Package: libdance2-plugin-passphrase-perl
Version: 3.4.1-1
Severity: important
Control: forwarded -1 https://github.com/PerlDancer/Dancer2-Plugin-Passphrase/issues/7

Dear Maintainer,

In the light of #1143264 about CVE-2026-18536 affecting
libdata-entropy-perl, I ponder on the option suggested by
Salvatore of removing the package from the archive for the
upcoming forky.

libdance2-plugin-passphrase-perl still depends on the ability of
using Data::Entropy, including upstream, but there seem to be
interest in migrating away to something else already, given
Github issue #7[1] upstream.  The reporter of the issue upstream
suggest migrating to one of:

  * Crypt::URandom,
  * Crypt::SysRandom, or
  * Crypt::PRNG at worse.

[1]: https://github.com/PerlDancer/Dancer2-Plugin-Passphrase/issues/7

I'm not sure of the upstream activity level these days and I
haven't pondered on a patch, at least not yet, but that might
give ideas to someone more comfortable with cryptography and
perl than I am.

In hope this helps,