inconsistently shifted to the left", since it breaks vim-youcompleteme's autopkgtests. (Closes: #1091729) -- James McCoy Fri, 10 Jan 2025 06:30:59 -0500 vim (2:9.1.0967-1) unstable; urgency=medium * Merge upstream tag v9.1.0967 + 9.1.0862: Change default for 'wildmenu' to true + 9.1.0895: Change default for 'history' to 200 + 9.1.0899: Change default for 'backspace' to "indent,eol,start" + 9.1.0915: Change default GTK font size from 10 to 12 + Update German manpage and fix formatting issues (Closes: #1087431) * Revert "Skip Test_display_registers after 9.1.0852", fixed upstream * Remove tags-* / tags.ref from debian/clean, since the upstream Makefile now handles this cleanup. -- James McCoy Sat, 28 Dec 2024 23:18:43 -0500 vim (2:9.1.0861-1) unstable; urgency=medium [ James McCoy ] * Merge upstream tag v9.1.0861 * salsa: Re-enable the crossbuild job [ Kirill Rekhov ] * d/copyright: update links (http -> https) * d/copyright: fix superfluous-file-pattern warning [ James McCoy ] * Skip GetLatestVimScripts tests since they require network access * Skip Test_display_registers after 9.1.0852 since it now fails when run without a GUI environment available -- James McCoy Wed, 13 Nov 2024 06:33:02 -0500 vim (2:9.1.0777-1) unstable; urgency=medium * Merge upstream patch v9.1.0777 + Security fixes: - 9.1.0764: Fix use-after-free when closing a buffer in a BufWinLeave autocmd, CVE-2024-47814 * Make autopkgtests validate the language bindings. The previous autopkgtests ran the entire upstream test suite whose flakiness made it useless as a marker for whether a package update broke Vim. Since the language bindings are the most likely to be affected by package updates, just test those in autopkgtests and remove the "flaky" restriction. * Declare compliance with Policy 4.7.0, no changes required -- James McCoy Sun, 13 Oct 2024 12:17:49 -0400 vim (2:9.1.0709-2) unstable; urgency=medium * Build with -O1 on s390x to workaround #1082125 -- James McCoy Sat, 21 Sep 2024 11:03:13 -0400 vim (2:9.1.0709-1) unstable; urgency=medium * Merge upstream patch v9.1.0709 + Security fixes: - 9.1.0707: Fix possibility of invalid cursor position, CVE-2024-45306 + 9.1.0706: Fix test_gettext tests when building in a shadow directory + 9.1.0709: Fix lookup of GUIEnter autocmd name in Turkish locale (Closes: #1074174) * Build-Depend on locales-all package to test new gettext() vimscript function * Delete runtime/doc/tags-* (language specific tags) during clean -- James McCoy Tue, 03 Sep 2024 10:30:28 -0400 vim (2:9.1.0698-1) unstable; urgency=medium * Merge upstream tag v9.1.0698 + Security fixes: - 9.1.0647: Fix use-after-free in tagstack_clear_entry(), CVE-2024-41957 - 9.1.0648: Fix double free in dialog_changed(), CVE-2024-41965 - 9.1.0678: Fix use-after-free in alist_add(), CVE-2024-43374 - 9.1.0689: Fix buffer-overflow in do_search() when 'rightleft' is set, CVE-2024-43790 - 9.1.0697: Fix heap-buffer-overflow in ins_typebuf(), CVE-2024-43802 + 9.1.0568: Add support for completing paths from 'cdpath' in :cd (Closes: #509940) * Clarify defaults.vim instructions in system vimrc when wanting to source defaults.vim to build on top of its settings. * Adjust make parameter used to specify vim binary, since upstream changed the expected variable name in multiple makefiles -- James McCoy Wed, 28 Aug 2024 06:41:08 -0400 vim (2:9.1.0496-1) unstable; urgency=medium * Merge upstream tag v9.1.0496 * Refresh patches; drop backported test_codestyle patch -- James McCoy Wed, 19 Jun 2024 21:07:11 -0400 vim (2:9.1.0377-1) unstable; urgency=medium * Merge upstream tag v9.1.0377 * Add ncurses-term Build-Depends for tests requiring vt420 TERM definition * Backport fix for test_codestyle failure -- James McCoy Sat, 27 Apr 2024 11:01:43 -0400 vim (2:9.1.0374-1) unstable; urgency=medium * Team upload. * New upstream tag v9.1.0374. * runtime(debversions): Add oracular (24.10) as Ubuntu release name. -- Simon Quigley Fri, 26 Apr 2024 16:34:19 -0500 vim (2:9.1.0199-1) unstable; urgency=medium * Merge upstream tag v9.1.0199 + 9.1.0064: Wayland support, which can be enabled by setting $GVIM_ENABLE_WAYLAND + 9.1.0162: Fix error handling when saving a file with xattrs (Closes: #1065978) + syntax/deb822sources.vim: Fix erroneous highlighting of keywords in field values. (Closes: #1061630) -- James McCoy Sun, 24 Mar 2024 09:16:49 -0400 vim (2:9.1.0016-1) unstable; urgency=medium * Team upload. * New upstream release: - Fix high-contrast diff highlighting introduced in 2:9.0.2189-1. -- Simon Quigley Thu, 11 Jan 2024 14:38:16 -0600 vim (2:9.1.0-1) unstable; urgency=medium * Team upload. * New upstream release, dedicated to the memory of Bram Moolenaar, Vim's lead developer for more than 30 years, who passed away half a year ago. The Vim project wouldn't exist without his work! -- Simon Quigley Tue, 02 Jan 2024 19:25:17 -0600 vim (2:9.0.2189-1) unstable; urgency=medium [ Simon Quigley ] * Merge upstream patch v9.0.2184: - Security fixes: + 9.0.2121: use-after-free in ex_substitute, CVE-2023-48706 - Update copyright years. [ James McCoy ] * Merge upstream patch v9.0.2189 - syntax/debcontrol.vim: Add support for loong64 keyword. Thanks to zhangjialing@loongson.cn for the patch. -- James McCoy Mon, 01 Jan 2024 09:23:58 -0500 vim (2:9.0.2116-1) unstable; urgency=medium * Merge upstream patch v9.0.2116 + Security fixes - 9.0.2106: Use-after-free in win_close(), CVE-2023-48231 - 9.0.2107: FPE in adjust_plines_for_skipcol, CVE-2023-48232 - 9.0.2108: overflow with count for :s command. Abort command if count is too large, CVE-2023-48233 - 9.0.2109: overflow in nv_z_get_count. Limit max value of count, CVE-2023-48234 - 9.0.2110: overflow in ex address parsing. Verify lnum is positive before subtracting from LONG_MAX, CVE-2023-48235 - 9.0.2111: overflow in get_number. Return 0 when the count gets too large, CVE-2023-48236 - 9.0.2112: overflow in shift_line. Limit indent to INT_MAX, CVE-2023-48237 + 9.0.2116: Crash when callback function aborts because of recursiveness. - Fixes FTBFS on armel -- James McCoy Mon, 20 Nov 2023 11:05:25 -0500 vim (2:9.0.2103-1) unstable; urgency=medium * Merge upstream patch v9.0.2103 + 9.0.2103: Fix FTBFS on 32-bit architectures due to recursive callback test. Limit recursiveness to 20 levels, rather than 100. -- James McCoy Mon, 13 Nov 2023 08:48:31 -0500 vim (2:9.0.2087-1) unstable; urgency=medium * Merge upstream patch v9.0.2087 (Closes: #1055287) + Security fixes - 9.0.2068: overflow in :history, CVE-2023-46246 -- James McCoy Sat, 04 Nov 2023 13:55:54 -0400 vim (2:9.0.2018-1) unstable; urgency=medium * Merge upstream patch v9.0.2018 + Security fixes - 9.0.1969: buffer-overflow in trunc_string() (Closes: #1053694, CVE-2023-5344) - 9.0.1992: segfault in exmode when redrawing, CVE-2023-5441 - 9.0.2010: use-after-free from buf_contents_changed(), CVE-2023-5535 * xxd: Remove obsolete Breaks/Replaces on vim-common -- James McCoy Fri, 13 Oct 2023 15:54:12 -0400 vim (2:9.0.1894-1) unstable; urgency=medium * The "Farewell, Bram" upload * Merge upstream patch v9.0.1894 + Vulnerability fixes - 9.0.1664: Divide by zero when scrolling with 'smoothscroll' set, CVE-2023-3896 - 9.0.1840: Use after free in do_ecmd, CVE-2023-4733 - 9.0.1846: Crash when fullcommand() is called with an invalid argument, CVE-2023-4734 - 9.0.1847: Out of bounds write in