#1059773 gnome-calculator: completely freeze at startup

Package:
gnome-calculator
Source:
gnome-calculator
Description:
GNOME desktop calculator
Submitter:
szcl
Date:
2025-08-27 07:05:03 UTC
Severity:
normal
Tags:
#1059773#5
Date:
2023-12-31 19:15:17 UTC
From:
To:
Dear Maintainer,


   * What led up to the situation?

        Launching the app today, it start normally, blink for a couple of times
and then it get completely freeze.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

        Launching the app.

   * What was the outcome of this action?

        Completely freeze.

   * What outcome did you expect instead?

        Do some calculations with it.
#1059773#10
Date:
2024-12-23 17:16:08 UTC
From:
To:
It seems to be a issue with the currency exchange rate update with HTTP:


~$ gnome-calculator

** (gnome-calculator:15095): WARNING **: 17:02:15.089:
currency-provider.vala:161: Couldn't download IMF currency rate file:
HTTP/2 Error: INTERNAL_ERROR

(gnome-calculator:15095): libsoup-WARNING **: 17:02:15.089:
(../libsoup/soup-session.c:334):soup_session_dispose: runtime check
failed: (soup_connection_manager_get_num_conns (priv->conn_manager) == 0)

(gnome-calculator:15095): libsoup-WARNING **: 17:02:15.089:
(../libsoup/soup-connection-manager.c:78):soup_host_free: runtime check
failed: (host->conns == NULL)
Killed


*After disabling internet connection, I could start the calculator
again.* After disabling the weekly/daily currency updates in the
settings, the program starts without freezing also with enabled internet
connection. Upstream bug report:


https://gitlab.gnome.org/GNOME/gnome-calculator/-/issues/359
#1059773#15
Date:
2025-02-19 17:20:24 UTC
From:
To:
Dear Maintainer,

   * What led up to the situation?

   Did the most recent security upgrade that brought in updated gnutls
   packages:

   Start-Date: 2025-02-19  10:41:30
   Commandline: packagekit role='update-packages'
   Upgrade: openssh-client:amd64 (1:9.2p1-2+deb12u4, 1:9.2p1-2+deb12u5), openssh-server:amd64 (1:9.2p1-2+deb12u4, 1:9.2p1-2+deb12u5), openssh-sftp-server:amd64 (1:9.2p1-2+deb12u4, 1:9.2p1-2+deb12u5), libgnutls30:amd64 (3.7.9-2+deb12u3, 3.7.9-2+deb12u4), libgnutls-dane0:amd64 (3.7.9-2+deb12u3, 3.7.9-2+deb12u4)
   End-Date: 2025-02-19  10:41:39

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

   So far starting from the terminal has made no difference.  After
   several seconds Gnome Shell will generate a popup stating that
   Calcuator is not responding and gives options to wait or force quit.

   * What was the outcome of this action?

   Selecting "Wait" results in the UI remaining unresponsive and the
   popup appearing again.  The only thing that happens is that it exits
   when "Force Quit" is selected.


Starting Calculator from the terminal gives this output:

$ gnome-calculator

** (gnome-calculator:8608): WARNING **: 11:05:10.574: currency-provider.vala:161: Couldn't download IMF currency rate file: HTTP/2 Error: INTERNAL_ERROR

(gnome-calculator:8608): libsoup-WARNING **: 11:05:10.574: (../libsoup/soup-session.c:334):soup_session_dispose: runtime check failed: (soup_connection_manager_get_num_conns (priv->conn_manager) == 0)

(gnome-calculator:8608): libsoup-WARNING **: 11:05:10.574: (../libsoup/soup-connection-manager.c:78):soup_host_free: runtime check failed: (host->conns == NULL)
Killed


Is this related to the failure to download the currency rate file?  Are
the updated gnutls packages to blame?

I am seeing this behavior on two Bookworm systems.

- Nate
#1059773#20
Date:
2025-02-19 20:37:56 UTC
From:
To:
I have been informed via Reddit that:

dconf write /org/gnome/calculator/refresh-interval 0

disables the attempt to download the currency file and permits using the
application.

