Hi,

I’d like to fix five security issues that are not worth a DSA in the
next point release (four are marked as no-dsa, the fifth one has no CVE
assigned).

[ Tests ]
The test suite has been updated with the code change.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

Thanks in advance for considering.

Regards,

taffit

Hi David,

The fifth one (GHSA-rvx4-ffvw-m9q3), now has as well a CVE, it is
CVE-2026-84361.

Regards,
Salvatore

Control: tags -1 + confirmed
[...]

Please go ahead.

Regards,

Adam

Here's an updated version of taffit's patch, which adds mention of CVE-2026-84361 via Salvatore's comment above.  I've also attached a diff between those 2 patches.

Steve

If you want to make updates to people's proposals, please involve them
in that process.

In any case, it looks like David included the CVE ID in his upload, so
there's no change required.

Regards,

Adam

Hi,

Le Sat, Oct 10, 2026 at 05:33:44PM +0100, Adam D. Barratt a écrit :
[…]

Indeed, I “silently” updated the changelog before the upload thanks to
Salavatore input, but failed to mention it on the bug report. Sorry for
the lack of communication (I usually try to keep those p-u request as
short as possible since the team has a fair amount of issues to deal
with).

Regards,

taffit