[ Reason ]
swupdate in trixie has the mongoose webserver embedded in version 7.14.
This is prone to ten CVEs as documented for the mongoose source package.
[ Impact ]
The configuration in swupdate might not be affected by all of them but
it is much less work to update the embedded mongoose version than
verifying every one of them.
[ Tests ]
I have run the embedded webserver in the swupdate binary and have run one
update.
[ Risks ]
This might introduce subtle issues because mongoose might have changed
configuration symbols. I have checked the swupdate history and it seems
that all of the substantial changes regarding mongoose use are already
included in trixie's version (as opposed to bookworm's, which would need
changes in swupdate's own files).
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
[ Changes ]
Update the included mongoose version to 7.21.
In unstable this was handled by building with the new mongoose package.
[ Other info ]
swupdate is not yet marked as affected by the CVEs referenced by the
debdiff. I am going to change the embedded package list so that the
swupdate security tracker might pick them up.