- Nate
#1059773#25
Date:
2025-02-20 11:20:08 UTC
From:
To:
Hi,

same here, possible a side effect of the libgnutls30:amd64
(3.7.9-2+deb12u3, 3.7.9-2+deb12u4) update?

The workaround with the refresh-interval 0 is not so easy with many users...

Samuel
#1059773#30
Date:
2025-02-22 08:16:46 UTC
From:
To:
Same here with gnome-calculator 1:43.0.1-2 and libsoup-3.0-0 3.2.2-2.  Messages on the console when WiFi is on:
** (gnome-calculator:39353): WARNING **: 09:11:55.567: currency-provider.vala:161: Couldn't download IMF currency rate file: HTTP/2 Error: INTERNAL_ERROR
(gnome-calculator:39353): libsoup-WARNING **: 09:11:55.567: (../libsoup/soup-session.c:334):soup_session_dispose: runtime check failed: (soup_connection_manager_get_num_conns (priv->conn_manager) == 0)
(gnome-calculator:39353): libsoup-WARNING **: 09:11:55.567: (../libsoup/soup-connection-manager.c:78):soup_host_free: runtime check failed: (host->conns == NULL)
The same workarounds apply: before running the calculartor, turn the WiFi off or stop refreshing the exchange rates via
$ gsettings set org.gnome.calculator refresh-interval 0
Whoever is responsible: shouldn't the bug reports be merged?
#1059773#37
Date:
2025-02-24 13:01:17 UTC
From:
To:
Hi.

Le Wed, Feb 19, 2025 at 02:37:56PM -0600, Nate Bargmann a écrit :

Thanks.

Upstream issues tracker also gets the suggestion to issue;
$ gsettings set org.gnome.calculator refresh-interval 0

I guess both commands have the same effect.

Hope this help,
#1059773#44
Date:
2025-03-27 19:38:00 UTC
From:
To:
1) I am seeing the same thing, also on Bookworm, and also with
gnome-calculator 1:43.0.1-2.

2) There are several bug reports that describe this one. Perhaps they
can be consolidated?

3) trixie has gnome-calculator 1:48.0-1, and it has a similar problem,
just not as obnoxious. Logging in over SSH, after a lengthy wait
(timeout on the currency conversion values?):

charles@tiassa:~$
(gnome-calculator:35091): Gtk-CRITICAL **: 12:14:13.070: Unable to register the application: GDBus.Error:org.freedesktop.DBus.Error.NoReply: Message recipient disconnected from message bus without replying

** (gnome-calculator:35091): WARNING **: 12:14:13.214: currency-provider.vala:171: Couldn't download IMF currency rate file: HTTP/2 Error: INTERNAL_ERROR

(gnome-calculator:35091): libsoup-WARNING **: 12:14:13.214: (../libsoup/soup-session.c:334):soup_session_dispose: runtime check failed: (soup_connection_manager_get_num_conns (priv->conn_manager) == 0)

(gnome-calculator:35091): libsoup-WARNING **: 12:14:13.214: (../libsoup/soup-connection-manager.c:84):soup_host_free: runtime check failed: (host->conns == NULL)

(gnome-calculator:35091): libsoup-WARNING **: 12:14:13.214: Disposing connection 0x55ac91a52800 while still connected

** (gnome-calculator:35091): WARNING **: 12:14:13.222: currency-provider.vala:544: Cannot use BC rates as don't have CAD rate

** (gnome-calculator:35091): WARNING **: 12:14:13.382: currency-provider.vala:407: Cannot use ECB rates as don't have EUR rate

** (gnome-calculator:35091): WARNING **: 12:14:14.083: currency-provider.vala:616: Cannot use UN rates as don't have USD rate

[1]+  Done                    gnome-calculator
charles@tiassa:~$

4) Suggestion for upstream: only get the currency conversion values if
the user is using the currency conversion facilities. I see no point in
fetching them if the user isn't going to use them.
#1059773#49
Date:
2025-08-21 14:23:06 UTC
From:
To:
Control: severity -1 serious
Control: tags -1 + bookworm pending
Control: block -1 by 1109147

A fix for this libsoup3 issue has been approved by the stable release
managers and should be included in the Debian 12.12 point release, which
is planned for 6th September. The same issue was also already fixed in
the Debian 13.0 stable release.

