Hi,

I'd like to upgrade Mistral to 20.0.0-2+deb13u2 in trixie.

[ Reason ]
Curren version is affected by these CVEs:
CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147

[ Impact ]
As per upstream announce here:
https://security.openstack.org/ossa/OSSA-2026-044.html

this is "four authorization and privilege vulnerabilities in Mistral"
that I would like to fix.

[ Tests ]
Unit tests are run at package build time AND in autopkgtest, plus the
upstream CI has functional tests. My own (package based) CI installs and
run Mistral too.

[ Risks ]
Not much considering the amount of testing.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
4 upstream patches.

Note that I have already uploaded the package. Please approve my upload.

Cheers,

Thomas Goirand (zigo)

Hi Thomas,

CVE-2026-93860 is mentioned here, but it's not in the diff?

Cheers,
        Moritz