On Tue, Oct 6, 2026 at 2:16 PM Santiago Vila <[email protected]> wrote: > > On Tue, Oct 06, 2026 at 01:43:13PM +0200, Santiago Vila wrote: > > On Mon, Oct 05, 2026 at 10:15:25AM +0200, Andrew Lee (李健秋) wrote: > > > You may also simply update this golang-github-google-cel-go package to > > > newer upstream version (>= v0.29.0) which included this fix. > > > > Hmm, I see that there was a team upload just a few days ago. > > > > Arthur: While we are at it, would you be willing to upgrade the > > package to >= 0.29.0 in unstable, while I still keep looking at how to > > backport the fix to trixie? > > Ok, the patch applies cleanly in unstable, I'm going to make a team upload > first to fix the CVE in unstable. > > (After that, anybody feel free to upgrade the package, I'm usually > hesitant to do that because I prefer to work on the rearguard).
You may also make an update in another branch and then run salsa-ci test with reverse dependency rebuilds. If there is nothing broken, it's safe to upload the new version instead. It's probably less work than apply the patch. :) Best regards, -- -Andrew
