vcswatch reports that
this package seems to have a new changelog entry (version
3.49.8-1, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
Here are the relevant commit messages:
commit b21f85c53f9bb78dfe133bff892d372ab431539c
Merge: abd19b8 0a20aa8
Author: Xavier Roche <roche@httrack.com>
Date: Tue Jun 9 20:12:01 2026 +0200
Merge pull request #317 from xroche/fix/cookie-cmp-loop
Fix never-matching wildcard cookie domain comparison
commit 0a20aa8522bdab079626289330b64d16ef12705f
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Tue Jun 9 20:09:23 2026 +0200
Fix never-matching wildcard cookie domain comparison
cookie_cmp_wildcard_domain used an unsigned loop counter, so i >= 0 was always
true (infinite loop and out-of-bounds reads) and an empty domain underflowed
l - 1. Use a signed counter. Found and fixed by greenrd in #172. closes #171
commit abd19b8cfa4b26504310f18e893ee6900a627b31
Merge: 566b9d5 4797749
Author: Xavier Roche <roche@httrack.com>
Date: Mon Jun 8 20:40:51 2026 +0200
Merge pull request #316 from xroche/chore/changelog-news-symlink
build: symlink ChangeLog and NEWS to history.txt
commit 4797749d4daa0dc3e4861f1588316c038ab423f8
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Mon Jun 8 20:40:27 2026 +0200
build: symlink ChangeLog and NEWS to history.txt
They were empty automake stubs (GNU strictness requires the files to exist).
Pointing them at history.txt satisfies automake, drops the confusing empty
files, and ships a real changelog in the dist tarball without duplicating
content in git.
commit 566b9d5008d48a1d89538be12a19fbd623201d4a
Merge: e4fc8ca 8b6bc1d
Author: Xavier Roche <roche@httrack.com>
Date: Mon Jun 8 20:22:21 2026 +0200
Merge pull request #315 from xroche/docs/readme-badges
docs: add CI and license badges to README.md
commit 8b6bc1d0edf77b288c4f20bc5e6ea850727bad38
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Mon Jun 8 20:21:52 2026 +0200
docs: add CI and license badges to README.md
commit e4fc8ca26fa0d0cc701388103d0e45f614e51163
Merge: a2b3dc9 5269266
Author: Xavier Roche <roche@httrack.com>
Date: Mon Jun 8 20:19:11 2026 +0200
Merge pull request #314 from xroche/ci/github-actions
ci: add GitHub Actions build/test matrix and shell lint
commit 52692668cd0e26d6aeac1aee8cd2b7842dd58122
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Mon Jun 8 20:16:38 2026 +0200
ci: add GitHub Actions build/test matrix and shell lint
Build and test (autoreconf, configure, make, make check) on x86-64 and arm64
with gcc and clang. A lint job runs shellcheck and shfmt -i 4 on the maintained
scripts.
commit a2b3dc93a33b83126244c8367ed715c5ca3d8797
Merge: a880195 308f071
Author: Xavier Roche <roche@httrack.com>
Date: Sun Jun 7 14:38:17 2026 +0200
Merge pull request #313 from xroche/feat/license-gpl3-simplify
Drop the OpenSSL linking exception, simplify to GPL-3.0
commit 308f07191063f2045c68f34c799944abb151cb83
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 14:29:33 2026 +0200
Updated to 3.49.8
commit 62a9643fc5db286075904c11f2a10a48403525d5
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 14:29:33 2026 +0200
license: drop the obsolete OpenSSL linking exception
OpenSSL 3.0+ is Apache-2.0 (GPL-compatible) and LibreSSL is BSD, so the GPL
linking exception is no longer needed; httrack is now plain GPL-3.0-or-later.
license.txt now carries the verbatim GPLv3 (matching COPYING); the ethical-use
request moves to README. debian/copyright updated to match.
