Hi, Upstream released cpp-httplib 0.64.0 on 2026-10-29. Unstable and forky still have 0.41.0+ds-3. Please consider packaging 0.64.0.
Security: the security tracker lists these CVEs as open for 0.41.0 in sid. Upstream fixed all of them in 0.51.0 or earlier: - CVE-2026-45352 (#1138578), fixed in 0.43.4 - CVE-2026-45372, CVE-2026-46527 (#1138578), fixed in 0.44.0 - CVE-2026-77341 (#1145976), fixed in 0.50.0 - CVE-2026-77358 (#1145977), fixed in 0.50.1 - CVE-2026-102944 (#1151204), fixed in 0.51.0 - CVE-2026-103930 (#1151203), fixed in 0.51.0 Reverse dependency: the Lemonade server (lemonade-server) embeds the Lemonade Nexus SDK, which needs cpp-httplib 0.61.0 or later for the WebSocket client and the TLS context API. With 0.41.0 the SDK does not build, so our Debian packaging must bundle a private copy of cpp-httplib. We want to build against the system package instead. I have not checked whether 0.64.0 also fixes #1138434 (FTBFS with OpenSSL 4.0) or #1142341 (FTBFS on hurd-amd64). Thank you for maintaining cpp-httplib. Regards, Geramy Loveless
