Hi, On Mon, 19 Oct 2026 at 16:22:07 +0200, Guilhem Moulin wrote: > Roundcube webmail upstream has just released 1.6.20 [0] which fixes a > new batch of security vulnerabilities:
As for the previous uploads, I suggest to follow 1.6.x (upstream's current LTS release) for trixie-security. The upstream diff [0] is targeted anyway. Several of the issues, in particular the SSRF, XSS and remote-content blocker bypass, have test coverage. Tested debdiff attached. Debusine result: https://debusine.debian.net/debian/developers/work-request/1508582/ Cheers, -- Guilhem. [0] https://github.com/roundcube/roundcubemail/compare/1.6.19...1.6.20
signature.asc
Description: PGP signature
