Hi Santiago, On Thu, Nov 05, 2026 at 11:19:21PM -0300, Santiago Ruano Rincón wrote: > Hi, > > Sorry for reacting on this long-standing bug only now... > > El 08/06/26 a las 21:14, Moritz Mühlenhoff escribió: > > On Mon, Jun 08, 2026 at 09:11:00PM +0200, Chris Hofstaedtler wrote: > > > Hi, > > > > > > I'm not against marking ply unsupported, but I must say the CVE is > > > very questionable. > > > > It's marked as bogus in the security tracker. I don't think we should > > start declaring random packages which are dead upstream as unsupported, > > that won't scale and is also not the right course of action. We have > > 100s of other packages which no longer have an active upstream and > > if there's ever a genuine security issue for ply we can look into > > fixes ourselves. > > If you don't mind, I have a question about the last sentence. Please, > correct me if I'm wrong, but I remember from other discussion (maybe > about the old freeimage) that we only consider fixes that are sanctioned > by upstream. My understanding is that upstream is the only one with an > authoritative position to state that a patch fixes a give vulnerability. > Is that understanding inaccurate?
In the most ideal case we always want a upstream sanctioned patch; sometimes it is still important to address an issue in stable for a dead upstream project, someone developed a patch and we are confident it is the aboslute right fix, then we can pick this change. Regards, Salvatore
