On 9/24/26 5:36 PM, Emilio Pozuelo Monfort wrote:
On 24/09/2026 16:52, Thomas Goirand wrote:
On 9/11/26 2:02 PM, Salvatore Bonaccorso wrote:
On Fri, Sep 04, 2026 at 12:20:23PM +0100, Adam D. Barratt wrote:
Control: tags -1 + confirmed
On Sun, 2026-08-16 at 20:59 +0200, Thomas Goirand wrote:
I'd like to update Nova to address CVE-2026-46448 / OSSA-2026-022
and OSSN-0101 (see bugs #1140149 and #1142113).
Please go ahead.
AFAICS this needs now to be rebased on the most current version in
trixie, and the version bumped to 2:31.0.0-6+deb13u3.
Regards,
Salvatore
Hi Salvatore,
I believe that's not correct and that the next version of Nova in Trixie
should be 2:31.0.0-6+deb13u2, which I just uploaded. Let me know if I'm
wrong.
That's wrong. trixie already has deb13u2, which was copied from trixie-
security during the last point release from [1].
So your update should be versioned deb13u3, and should include the
changes in that trixie-security upload to not lose them.
In fact, according to rmadison, there's already a deb13u3 in stable-new,
not sure who uploaded that or what changes it contains.
nova | 2:31.0.0-6+deb13u2 | stable | source
nova | 2:31.0.0-6+deb13u3 | stable-new | source
Cheers,
Emilio
[1] https://lists.debian.org/debian-security-announce/2026/msg00054.html
Hi Emilio,
Not sure how I got so confused in my messages, though I believe my
actions were right. I uploaded 2:31.0.0-6+deb13u3, which is still in
"stable-new" and needs to be approved to fix CVE-2026-46448 and
OSSN-0101. Please approve it.
Cheers,
Thomas Goirand (zigo)
