d/changelog: ready for upload to unstable.

d/patches/CVE-2026-*.patch: new security patches.

This change includes a patch queue addressing CVE-2026-50003,
CVE-2026-50254, CVE-2026-35505, CVE-2026-52868 and CVE-2026-44628.
The latter CVE-2026-44628 is divided into two patches to match
upstream's commits.  These changes fix a range of issues, including
risks of path traversals, denial of services and information leaks.

Closes: #1141411

d/changelog: ready for upload to unstable.

CVE-2026-12805.patch: new: fix CVE-2026-12805.

This patch fixes a risk of buffer overflow by ensuring negative error
codes in XMLNode::parseFile are properly handled, as well a NULL
values.

Closes: #1140562

d/changelog: ready for urgent upload to unstable.

d/control: add myself to uploaders.

CVE-2026-10194.patch: new: fix CVE-2026-10194.

Closes: #1139181

d/changelog: ready for upload to unstable.

Revert "CVE-2026-10528-partial.patch: new: fix needed by orthanc."

The change is causing an ABI breakage that is going to require a
transition.  It is more appropriate to wait for the 3.7.1 release and
coordinate the transition on a sane basis.  In the meantime the change
is undone.

This reverts commit 5d6c0649ddf534d574f7c64245f13a9924400245.

d/changelog: ready for team upload.

d/changelog: ready for upload to unstable.

d/changelog: update the changelog.

CVE-2026-10528-partial.patch: new: fix needed by orthanc.

This patch introduce the part of the mitigation against CVE-2026-10528
affecting orthanc that needs to be applied on the side of dcmtk.  See
also Debian bug #1138713.

CVE-2026-5663.patch: new: fix CVE-2026-5663.

This change introduces guardrails to prevent risks of shell code
injection.

Closes: #1133001

d/changelog: initialise the changelog.

Merge remote-tracking branch 'pino/hurd'

release

Update standards version to 4.7.4, no changes needed.

Upgrade checklist verified:
 4.7.3 → 4.7.4:
  * Package is not in non-free-firmware

Changes-By: lintian-brush
Fixes: lintian: source: out-of-date-standards-version 4.7.3 (released 2025-12-23) (current is 4.7.4.1)
See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

use dh-cruft to register obsolete files to purge

Install and use sysusers.d/tmpfiles.d config files

sysusers.d/tmpfiles.d config files allow a package to use declarative
configuration instead of manually written maintainer scripts.
This also allows image-based systems to be created with /usr/ only, and
also allows for factory resetting a system and recreating /etc/ on boot.

https://www.freedesktop.org/software/systemd/man/latest/sysusers.d.html

Stop deleting system user/group on remove/purge

Removing system users/groups on purge is considered bad practice,
as the kernel recycles UIDs/GIDs. So any potential leftover
file/directory can then become owned by the next user/group that
gets added, with unpredictable consequences.

d/changelog: start transition to unstable.

d/changelog: document drop of Breaks+Replaces.

d/control: drop libdcmtk20 breaking and replacing libdcmtk19.

After examination of the situation, the stanza was needed against the
faulty 3.7.0-1, but it is not needed on 3.7.0+really3.6.9-1.

d/changelog: initialize the changelog.

d/u/metadata: eprint → Eprint.

skip-bigendian-roundtrip-failure.patch: short form BTS URI.

d/copyright: provide working links to the AFPL.

The original link from the legal text broke some time ago.
The AFPL does not have to apply in that context anyways.

d/changelog: ready for experimental upload.

skip-bigendian-roundtrip-failure.patch: new: skip test failure on s390x.

The correction is work in progress upstream.

d/changelog: update the changelog.

d/control: libdcmtk20 replaces libdcmtk19.

d/changelog: initialize for experimental upload.

d/*: soname bump to libdcmtk20.

d/rules: guard against accidental ABI breakages.

d/changelog: ready for upload to unstable.

d/dcmtk-doc.doc-base: update upstream version.

Revert "d/dcmtk-doc.doc-base: fix hardwired version number."

This reverts commit bad4aff296a7c0909b46e1d8a4c81f36c0f6f219.

d/copyright: refresh following new upstream release.

d/patches/hurd.patch: new, fix the build on GNU/Hurd.

d/dcmtk-doc.doc-base: fix hardwired version number.

d/control: declare compliance to standards version 4.7.3.

d/changelog: initialise appropriately.

d/control: drop redundant Priority: optional.