do_addsub(), CVE-2023-4735 - 9.0.1848: Buffer overflow in vim_regsub_both(), CVE-2023-4738 - 9.0.1857: Heap use after free in is_qf_win(), CVE-2023-4750 - 9.0.1858: Heap use after free in ins_compl_get_exp(), CVE-2023-4752 - 9.0.1873: Heap buffer overflow in vim_regsub_both(), CVE-2023-4781 + 9.0.1682: Use little-endian byte order for sodium encrypted files. This allows re-enabling the crypt tests on big-endian platforms. + 9.0.1683: Use Lua 5.1 compatible numeric escapes to fix if_lua tests with Lua 5.1. + 9.0.1739: Ensure all libvterm files are cleaned during "make clean" + Ship an "editorconfig" plugin as an optional package. * Adjust copyright years and license text for Bram's passing * Fix the check for when to run "make distclean" (Closes: #1045719) * Build against Lua 5.1 instead of Lua 5.2 (Closes: #1050637) * Re-enable Test_uncrypt_xchacha20 tests on big-endian systems * Skip flaky test Test_crash1 -- James McCoy Mon, 11 Sep 2023 09:22:50 -0400 vim (2:9.0.1672-1) unstable; urgency=medium * Merge upstream patch v9.0.1672 * Remove check for DEB_BUILD_OPTIONS=nocheck, since dh_auto_test handles it now * Skip Test_uncrypt_xchacha20 tests on big endian systems -- James McCoy Tue, 04 Jul 2023 09:02:26 -0400 vim (2:9.0.1658-1) unstable; urgency=medium * Merge upstream patch v9.0.1658 + Vulnerability fixes - 9.0.1392: Using NULL pointer with nested :open command, CVE-2023-1264 - 9.0.1402: Crash when using null_class, CVE-2023-1355 - 9.0.1531: Crash when register contents ends up being invalid, CVE-2023-2609 - 9.0.1532: Crash when expanding "~" in substitute causes very long text, (Closes: #1035955, CVE-2023-2610) + 9.0.1409: Racket files are recognized as their own filetype, rather than as scheme + 9.0.1619: Always recognize the codes for focus gained/lost, even if Vim doesn't expect the terminal to support them. (Closes: #1038401) + Document behavior of C-x / C-a on numbers outside the range of a 64-bit value. (Closes: #1031256) * Refresh patches, dropping backport of v9.0.1499 * Include uganda.txt, sponsor.txt, and versionX.txt in vim-common so the intro screen has functional help links when only vim-tiny and vim-common are installed * Declare compliance with Policy 4.6.2, no changes needed * Remove non-functional diversion handling in vim-runtime.postinst -- James McCoy Sat, 24 Jun 2023 11:08:58 -0400 vim (2:9.0.1378-2) unstable; urgency=medium * Backport 9.0.1499 to fix CVE-2023-2426 (Closes: #1035323) * Backport fix for indenting of Perl subroutines (Closes: #1034529) -- James McCoy Thu, 04 May 2023 06:24:44 -0400 vim (2:9.0.1378-1) unstable; urgency=medium * Merge upstream patch v9.0.1378 + Vulnerability fixes - 9.0.1143: Invalid memory access with bad 'statusline' value, CVE-2023-0049 - 9.0.1144: Reading beyond text, CVE-2023-0051 - 9.0.1145: Invalid memory access with recursive substitute expression, (Closes: #1031875, CVE-2023-0054) - 9.0.1189: Invalid memory access with folding and using "L", CVE-2023-0288 - 9.0.1225: Reading past the end of a line when formatting text, CVE-2023-0433 - 9.0.1247: Divide by zero with 'smoothscroll' set and a narrow window, CVE-2023-0512 - 9.0.1331: Illegal memory access when using :ball in Visual mode, CVE-2023-4751 - 9.0.1367: Divide by zero in zero-width window, CVE-2023-1127 - 9.0.1376: Accessing invalid memory with put in Visual block mode, CVE-2023-1170 + 9.0.1073, 9.0.1080: Fix keyboard input/mapping support for some terminals (e.g., foot and kitty). (Closes: #1029049) + 9.0.1213: Fix inconsistent behavior when adding text after a fold at the end of the buffer (Closes: #868252) + syntax/2html.vim: Fix reference to undefined s:settings_no_doc variable (Closes: #1030151) + syntax/debcontrol.vim, syntax/debsources.vim: Add support for non-free-firmware. (Closes: #1029986) -- James McCoy Sat, 04 Mar 2023 14:41:33 -0500 vim (2:9.0.1000-4) unstable; urgency=medium * Backport patch to fix tests on IPv6-only hosts (Closes: #1027824) -- James McCoy Tue, 10 Jan 2023 22:16:36 -0500 vim (2:9.0.1000-3) unstable; urgency=medium * Fix substitution of VIMCUR in vim-common.install (Closes: #1027766) * Backport v9.0.1129 to fix sporadic Test_range failure -- James McCoy Tue, 03 Jan 2023 10:15:51 -0500 vim (2:9.0.1000-2) unstable; urgency=medium * Restore man page translations for da, de, and ja (Closes: #1027318) * Update to debhelper-compat 13 * Remove obsolete maintscript files for versions earlier than oldstable * Remove PER_VARIANT_FILES handling in debian/rules * Add future=+lfs to DEB_BUILD_MAINT_OPTIONS * Backport v9.0.1118 to fix sporadic test failures * ci: Run tests against installed xxd * ci: Install python3 for vim tests * Backport v9.0.1117 to fix bracketed paste with new ncurses (Closes: #1027674) -- James McCoy Mon, 02 Jan 2023 06:31:55 -0500 vim (2:9.0.1000-1) unstable; urgency=medium * Merge upstream patch v9.0.1000 + Security fixes - 9.0.0882: using freed memory after SpellFileMissing autocmd uses bwipe, CVE-2022-4292 - 9.0.0947: invalid memory access in substitute with function that goes to another file (Closes: #1027146, CVE-2022-4141) * Backport v9.0.1087 to fix test_autocmd flakiness -- James McCoy Wed, 28 Dec 2022 11:51:10 -0500 vim (2:9.0.0813-1) unstable; urgency=medium * Merge upstream patch v9.0.0813 + syntax/markdown.vim: Fix performance of markdownLinkText highlighting. (Closes: #994209) -- James McCoy Sun, 30 Oct 2022 16:59:44 -0400 vim (2:9.0.0626-1) unstable; urgency=medium * Merge upstream patch v9.0.0626 + Various CVE fixes (Closes: #1019590) - 9.0.0246: using freed memory when 'tagfunc' deletes the buffer, CVE-2022-2946 - 9.0.0260: using freed memory when using 'quickfixtextfunc' recursively, CVE-2022-2982 - 9.0.0322: crash when no errors and 'quickfixtextfunc' is set, CVE-2022-3037 - 9.0.0360: crash when invalid line number on :for is ignored, CVE-2022-3099 - 9.0.0389: crash when 'tagfunc' closes the window, CVE-2022-3134 - 9.0.0483: illegal memory access when replacing in virtualedit mode, CVE-2022-3234 - 9.0.0490: using freed memory with cmdwin and BufEnter autocmd, CVE-2022-3235 - 9.0.0530: using freed memory when autocmd changes mark, CVE-2022-3256 - 9.0.0577: buffer underflow with unexpected :finally, CVE-2022-3296 - 9.0.0598: using negative array index with negative width window, CVE-2022-3324 - 9.0.0614: CVE-2022-3352 + 9.0.0509: confusing error for "saveas" command with "nofile" buffer (Closes: #796872) -- James McCoy Fri, 30 Sep 2022 00:38:50 -0400 vim (2:9.0.0242-1) unstable; urgency=medium * Merge upstream patch v9.0.0242 + 9.0.241/242: Install the shared syntax files (Closes: #1017856) * Add historic changelog entry for #947120 fix * Adjust lintian overrides for new []-format * Declare compliance with Policy 4.6.1, no changes needed -- James McCoy Mon, 22 Aug 2022 22:46:33 -0400 vim (2:9.0.0229-1) unstable; urgency=medium * Merge upstream patch v9.0.0229 + Various CVE fixes - 9.0.0211: invalid memory access when compiling :lockvar, CVE-2022-2819 - 9.0.0212: invalid memory access when compiling :unlet, CVE-2022-2816 - 9.0.0213: using freed memory with error in assert argument, CVE-2022-2817 - 9.0.0218: reading before the start of the line, CVE-2022-2845 - 9.0.0220: invalid memory access with for loop over NULL string, CVE-2022-2849 - 9.0.0221: accessing freed memory if compiling nested function fails, CVE-2022-2862 - 9.0.0225: