Dear maintainer(s),

I was recently notified that Cyrus upstream has released version 3.10.3. Based on the changelog [1], the new release addresses a handfull of CVEs. Would it be possible to cut a new 3.10.3 release to bring Trixie in line with the upstream ?

Is this update viable, or should users be looking at the 3.12.X release instead ?

[1] https://www.cyrusimap.org/3.10/imap/download/release-notes/3.10/x/3.10.3.html

Thank you,
--
Codin

Usually, the release team rejects such requests. You should isolate the
CVE fixes as patches and add them as quilt patches to the 3.10.2-1
version resulting in a 3.10.2-1+deb13u1 trixie proposed update request.
You can see example in the https://bugs.debian.org/release.debian.org
bug tracker. If you want other bugfixes than security fixes, they should
have an important bug report associated.

Upstream also added/changed the test suite to accommodate or test for
the fixed bugs. See [link to github]. Should those be included in a PU?

@Codin: Are you interested in submitting a PU? If not, then I'm willing
to have a poke at it.

Kind regards,

     Edmund


[link to github]:
https://github.com/cyrusimap/cyrus-imapd/compare/cyrus-imapd-3.10.2...cyrus-imapd-3.10.3

I'd be happy to take a stab at it, however, I'm new to the Debian release workflow process and it will take me a while to get things organized. If you have pointers to where I should start, that would be much appreciated.

Thank you !

(FTR: I managed to compile v3.10.3 locally in Triexie and deployed it on my environment, however, I'd be happy to contribute the build/patches upstream).

The stable update request is filed as #1142925.