On Tue, Sep 15, 2026 at 01:29:47AM +0200, Santiago Vila wrote: > If the patch applied cleanly to the trixie version (which I have not checked > yet), > we could either ask the SRM to cancel 0.18.2+ds-5+deb13u1, or maybe > just make another release on top of that versioned +deb13u2.
I confirm that the patch does *not* apply cleanly. Took it from this URL: https://github.com/cel-expr/cel-go/commit/2814acd9e1edc48811cbd88c6f60432638334e5a.patch and this is how it goes on top of a tree with debian/patches already applied: $ cat ../CVE-2026-83530.patch | patch -p1 patching file cel/cel_test.go Hunk #1 succeeded at 20 with fuzz 2 (offset -2 lines). Hunk #2 succeeded at 2873 (offset -1036 lines). patching file cel/env.go Hunk #1 succeeded at 254 (offset -182 lines). Hunk #2 succeeded at 272 (offset -182 lines). Hunk #3 succeeded at 444 (offset -219 lines). patching file common/runes/buffer.go Hunk #2 FAILED at 114. Hunk #3 FAILED at 196. Hunk #4 FAILED at 223. Hunk #5 FAILED at 239. 4 out of 5 hunks FAILED -- saving rejects to file common/runes/buffer.go.rej patching file common/runes/buffer_test.go patching file common/source.go Hunk #1 succeeded at 77 (offset 3 lines). Hunk #2 succeeded at 100 (offset 9 lines). patching file common/source_test.go Somebody who know golang better than me would have to look at this. Thanks.