This is a libsoup3 bug, not a gnome-calculator bug (even though the
symptom appears in gnome-calculator), so gnome-calculator will not be
changed for this.

As noted in several of the many duplicate bug reports, a workaround is
to run this command

     gsettings set org.gnome.calculator refresh-interval 0

which turns off download of currency exchange rates.

Peter Mueller wrote:

I am intentionally not merging the duplicate bug reports or reassigning
them to libsoup3 at this stage, in the hope that this way, users of
gnome-calculator will see at least one of the 10 different bug reports
that refers to this issue, and not open an 11th.

     smcv
#1059773#58
Date:
2025-08-21 14:23:06 UTC
From:
To:
Control: severity -1 serious
Control: tags -1 + bookworm pending
Control: block -1 by 1109147

A fix for this libsoup3 issue has been approved by the stable release
managers and should be included in the Debian 12.12 point release, which
is planned for 6th September. The same issue was also already fixed in
the Debian 13.0 stable release.

This is a libsoup3 bug, not a gnome-calculator bug (even though the
symptom appears in gnome-calculator), so gnome-calculator will not be
changed for this.

As noted in several of the many duplicate bug reports, a workaround is
to run this command

     gsettings set org.gnome.calculator refresh-interval 0

which turns off download of currency exchange rates.

Peter Mueller wrote:

I am intentionally not merging the duplicate bug reports or reassigning
them to libsoup3 at this stage, in the hope that this way, users of
gnome-calculator will see at least one of the 10 different bug reports
that refers to this issue, and not open an 11th.