commit a88019560b776efa5c437b16e3ddd491330448c0
Merge: 7047e3d e6cae43
Author: Xavier Roche <roche@httrack.com>
Date: Sun Jun 7 14:18:44 2026 +0200
Merge pull request #312 from xroche/chore/debhelper-compat-13
debian: switch to debhelper-compat (= 13)
commit e6cae4343a7240fdadfdb506d752fdb7367e80fc
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 14:14:03 2026 +0200
debian: switch to debhelper-compat (= 13)
Replace the debian/compat file and the unversioned debhelper build-dep with
debhelper-compat (= 13), and drop the now-redundant dh-autoreconf and obsolete
autotools-dev build deps. Compat level is unchanged (13). Clears the
no-versioned-debhelper-prerequisite and useless-autoreconf-build-depends lintian
tags. Folded into the not-yet-uploaded 3.49.7-2 stanza.
commit 7047e3ddd92f59c11fb63dc3f94f03ad7ed0ca9c
Merge: 87452f3 074965d
Author: Xavier Roche <roche@httrack.com>
Date: Sun Jun 7 13:09:06 2026 +0200
Merge pull request #311 from xroche/chore/standards-version-4.7.0
debian: bump Standards-Version to 4.7.0
commit 074965d38a73007a7116d7d6178fcdffb7267f41
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 13:06:23 2026 +0200
debian: bump Standards-Version to 4.7.0
No packaging changes required. The 4.7.0 normative items do not apply to
httrack: it ships no maintainer scripts (so the systemd config
diversion/alternatives rule is moot), no services or init scripts (so the
systemd-unit requirement is moot), and it is in main (so the contrib/non-free
no-network rules target rule is moot).
commit 87452f3b89104efd57b38e07cd89779b56f577df
Merge: dc50f25 3220085
Author: Xavier Roche <roche@httrack.com>
Date: Sun Jun 7 11:47:18 2026 +0200
Merge pull request #310 from xroche/feat/in-tree-mkdeb
Build Debian packages in-tree via tools/mkdeb.sh
commit 3220085797f02ea7c4b2a8cca7a03697c9352156
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 11:45:40 2026 +0200
tools: collect artifacts with dcmd, tidy tool checks
dcmd expands the .changes to its full file set (orig, dsc, debs, dbgsym
ddebs, buildinfo), replacing the hand-rolled copy loop that silently
dropped the dbgsym packages. need() now takes several tools at once;
drop the unused dpkg-parsechangelog check and require dcmd.
commit ba41415c157054cce3e4e66b5daf16ff45d5f8f4
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 11:31:25 2026 +0200
scripts: shellcheck and shfmt -i 4 cleanup
makeman.sh: use CDPATH='' (SC1007) and 4-space indent; the manpage regen test
reformatted with shfmt -i 4. No behavior change.
commit 49a6698ca5e9d9c2230f15328a9504c6a3022b72
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 11:31:25 2026 +0200
debian: fix bogus maintainer email in the 3.49.6-1 changelog entry
roche@proliant.localnet was a local hostname that leaked into a released entry;
lintian flags it as bogus-mail-host. Use xavier@debian.org like the other
entries.
commit 0de1b405e4fe0dbb270400f617cb4f1e7946543e
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 11:31:25 2026 +0200
tools: add mkdeb.sh and a make deb target for signed packages
Replaces an external workstation script. mkdeb.sh exports committed HEAD plus
the coucal submodule to a scratch dir, refreshes the build system and man page
(reusing make -C man regen-man), builds a clean upstream tarball, overlays
debian/, and runs debuild (build + lintian + signing). It takes the GPG key and
options as arguments and writes nothing in the working tree. 'make deb
DEB_FLAGS=...' is a thin wrapper. Honors SOURCE_DATE_EPOCH.
commit dc50f2542095e5e29d6de458ecd189569c15e072
Merge: 000017b 7bab826
Author: Xavier Roche <roche@httrack.com>
Date: Sun Jun 7 10:56:55 2026 +0200
Merge pull request #309 from xroche/feat/manpage-generator
Generate the man page in-tree from --help (indent-aware)
commit 7bab8263a1f7f72d4eee1708d80c0721e76564b8
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 10:53:03 2026 +0200
man: regenerate httrack.1 with an in-tree, indent-aware script
The external makeman.sh turned the first token of every indented --help line
into an option, so prose like the -%! warning rendered as bogus -IMPORTANT and
-USE options (Debian #1061053). man/makeman.sh classifies lines by indentation,
reads README from the source tree, and honors SOURCE_DATE_EPOCH.