using freed memory with multiple line breaks in expression, CVE-2022-2889 * Add Recommends: xxd to vim-common * Minor fixes for vim-tiny's fake help file (Closes: #1017715) * Revert "Temporarily skip Test_Debugger_breakadd_expr", test fixed upstream -- James McCoy Sat, 20 Aug 2022 09:56:52 -0400 vim (2:9.0.0135-1) unstable; urgency=medium * Merge upstream patch v8.2.5172 + ftplugin/perl.vim: Only add : to 'isfname' in Perl buffers. (Closes: #761800) + ftplugin/tap.vim: Set fold-related options local to the buffer. (Closes: #954113) + syntax/debcontrol.vim: Fix highlighting of sections with a slash (e.g., "non-free/utils"). (Closes: #1010839) + syntax/tap.vim: Match TODO/SKIP markers case-insensitively. (Closes: #954016) + syntax/perl.vim: Properly highlight code on the same line as the start of a here-doc block. (Closes: #136455) + Various CVE fixes (Closes: #1015984, #1016068) - 8.2.5043: can open a cmdline window from a substitute expression, CVE-2022-1942 - 8.2.5050: using freed memory when searching for pattern in path, CVE-2022-1968 - 8.2.5063: error for a command may go over the end of IObuff, CVE-2022-2000 - 8.2.5120: searching for quotes may go over the end of the line, CVE-2022-2124 - 8.2.5122: lisp indenting may run over the end of the line, CVE-2022-2125 - 8.2.5123: using invalid index when looking for spell suggestions, CVE-2022-2126 - 8.2.5126: substitute may overrun destination buffer, CVE-2022-2129 - 9.0.0018: going over the end of the typeahead, CVE-2022-2285 - 9.0.0025: accessing beyond allocated memory with the cmdline window, CVE-2022-2288 - 9.0.0035: spell dump may go beyond end of an array, CVE-2022-2304 - 8.2.5162: reading before the start of the line with BS in Replace mode, CVE-2022-2207 - 8.2.4895: buffer overflow with invalid command with composing chars, CVE-2022-1616 - 8.2.4899: with latin1 encoding CTRL-W might go before the cmdline, CVE-2022-1619 - 8.2.4919: can add invalid bytes with :spellgood, CVE-2022-1621 - 8.2.4956: reading past end of line with "gf" in Visual block mode, CVE-2022-1720 - 8.2.4977: memory access error when substitute expression changes window, CVE-2022-1785 - 8.2.5013: after text formatting cursor may be in an invalid position, CVE-2022-1851 - 8.2.5023: substitute overwrites allocated buffer, CVE-2022-1897 - 8.2.5024: using freed memory with "]d", CVE-2022-1898 - 9.0.0060: accessing uninitialized memory when completing long line, CVE-2022-2522 * Temporarily skip Test_Debugger_breakadd_expr * Remove "Depends: xxd" from vim-common (Closes: #1007887) * Suppress error about missing defaults.vim in vim-tiny (Closes: #1004118) -- James McCoy Wed, 03 Aug 2022 19:00:35 -0400 vim (2:8.2.4793-1) unstable; urgency=medium * Merge upstream patch v8.2.4793 -- James McCoy Wed, 20 Apr 2022 20:23:54 -0400 vim (2:8.2.4659-1) unstable; urgency=medium * Merge upstream patch v8.2.4659 + 8.2.4151: reading beyond end of a line (Closes: #1004859, CVE-2022-0318) + autoload/phpcomplete.vim: Fix E565 error in omni-completion (Closes: #1008710) * Remove outdated NEWS and README.Debian entries * README.Debian: Fix links to vim-policy * Improve docs about purpose and effect of defaults.vim (Closes: #856273) * Define system (g)vimrc location as /etc/vim/(g)vimrc, rather than symlinking from /usr/share/vim/(g)vimrc -> /etc/vim/(g)vimrc. * Replace vim-athena with vim-motif, Athena GUI deprecated upstream * Remove lintian override for rgb.txt, removed upstream * Declare compliance with Policy 4.6.0, no changes needed * Remove vim-gtk transitional package -- James McCoy Sun, 03 Apr 2022 10:44:13 -0400 vim (2:8.2.3995-1) unstable; urgency=medium * Merge upstream patch v8.2.3918 + 