     smcv
#1059773#63
Date:
2025-08-22 15:32:30 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
libsoup3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1059773@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon McVittie <smcv@debian.org> (supplier of updated libsoup3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 12 Jul 2025 14:39:06 +0100
Source: libsoup3
Architecture: source
Version: 3.2.3-0+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1052551 1054962 1059773 1064744 1077962 1087416 1087417 1098315 1099119 1100509 1100541 1101922 1102471 1104456
Changes:
 libsoup3 (3.2.3-0+deb12u1) bookworm; urgency=medium
 .
   * Team upload
 .
   [ Jeremy Bícha ]
   * d/control{,.in}: Add Build-Depends: ca-certificates for build-time tests
     (Closes: #1064744, #1054962)
 .
   [ Simon McVittie ]
   * Re-export patch series (no functional changes)
   * New upstream old-stable release 3.2.3
     - Fix a buffer overrun if asked to parse non-UTF-8 headers. It is
       believed that this cannot happen on the client side, but it can
       happen in SoupServer. (CVE-2024-52531, Closes: #1087417)
     - Avoid an infinite loop in WebSocket processing which can cause a denial
       of service via resource exhaustion (CVE-2024-52532, Closes: #1087416)
     - Fix denial of service (crash) when parsing invalid data URLs
       (CVE-2025-32051)
     - Fix heap overflows during content sniffing
       (CVE-2025-32052, libsoup3 equivalent of #1102214)
       (CVE-2025-32053, libsoup3 equivalent of #1102215)
     - Fix an integer overflow during parameter serialization
       (CVE-2025-32050, libsoup3 equivalent of #1102212)
   * Fix a regression introduced in 3.2.3 by backporting its fixes from
     3.6.5:
     - d/p/sniffer-Fix-potential-overflow.patch,
       d/p/sniffer-Add-better-coverage-of-skip_insignificant_space.patch:
       Fix more heap buffer overflows during content sniffing
       (CVE-2025-2784; libsoup3 equivalent of #1102208)
     - d/source/include-binaries: Configure dpkg to accept non-text diffs
       in test data for CVE-2025-2784
   * d/p/server-Add-note-about-recommended-usage.patch:
     Update documentation to indicate the level of security support for
     the server side.
     Upstream clarified the documentation in 3.6.1 to state that SoupServer
     is not intended to be exposed to untrusted clients.
     (Related to CVE-2024-52531, CVE-2024-52532)
   * d/p/tests-Add-test-for-passing-invalid-UTF-8-to-soup_header_p.patch:
     Add test coverage related to CVE-2024-52531
   * Backport additional CVE fixes from upstream release 3.5.2:
     - d/p/headers-Strictly-don-t-allow-NUL-bytes.patch:
       Reject HTTP headers if they contain NUL bytes
       (CVE-2024-52530, libsoup3 equivalent of #1088812)
   * Backport additional CVE fixes from upstream release 3.6.2:
     - d/p/content-sniffer-Handle-sniffing-resource-shorter-than-4-b.patch:
       Fix denial of service when sniffing type of a short resource
       (CVE-2025-32909, libsoup3 equivalent of #1103517)
     - d/p/auth-digest-Handle-missing-realm-in-authenticate-header.patch,
       d/p/auth-digest-Handle-missing-nonce.patch,
       d/p/auth-digest-Fix-leak.patch:
       Fix denial of service (crash) during client-side authentication
       (CVE-2025-32910, libsoup3 equivalent of #1103516)
     - d/p/soup_message_headers_get_content_disposition-Fix-NULL-der.patch,
       d/p/soup_message_headers_get_content_disposition-strdup-trunc.patch:
       Fix memory management of message headers.
       (CVE-2025-32911, CVE-2025-32913; libsoup3 equivalent of #1103515)
     - d/p/soup_header_parse_quality_list-Fix-leak.patch:
       Fix a memory leak (slow denial of service) in quality list parsing
       (CVE-2025-46420, libsoup3 equivalent of #1104055)
   * Backport additional CVE fixes from upstream release 3.6.5:
     - d/p/auth-digest-Handle-missing-nonce-1.patch,
       d/p/digest-auth-Handle-NULL-nonce.patch:
       Fix additional denial of service issues related to CVE-2025-32910
       (CVE-2025-32912, libsoup3 equivalent of #1103516)
     - d/p/headers-Handle-parsing-edge-case.patch,
       d/p/headers-Handle-parsing-only-newlines.patch:
       Fix denial of service (crash) in http server header parsing
       (CVE-2025-32906, libsoup3 equivalent of #1103521)
     - d/p/session-Strip-authentication-credentails-on-cross-origin-.patch:
       Fix credentials disclosure on cross-origin redirect
       (CVE-2025-46421, libsoup3 equivalent of #110405)
   * d/control: libsoup-3.0-tests Depends on ca-certificates
     (Equivalent of #1054962, #1064744 for autopkgtests)
   * d/p/connection-manager-don-t-crash-if-connection-outlives-its.patch:
     Add patch from upstream fixing a use-after-free during disconnection.
     In particular this resolves a hang during gnome-calculator startup,
     when it downloads currency conversion data.
     (Closes: #1077962, #1052551, #1098315, #1099119, #1100509, #1104456,
     #1100541, #1101922, #1102471, #1059773)
   * d/p/connection-auth-don-t-crash-if-connection-outlives-the-au.patch:
     Add patch from upstream fixing another use-after-free during disconnect.
     (Related to #1077962, etc.)
Checksums-Sha1:
 3cd4cbe62114d1591ac7ed133219be3096f5ebee 3362 libsoup3_3.2.3-0+deb12u1.dsc
 104cbce77f3d620c9b6660f03c6c8076a2c99711 1530552 libsoup3_3.2.3.orig.tar.xz
 0ee17a274d37bd4967b3d8941c13c766520a52c5 37636 libsoup3_3.2.3-0+deb12u1.debian.tar.xz
 cdd653b893d75895662f4fdf3c380b53edb10ee7 18435 libsoup3_3.2.3-0+deb12u1_source.buildinfo
Checksums-Sha256:
 f68bd3c65f208bacfc99d54fe24012a9ce0aef217f89ff0e4ae354f5f029852b 3362 libsoup3_3.2.3-0+deb12u1.dsc
 3f50c2a883d7e984e31ecbaa35326b4e6bc6357bd3eed9bb4eb49154ebadd2fd 1530552 libsoup3_3.2.3.orig.tar.xz
 5afa608a041cf3b0f08386f97e9ec6adaa8971598876e03cbd30812a19ab97c8 37636 libsoup3_3.2.3-0+deb12u1.debian.tar.xz
 9a0bd6df19b611dc6b0f17e16406112bcc8d18f5fcd7da57efefa486d22e0f6c 18435 libsoup3_3.2.3-0+deb12u1_source.buildinfo
Files:
 9e780002f7ff4ffbc7098ba3a46e45da 3362 devel optional libsoup3_3.2.3-0+deb12u1.dsc
 c609e3028296f559786fa581c418f4da 1530552 devel optional libsoup3_3.2.3.orig.tar.xz
 a155ad6386cde3560239fddd97e02581 37636 devel optional libsoup3_3.2.3-0+deb12u1.debian.tar.xz
 4f3fec537be1c450b78572bf5ff4fb43 18435 devel optional libsoup3_3.2.3-0+deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmiYbz8ACgkQI1wJnT6z
MHYX5w//TNn1SbM3UK6VL7w3yeKY724RIjlt8pkF4I75kS9ws2gNVxddbpBhG04c
MVMF/C8ZiKWtIl73FUfQe8ywLePM/QEwUe/gqwkXwXTUG8CJLj0NjsVjOZrWtWI5
EZPdhFun6hX5l236IdYtV71jZSVu/LPzXdSH+Ycs0TyuQth1RRpOKPaJoyZSkE8d
pJvrGRGGtGqW6p3gdlhnwgOlnHZ0ei/15fI4xptjlikikMFXXuNVTC86Fdz5yvHH
TJus4XUka0+KV+mh98NrABNAh/Ar4MNCJfmpEceip6eGLqJ2JaegalHuaJkUusKe
POQ9lrR3cvL22gaw/Xw+O79GFwc4mN3wN/NRar5CHuUr83NdbLnkmzuohfAk3PzA
d14lBtJaPOa/Jxkv5HwwuFlG9DfyvtGkXfoU+5pD+alXrj08OzZ1i/P4kVs0hzrA
cEgQcneFJJjaD0JOWps6LlsT2CXWdpDRKN54l0lUeVRXlCXq41FqMuN8+plBYdCN
Pkaj0fxFUat1sBq9llzgreg26Tor1Kec7+ASuYw9iv9HB9JJromYUjc8tVb4Aj8u
xnjpZgFw1X7eR+zI9hruuuZV0ji46hcujkDy+5eqwUxTupvzluLxy2Qz6eICNTlt
FNg/ZJv95cKx19G+Z8yTcpgoNzEn6eiSOhiObzXwGBn5FRCNtRE=
=wM44
-----END PGP SIGNATURE-----
#1059773#68
Date:
2025-08-27 07:02:55 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
libsoup3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1059773@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon McVittie <smcv@debian.org> (supplier of updated libsoup3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 25 Aug 2025 16:06:45 +0100