'make -C man regen-man' refreshes the page; tests/02_manpage-regen.test fails
if the committed page drifts from --help.
commit 000017bce751f05fc76555624644c9812d4403e3
Merge: dcf300c 98b6b1e
Author: Xavier Roche <roche@httrack.com>
Date: Sun Jun 7 08:55:44 2026 +0200
Merge pull request #308 from xroche/fix/openssl4-tls-init
Modernize OpenSSL TLS init for the 3.x->4.x transition
commit 98b6b1e2e7cf73c73e810f82540707fd811c9284
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sun Jun 7 08:50:04 2026 +0200
tls: modernize OpenSSL init for the 3.x->4.x transition
Use TLS_client_method() and OpenSSL_version() on OpenSSL 1.1.0+ / LibreSSL
2.7.0+; the deprecated SSLv23/SSLeay init may be removed in OpenSSL 4.0.
Legacy path kept for older OpenSSL.
commit dcf300c2114d417670cdfba80c3ad36ee17420a3
Merge: 748c35d f907ac5
Author: Xavier Roche <roche@httrack.com>
Date: Sat Jun 6 21:18:13 2026 +0200
Merge pull request #307 from xroche/fix/multiarch-config-h-coinstall
Fix Multi-Arch co-installation and man page rendering (3.49.7)
commit f907ac5264f8e2ffb9c2414657ffa6df2d8fe94b
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sat Jun 6 21:15:24 2026 +0200
Updated to 3.49.7
New upstream release for the Multi-Arch config.h fix (Debian #1133728) and
the man page rendering fix (Debian #1061053).
commit 072464b501726de09a03c7c57590060d956ab27b
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sat Jun 6 21:15:24 2026 +0200
man: fix -%! security warning rendered as bogus options (Debian #1061053)
The IMPORTANT NOTE / USE IT lines used .IP \-... tags, so groff showed
them as -IMPORTANT and -USE options. Render them as continuation text of
the -%! description instead.
commit d4b6e05aeb049eda9f07794498cdb99e1e25b434
Author: Xavier Roche <xavier.roche@algolia.com>
Date: Sat Jun 6 20:47:05 2026 +0200
build: keep SIZEOF_LONG out of config.h for Multi-Arch (Debian #1133728)
SIZEOF_LONG was the only config.h macro differing across architectures
(8 vs 4), which broke libhttrack-dev Multi-Arch: same co-installation.
md5.h was its only non-Windows user and now uses uint32_t from <stdint.h>.
Regenerated configure and config.h.in.
commit 748c35de7858ead963daf1393ad023d75b7820c2
Author: Xavier Roche <roche@httrack.com>
Date: Tue Mar 11 19:41:37 2025 +0100
Updated to 3.49.6
commit e80327190d2dc3044ef9333cf36290efa083071d
Merge: ce2d2ce c490c3c
Author: Xavier Roche <roche@httrack.com>
Date: Sun Mar 9 17:51:01 2025 +0100
Merge pull request #290 from tabudz/fix-CVE-2017-14062
Fix: Potential Vulnerability in Cloned Function
commit c490c3c3e52d7966ef46d745468dc2ddbb493ce9
Author: tabudz <tanb74653@gmail.com>
Date: Tue Feb 25 12:12:44 2025 +0800
lib/puny_decode: Fix integer overflow (found by fuzzing)
commit ce2d2ce810cb1bbaf1c587a3947c31adb47d5244
Author: Xavier Roche <roche@httrack.com>
Date: Tue Feb 13 20:05:47 2024 +0100
Add missing missing helper (closes #273)
![[bug history graph]](https://qa.debian.org/data/bts/graphs/h/httrack.png){kind=link}