8.2.3610: crash when ModeChanged triggered too early (Closes: #1001900, CVE-2021-3968) + 8.2.3611: crash when using CTRL-W f without finding a file name (Closes: #1001899, CVE-2021-3973) + 8.2.3612: using freed memory with regexp using a mark (Closes: #1001897, CVE-2021-3974) + 8.2.3625: illegal memory access when C-indenting (Closes: #1001896, CVE-2021-3984) + 8.2.3847: illegal memory access when using a lambda with an error (Closes: #1002534, CVE-2021-4136) + autoload/zip.vim: Use URI syntax for pseudo-filename to avoid empty buffer after 8.2.3468 (Closes: #1000767) * Revert "Disable Test_very_large_count since it fails on 32-bit systems", fixed upstream -- James McCoy Mon, 03 Jan 2022 17:57:10 -0500 vim (2:8.2.3565-1) unstable; urgency=medium * Merge upstream patch v8.2.3565 + 8.2.3489: ml_get error after search with range (Closes: #996593, CVE-2021-3875) + syntax/{debchangelog,debsources}.vim: Add jammy as a recognized Ubuntu release (Closes: #996760) * Drop patches applied upstream + Fix test_recover.vim's checks for endianness and size of long + Use explicitly signed type for tt_min_argcount to fix unsigned char systems * Revert "Temporarily depend on xxd for build tests/autopkgtests" * Disable Test_very_large_count since it fails on 32-bit systems -- James McCoy Sat, 30 Oct 2021 10:56:38 -0400 vim (2:8.2.3455-2) unstable; urgency=medium * Fix test_recover.vim's checks for endianness and size of long * Use explicitly signed type for tt_min_argcount to fix unsigned char systems -- James McCoy Sun, 03 Oct 2021 09:17:57 -0400 vim (2:8.2.3455-1) unstable; urgency=medium * Merge upstream patch v8.2.3455 + 8.2.2761: Don't add current_syn_inc_tag to topgrp. (Closes: #947120) + 8.2.3022: Add support for xchacha20 encryption, using libsodium + 8.2.3068: Update Unicode support to Unicode 13 + 8.2.3402, 8.2.3403: invalid memory access when using :retab with large value (Closes: CVE-2021-3770, #994076) + 8.2.3409: reading beyond end of line with invalid utf-8 character (Closes: CVE-2021-3778, #994498) + 8.2.3428: using freed memory when replacing (Closes: CVE-2021-3796, #994497) + 8.2.3430: Add the ModeChanged autocommand event + ftplugin/scala.vim: Fix syntax of includeexpr option (Closes: #895629) + syntax/{debchangelog,debsources}.vim: Add impish as a recognized Ubuntu release (Closes: #995151) * Vim addons policy + Automatically publish policy to https://vim-team.pages.debian.net/vim/ (Closes: #989223) + Rewrite policy to document use of dh_vim-addon instead of vim-addon-manager * Explicitly Depend on lynx to ensure docbook2txt works * Build against libsodium for non-tiny builds * Define a writable $HOME for the tests * Temporarily depend on xxd for build tests/autopkgtests, otherwise new tests for the xchacha20 encryption fail. * Switch to salsa-ci-team pipeline for CI -- James McCoy Thu, 30 Sep 2021 12:54:53 -0400 vim (2:8.2.2434-3) unstable; urgency=medium * Add pkg.vim.noruby Build-Profile * Disable ruby interpreter on alpha and ia64 (Closes: #983308) * Re-enable ruby for vim-gtk3 on Ubuntu, since it is no longer in main -- James McCoy Mon, 01 Mar 2021 21:58:09 -0500 vim (2:8.2.2434-2) unstable; urgency=medium * Only enable sound support for GUI builds (Closes: #982856) -- James McCoy Sat, 20 Feb 2021 13:46:51 -0500 vim (2:8.2.2434-1) unstable; urgency=medium * Merge upstream patch v8.2.2434 + 8.2.2428: Fix handling of focus events when 'ttymouse' is unset. (Closes: #980449) -- James McCoy Sat, 30 Jan 2021 23:47:07 -0500 vim (2:8.2.2367-1) unstable; urgency=medium * Merge upstream patch v8.2.2367 + 8.2.2367: Fix test failures on armel/armhf/mipsel -- James McCoy Sun, 17 Jan 2021 10:53:54 -0500 vim (2:8.2.2344-2) unstable; urgency=medium * rules: Add dummy command to test target to fix make error when DEB_BUILD_OPTIONS=nocheck -- James McCoy Thu, 14 Jan 2021 22:25:21 -0500 vim (2:8.2.2344-1) unstable; urgency=medium * Merge upstream patch v8.2.2344 + ftplugin/spec.vim: Fix missing ":let" (Closes: #977429) + syntax/cabal.vim: Add build-tools-depends keyword (Closes: #973548) * rules: Sanitize locale-related environment variables (Closes: #973943) -- James McCoy Thu, 14 Jan 2021 21:40:26 -0500 vim (2:8.2.1913-1) unstable; urgency=medium [ James McCoy ] * Merge upstream tag v8.2.1913 + syntax/sh.vim: Highlight "local var" appropriately when /bin/sh is dash. (Closes: #796282) + plugin/netrwPlugin.vim: Fix directory navigation with g:netrw_liststyle=3 and g:netrw_list_hide='^\..*'. (Closes: #942549) + 8.2.1909: Remove the limit on items in 'statusline' (Closes: #688258) + 8.2.1912: Fix test failures with Python 3 >= 3.9 (Closes: #972777) * rules: Provide path to vim when building vim.pot * Add procps and cscope to (autopkg)test Depends * d/tests: Use dpkg-query rather than dpkg-parsechangelog to get upstream version * d/tests: Use runtime/ from source tree * d/tests: Force TERM=xterm when running upstreamtest * Stop installing vim2html.pl * Stop installing README.txt files in vim-runtime * Lintian + Add national-encoding overrides for files intentionally in non-UTF8 encodings + Add package-contains-documentation-outside-usr-share-doc overrides for builtin help + Rename binary-without-manpage override to no-manual-page + Rename manpage-without-executable override to spare-manual-page + Override repeated-path-segment for dvorak plugin + Add package-contains-documentation-outside-usr-share-doc override for rgb.txt [ Pino Toscano ] * Remove unused XPM icons. * Remove do not ship gvim.svg in /usr/share/pixmaps. -- James McCoy Tue, 27 Oct 2020 21:38:24 -0400 vim (2:8.2.0716-3) unstable; urgency=medium * Version the vim/gvim/etc Provides for the vim binary packages. This allows versioned Depends on vim to be satisfied by any of the binary packages instead of trying to install Package: vim. (Closes: #960119) -- James McCoy Mon, 11 May 2020 22:37:13 -0400 vim (2:8.2.0716-2) unstable; urgency=medium * Build vim-basic for arch-all builds, needed for install targets -- James McCoy Sat, 09 May 2020 11:27:39 -0400 vim (2:8.2.0716-1) unstable; urgency=medium * Merge upstream tag v8.2.0716 + syntax/make.vim: Fix mis-highlighting of targets that start with the word "overrule". (Closes: #958993) * rules: Switch to dh * Remove src/po/vim.pot during clean -- James McCoy Sat, 09 May 2020 09:20:09 -0400 vim (2:8.2.0510-1) unstable; urgency=medium * Merge upstream tag v8.2.0510 + 8.2.0444: Improve reliability of Test_swap_prompt_splitwin + 8.2.0447: Improve reliability of Test_terminal_scroll + 8.2.0454: Improve reliability of Test_state + 8.2.0456, 8.2.0461, 8.2.0470: Improve reliability of Test_confirm_cmd + 8.2.0462: Fix invalid assertion in Test_popup_and_previewwindow_dump + 8.2.0474: Allow ":write" to overwrite an existing file when used via BufWriteCmd, fixing breakage of plugins like vim-gnupg * Add lintian overrides for manpage-without-executable * Remove obsolete vim-common.preinst -- James McCoy Sat, 04 Apr 2020 23:20:13 -0400 vim (2:8.2.0439-1) unstable; urgency=medium * Merge upstream tag v8.2.0439 + 8.2.0398: Fix FTBFS due to Test_profile_func() failure + 8.2.0436: Fix FTBFS in test_vim9_disassemble.vim due to type mismatches in format strings -- James McCoy Mon, 23 Mar 2020 23:21:40 -0400 vim (2:8.2.0397-1) unstable; urgency=medium * Merge upstream tag v8.2.0397 + 8.2.0382: Fix Test_terminal_in_popup failures