Source: libsoup3
Architecture: source
Version: 3.2.3-0+deb12u2
Distribution: bookworm
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1052551 1054962 1059773 1064744 1077962 1087416 1087417 1098315 1099119 1100509 1100541 1101922 1102471 1104456
Changes:
 libsoup3 (3.2.3-0+deb12u2) bookworm; urgency=medium
 .
   * Team upload
   * d/p/tests-Gracefully-skip-test-if-a-large-memory-allocation-f.patch:
     Add proposed patch to fix a test failure on some 32-bit machines, in
     particular Debian 12's mipsel buildds
 .
 libsoup3 (3.2.3-0+deb12u1) bookworm; urgency=medium
 .
   * Team upload
 .
   [ Jeremy Bícha ]
   * d/control{,.in}: Add Build-Depends: ca-certificates for build-time tests
     (Closes: #1064744, #1054962)
 .
   [ Simon McVittie ]
   * Re-export patch series (no functional changes)
   * New upstream old-stable release 3.2.3
     - Fix a buffer overrun if asked to parse non-UTF-8 headers. It is
       believed that this cannot happen on the client side, but it can
       happen in SoupServer. (CVE-2024-52531, Closes: #1087417)
     - Avoid an infinite loop in WebSocket processing which can cause a denial
       of service via resource exhaustion (CVE-2024-52532, Closes: #1087416)
     - Fix denial of service (crash) when parsing invalid data URLs
       (CVE-2025-32051)
     - Fix heap overflows during content sniffing
       (CVE-2025-32052, libsoup3 equivalent of #1102214)
       (CVE-2025-32053, libsoup3 equivalent of #1102215)
     - Fix an integer overflow during parameter serialization
       (CVE-2025-32050, libsoup3 equivalent of #1102212)
   * Fix a regression introduced in 3.2.3 by backporting its fixes from
     3.6.5:
     - d/p/sniffer-Fix-potential-overflow.patch,
       d/p/sniffer-Add-better-coverage-of-skip_insignificant_space.patch:
       Fix more heap buffer overflows during content sniffing
       (CVE-2025-2784; libsoup3 equivalent of #1102208)
     - d/source/include-binaries: Configure dpkg to accept non-text diffs
       in test data for CVE-2025-2784
   * d/p/server-Add-note-about-recommended-usage.patch:
     Update documentation to indicate the level of security support for
     the server side.
     Upstream clarified the documentation in 3.6.1 to state that SoupServer
     is not intended to be exposed to untrusted clients.
     (Related to CVE-2024-52531, CVE-2024-52532)
   * d/p/tests-Add-test-for-passing-invalid-UTF-8-to-soup_header_p.patch:
     Add test coverage related to CVE-2024-52531
   * Backport additional CVE fixes from upstream release 3.5.2:
     - d/p/headers-Strictly-don-t-allow-NUL-bytes.patch:
       Reject HTTP headers if they contain NUL bytes
       (CVE-2024-52530, libsoup3 equivalent of #1088812)
   * Backport additional CVE fixes from upstream release 3.6.2:
     - d/p/content-sniffer-Handle-sniffing-resource-shorter-than-4-b.patch:
       Fix denial of service when sniffing type of a short resource
       (CVE-2025-32909, libsoup3 equivalent of #1103517)
     - d/p/auth-digest-Handle-missing-realm-in-authenticate-header.patch,
       d/p/auth-digest-Handle-missing-nonce.patch,
       d/p/auth-digest-Fix-leak.patch:
       Fix denial of service (crash) during client-side authentication
       (CVE-2025-32910, libsoup3 equivalent of #1103516)
     - d/p/soup_message_headers_get_content_disposition-Fix-NULL-der.patch,
       d/p/soup_message_headers_get_content_disposition-strdup-trunc.patch:
       Fix memory management of message headers.
       (CVE-2025-32911, CVE-2025-32913; libsoup3 equivalent of #1103515)
