On Mon, 2 Nov 2026, Agustin Martin wrote:
El vie, 30 oct 2026 a las 21:13, Kevin Atkinson (<[email protected]>) escribió:
On Fri, 30 Oct 2026, Agustin Martin wrote:
I would prefer if you just update stable to 0.60.8.3. The changes between
0.60.8.0, .1, .2, and .3, were kept very minimal (I even used the exact same
verson of autotools). No new features were added, and the bug fixes beyond
security are very minimal and won't break anything.
Also even though the commits that mentioned the CVE did in fact fix them,
please note the following:
0b52f16f997958a7d973cbda15f106114a2b3749 is a followup fix for CVE-2026-103658.
I belive the exact fix might still lead to a crash.
The fix for CVE-2026-75819 left open a similar vulnability,
7f9bda27d68b34c2abfbf82ad7bdbab45c1fb903 fixes that.
Also, the memory issues I mentioned are likely just as serious as the three
CVE with low severity. It is just that no CVE were created.
Hi, Kevin,
Uploads to stable need release manager approval, they are not
something I can do directly. Policy for that is that they must contain
the very minimal set of important changes that justify the upload. No
full releases are allowed in the general case. In this case, stable
contains 0.60.8.1, so it would not be just changes from 0.60.8.2 to
0.60.8.3. I will try to get blessings for all relevant changes in
0.60.8.3, but applied to 0.60.8.1 (will use some of your rationale
above if you do not mind). See section 5.5.1 in
https://www.debian.org/doc/manuals/developers-reference/pkgs.html
about what is expected to go into stable.
Feel free to use my wording elsewhere, either in the Debian changelog or to
you emails to the release manager.
If you try and incorporate all the changes in between 0.60.8.2 to 0.60.8.3 you
are creating a lot of extra work for yourself. The changes between these
point releases are kept very minimal on purpose. In fact I made the release
on a really old system so that the exact same version of autotools is used. I
then manually reviewed the diff between the actual release content to make sure
nothing unexpected snuck in.
Also, in case you did not realize it, each release is tagged in the git repo,
but the tags are not part of any branch. You can use something like
'rel-0.60.8.1...rel-0.60.8.2' and 'rel-0.60.8.2...rel-0.60.8.3' to review the
changes.
Kevin