07_dont_export_all_executables.patch: unfuzz.

*-CVE-*.patch: delete: all security issues are fixed upstream.

d/copyright: document new file o/i/d/o/ofjsmn.h.

d/copyright: bump upstream copyright year.

Update upstream source from tag 'upstream/3.7.0'

Update to upstream version '3.7.0'
with Debian dir 612b2dd5f1ee8f9e2aca579885ed44dd04f7e738

New upstream version 3.7.0

d/changelog: ready for upload to unstable.

d/libdcmtk19.lintian-overrides: fix typo caught by lintian.

d/control: declare compliance to standards version 4.7.2.

d/control: drop redundant Rules-Requires-Root: no.

d/watch: convert to v5 Github template.

d/changelog: unrelease to bring a few more changes.

d/changelog: ready for upload to unstable.

d/patches/*-CVE-2025-9732.patch: new.

These changes pulled from dcmtk upstream address CVE-2025-9732.

Closes: #1113993

d/rules: cleanup a stray "noname" file.

Closes: #1122403

d/changelog: Upload 3.6.9-5 to unstable

documentation: Spring cleanups. Closes: #1095639

0012-CVE-2025-2357.patch: new: fix CVE-2025-2357.

Closes: #1100724

d/control: relax dependency on dcmtk-data. Closes: #1098944

d/changelog: ready for upload to unstable.

0011-CVE-2025-25472.patch: new: fix CVE-2025-25472.

d/changelog: unrelease.

d/changelog: ready for upload to unstable.

0010-CVE-2025-25474.patch: new: fix CVE-2025-25474.

Closes: #1098374

0009-CVE-2025-25475.patch: new: fix CVE-2025-25475.

Closes: #1098373

Reinstate 0007-CVE-2024-47796.patch and 0008-CVE-2024-52333.patch.

These were not part of dcmtk 3.6.9 upstream and still apply.

Thanks: Salvatore Bonaccorso

d/changelog: Upload 3.6.9-3 to unstable

d/watch: Properly watch upstream on github

d/doc: Make sure to reference 3.6.9 path

d/patches: Remove old unused patches

d/changelog: Upload 3.6.9-2 to experimental

d/t/run-unit-test: Adapt to new installation

d/changelog: Upload 3.6.9-1 to experimental

Merge branch 'master' into debian/experimental

d/patches: Refresh patches

d/install: Migrate to new SOVERSION

New upstream version 3.6.9

Update upstream source from tag 'upstream/3.6.9'

Update to upstream version '3.6.9'
with Debian dir 6c3bd68558195e7a06972f9cf791344eb75eae8c

d/changelog: ready for upload to unstable.

0008-CVE-2024-52333.patch: new.

This patch addresses CVE-2024-52333.

Closes: #1093047

0007-CVE-2024-47796.patch: new.

This patch addresses CVE-2024-47796.

Closes: #1093043

0004-Fixed-two-segmentation-faults.patch: unfuzz.

0001-Fixed-unchecked-typecasts-of-DcmItem-search-results.patch

Patch refreshed.

d/changelog: Upload 3.6.8-6 to unstable

d/patches: Fixed possible overflows when allocating memory. Closes: #1074483

d/t/run-unit-test: Fix unit-test for new release. Closes: #1075917

d/changelog: Upload 3.6.8-5 to unstable

d/control: Bump Std-Vers to 4.7.0 no changes needed

d/changelog: Upload 3.6.8-4 to experimental

Merge branch 'master' into debian/experimental

Upload for unstable as 3.6.7-15

Update two of the previously applied patches to avoid breaking the ABI. Closes: #1070207.

The updated patches are:

0001-Fixed-unchecked-typecasts-of-DcmItem-search-results.patch
0003-Fixed-wrong-error-handling-previous-commit.patch

Upload for unstable as 3.6.7-14

Apply patches from NMU proposal by Adrian Bunk to address CVE-2024-28130, CVE-2024-34508 and CVE-2024-34509. Closes: #1070207.

drop salsa-ci.yml in favor of the default configuration from pipeline repository

build reproducibly without rpath and set LD_LIBRARY_PATH for running tests