by disabling the ruler + syntax/resolv.vim: Refresh list of known options. (Closes: #626371) -- James McCoy Tue, 17 Mar 2020 08:31:45 -0400 vim (2:8.2.0378-1) unstable; urgency=medium * Merge upstream tag v8.2.0378 + 8.2.0374: Fix test failures on 32-bit archs. (Closes: #953742) -- James McCoy Fri, 13 Mar 2020 23:40:47 -0400 vim (2:8.2.0368-1) unstable; urgency=medium * Merge upstream patch v8.2.0368 + New "vim9script" syntax available for scripts, c.f. ":help vim9-script" + syntax/debchangelog.vim: Stop highlighting space before "UNRELEASED" as an error (Closes: #944781) + syntax/markdown.vim: Don't treat a bare "<" as the start of an HTML tag. (Closes: #892172) + syntax/resolv.vim: Highlight IPv6 addresses (Closes: #626371) + 8.2.0271: Correctly format 64-bit numbers for status messages in vim-tiny on 32-bit systems (Closes: #951380) * Declare compliance with Policy 4.5.0, no changes needed * Build-Depend on debhelper-compat (= 12) -- James McCoy Tue, 10 Mar 2020 22:54:00 -0400 vim (2:8.1.2269-1) unstable; urgency=medium * Merge upstream patch v8.1.2269 + 8.1.2261: Disable modifyOtherKeys while in Insert mode when 'noesckeys' is set. (Closes: #944132) -- James McCoy Sat, 09 Nov 2019 07:59:40 -0500 vim (2:8.1.2244-1) unstable; urgency=medium * Merge upstream patch v8.1.2244 + syntax/debchangelog.vim: Highlight unsupported releases differently than supported releases. (Closes: #847933) + "mouse" feature is now always enabled. + Improve support for chorded mappings in xterm, when xterm's modifyOtherKeys mode is enabled, c.f. :help modifyOtherKeys. * Revert "Move /usr/bin/vim.* into /usr/libexec/vim/" (Closes: #943328, #942225). The change broke user preferences for alternatives and sensible-editor. * Add /var/lib/addons to 'runtimepath' at build time (Closes: #943967) * Use dh_missing instead of dh_install --list-missing (Closes: #942277) -- James McCoy Sun, 03 Nov 2019 20:52:36 -0500 vim (2:8.1.2136-1) unstable; urgency=medium * Merge upstream patch v8.1.2136 + Farsi support was removed + syntax/debcontrol.vim: Recognize "Files-Excluded(-)" fields (Closes: #932894) + Swap files are automatically deleted if the file was unmodified and the process which generated the swap file isn't running. (Closes: #375989) + Fix incorrect over-indenting when auto-indent is enabled for XML files. (Closes: #918672) + Fix indentation of bash scripts with nested if blocks. (Closes: #939369) + New popup window support, via the "popup_*()" APIs + New sound support, via the "sound_*()" APIs + "localmap", "visual", "visualextra", "visualedit", "user_commands", "multi_byte", "cmdline_compl", "insert_expand", "modify_fname", and "comments" features are now always enabled. + Fix test_compiler.vim failure when locale isn't available. (Closes: #917859) * control: + Remove obsolete versioned Build-Depends on dpkg-dev * rules: + Use dh_install --list-missing * Turn vim-gtk into a transitional package to vim-gtk3 (Closes: #930576 since the IA__gdk_drawable_get_size assertions don't happen in the GTK3 build) * Declare compliance with Policy 4.4.1, no changes needed * Move /usr/bin/vim.* into /usr/libexec/vim/ * autopkgtest: + Mark the "$variant --version" tests superficial + Add new tests which run the build time tests against the installed binary/runtime. Mark it flaky for now, since there are some tests which are more prone to fail in the LXC environment. + Run autopkgtests as a dedicated user, to avoid false negative failures with upstream tests which check permissions -- James McCoy Fri, 11 Oct 2019 21:37:58 -0400 # Older entries have been removed from this changelog. # To read the complete changelog use `apt changelog vim-nox`.