El vie, 30 oct 2026 a las 21:13, Kevin Atkinson (<[email protected]>) escribió: > On Fri, 30 Oct 2026, Agustin Martin wrote: > > > > Thanks for the reminder. I will wait until current package in sid > > reaches testing. It contains exactly the differences (vulnerability > > fixes) I want to propose for stable-upates, and I want to have that > > minimal set of changes tested outside my box before uploading new > > aspell version. I expect to have a Debian package with new aspell > > version prepared and uploaded around beginning of next week. > > I would prefer if you just update stable to 0.60.8.3. The changes between > 0.60.8.0, .1, .2, and .3, were kept very minimal (I even used the exact same > verson of autotools). No new features were added, and the bug fixes beyond > security are very minimal and won't break anything. > > Also even though the commits that mentioned the CVE did in fact fix them, > please note the following: > > 0b52f16f997958a7d973cbda15f106114a2b3749 is a followup fix for > CVE-2026-103658. > I belive the exact fix might still lead to a crash. > > The fix for CVE-2026-75819 left open a similar vulnability, > 7f9bda27d68b34c2abfbf82ad7bdbab45c1fb903 fixes that. > > Also, the memory issues I mentioned are likely just as serious as the three > CVE with low severity. It is just that no CVE were created.
Hi, Kevin, Uploads to stable need release manager approval, they are not something I can do directly. Policy for that is that they must contain the very minimal set of important changes that justify the upload. No full releases are allowed in the general case. In this case, stable contains 0.60.8.1, so it would not be just changes from 0.60.8.2 to 0.60.8.3. I will try to get blessings for all relevant changes in 0.60.8.3, but applied to 0.60.8.1 (will use some of your rationale above if you do not mind). See section 5.5.1 in https://www.debian.org/doc/manuals/developers-reference/pkgs.html about what is expected to go into stable. Regards, -- Agustin
