Hi.

Apparently the package used to contain the conffiles:
/etc/bash_completion.d/fail2ban
/etc/fail2ban/action.d/nftables-common.conf
/etc/fail2ban/filter.d/sshd-ddos.conf
/etc/fail2ban/filter.d/sshd-aggressive.conf
/etc/fail2ban/filter.d/postfix-sasl.conf
/etc/fail2ban/filter.d/postfix-rbl.conf
but no longer does so.

Please properly clean them up using dpkg-maintscript-helper(1).
(AFAIU, the version that needs to be specified for that is NOT
the version where the conffile was dropped, but rather "the
latest version of the package whose upgrade should trigger
the operation"

Quoting the manpage:
           For example, for a conffile removed in version 2.0-1 of a package,
           prior-version should be set to 2.0-1~. This will cause the conffile
           to be removed even if the user rebuilt the previous version 1.0-1
           as 1.0-1local1. Or a package switching a path from a symlink
           (shipped in version 1.0-1) to a directory (shipped in version
           2.0-1), but only performing the actual switch in the maintainer
           scripts in version 3.0-1, should set prior-version to 3.0-1~.


Cheers,
Chris.

Hey.

Unfortunately the previous leftover conffiles haven't been cleaned up
in the meantime.


And even more conffiles need to be added to that list, namely
$ dpkg-query --showformat='${Package}\n${Conffiles}\n' --show  |  awk '/^[^ ]/{pkg=$1}/ obsolete$/{print pkg,$0}' | cut -d ' ' -f 1-3 | column -t
fail2ban                /etc/fail2ban/action.d/iptables-common.conf
fail2ban                /etc/fail2ban/action.d/badips.py
fail2ban                /etc/fail2ban/action.d/badips.conf


which all three were left over when upgrading from bullseye to
bookworm.


Cheers,
Chris.