     - d/p/soup_header_parse_quality_list-Fix-leak.patch:
       Fix a memory leak (slow denial of service) in quality list parsing
       (CVE-2025-46420, libsoup3 equivalent of #1104055)
   * Backport additional CVE fixes from upstream release 3.6.5:
     - d/p/auth-digest-Handle-missing-nonce-1.patch,
       d/p/digest-auth-Handle-NULL-nonce.patch:
       Fix additional denial of service issues related to CVE-2025-32910
       (CVE-2025-32912, libsoup3 equivalent of #1103516)
     - d/p/headers-Handle-parsing-edge-case.patch,
       d/p/headers-Handle-parsing-only-newlines.patch:
       Fix denial of service (crash) in http server header parsing
       (CVE-2025-32906, libsoup3 equivalent of #1103521)
     - d/p/session-Strip-authentication-credentails-on-cross-origin-.patch:
       Fix credentials disclosure on cross-origin redirect
       (CVE-2025-46421, libsoup3 equivalent of #110405)
   * d/control: libsoup-3.0-tests Depends on ca-certificates
     (Equivalent of #1054962, #1064744 for autopkgtests)
   * d/p/connection-manager-don-t-crash-if-connection-outlives-its.patch:
     Add patch from upstream fixing a use-after-free during disconnection.
     In particular this resolves a hang during gnome-calculator startup,
     when it downloads currency conversion data.
     (Closes: #1077962, #1052551, #1098315, #1099119, #1100509, #1104456,
     #1100541, #1101922, #1102471, #1059773)
   * d/p/connection-auth-don-t-crash-if-connection-outlives-the-au.patch:
     Add patch from upstream fixing another use-after-free during disconnect.
     (Related to #1077962, etc.)
Checksums-Sha1:
 109f78b0454e2dfb3c04d7580032cf1653adbbc7 3514 libsoup3_3.2.3-0+deb12u2.dsc
 18c39cf2ccdbe8bafae6ea5cb9fcee000ff89f92 38208 libsoup3_3.2.3-0+deb12u2.debian.tar.xz
 12081c772865f927fc2d717eb0b22e03c23aae09 2473716 libsoup3_3.2.3-0+deb12u2.git.tar.xz
 a67dd354b3d5929d371fdb3d37d0804d0efc7fd9 18090 libsoup3_3.2.3-0+deb12u2_source.buildinfo
Checksums-Sha256:
 b00656d3dc925048e575643f7ea701ffc3d1e2ec677372b77255284e0b810be6 3514 libsoup3_3.2.3-0+deb12u2.dsc
 34a04a865a644a16d635f55454ba06d52329806de943a95ed245384e6ea077b6 38208 libsoup3_3.2.3-0+deb12u2.debian.tar.xz
 9337618beea532c5699338dab705633fad05b05f761381c3d467ba0ed9c29791 2473716 libsoup3_3.2.3-0+deb12u2.git.tar.xz
 dcb95818cb589d1d9f81f49c5d5e6a16ab48560674c47eaf457b4c995b4a7409 18090 libsoup3_3.2.3-0+deb12u2_source.buildinfo
Files:
 ecaa011c29a9237de552df9ec26cd29f 3514 devel optional libsoup3_3.2.3-0+deb12u2.dsc
 ebaf706e41784c7ecdac04475eaa8674 38208 devel optional libsoup3_3.2.3-0+deb12u2.debian.tar.xz
 d2c73254c8d2288371d330a92fccb046 2473716 None None libsoup3_3.2.3-0+deb12u2.git.tar.xz
 861f8b3a357d3ca2ddd458456d12edd9 18090 devel optional libsoup3_3.2.3-0+deb12u2_source.buildinfo
Git-Tag-Info: tag=fa847d591345c7074c0ccb2bad8f16dcde18d15a fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <smcv@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmishYoACgkQYG0ITkaD
wHkCwQ/+Pe4XP/B5bvd/zePkpk49GSx3We7W7xpgJuDentebHISJObL9HlU0b4ey
gPtnBfVmIFW9Jg2AzgrHqWd9fBd7HvbIhYZAu7Wr4KXYKvnNl7lJFdmRbAuJjwS+
GRCjh77nZZFy7bhFqxH+twPt4BI5dIJTdUs5tGA3iSFGshd3xpgZe01ABOhgbFCK
Lb3yqduCWEYQ1BeOhHYb+ZWNi8XNU5VAgEPhVYL8yVpzbGVR5G9IowyQ932U26Zb
yw37MYH5hPSLSjuFBttqYenS1krtwOnfW+EKRnLeF7uEBNKWWn3KEchtmgDBPUDi
unGZx5MqzYIVmpxvfCBYqxJ3n1oByBmZKRdsXQxUYUANuXTQ290Ean9cvbSY7M2l
Jq2JaRbDe/61wLWzmFzyXp1bBOT28TeWwBIABsj/xcd/UyRyI2gIDI8dnyqNlEd/
oRfwg0s0i8menc9Kq2X1rOqO1VllhxOb8aOWVpM4zPyX4GqA7nLfoNeEVp3z+Yxw
DOnt6kr/VTAH0UlbiVfrQPJVMokM1H3c1ymnnP0KZKV0gAA51Dzd66Wh7Vmp9JQi
rDiqqWiMTrvyGjF0d1/PzmD9TRneTlBVjAaWMqxu9wHVooarzyjvqrsgKu1kGIW7
jM6vOCyVS3yjAeys9ieKQZ2VXiG2F0AjyTF0H2yLkAvtPDC/FXw=
=r12K
-----END PGP SIGNATURE-----