Here is my public monthly report.
Thanks to our sponsors for making this possible, and to Freexian for
handling the offering.
https://www.freexian.com/lts/debian/#sponsors
LTS
- Front Desk (week 38 2026)
- High activity, with accumulated backlog from previous FDs
- Mark 25 packages for update, dropped none
- Triage or precise bookworm triage for ~250 CVEs
- Tidy work queue and team package information for 5 packages
- Issue/sponsor DLAs
- Announce DLA-4734-1 for lemonldap-ng
https://lists.debian.org/debian-lts-announce/2026/09/msg00000.html
https://lists.debian.org/debian-lts/2026/09/msg00006.html
- Announce DLA-4783-1 for xz-utils
https://lists.debian.org/debian-lts-announce/2026/09/msg00018.html
(and reference xz-utils in our 'lts-do-call-me' file)
ELTS
- Front Desk (week 38 2026)
- High activity, with accumulated backlog from previous FDs
- Mark 26 packages for update, dropped none
- Triage or precise triage for ~100 CVEs
- Experimental CVE severity/urgency import and assessment (see also
tooling below)
- Review history of newly supported packages, including backlog
(4 issues)
- Associate CVEs from newer, branched Debian packages with different
names to older ELTS packages (golang*, libbson*, mariadb*, netty*,
openssl*, postgresql*, python*, ruby*, sqlite*, tomcat*, unbound*,
vtk*, wxwidgets*)
- Tidy work queue and team package information for 7 packages
- Clean-up obsolete ELTS entries
Common documentation and tooling
- Tooling
- lts-follow-low-no-dsa: new script, prepare mass-triage for
low-priority packages with low-priority CVEs
- PGP-based mailing-list approval: locate userdir_gpg.py, part of
the DLA signature check, needed for a compatibility fix
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050915#23
- ELTS tooling
- data/packages/renamed-packages*: adjust stable/lts/elts packages
tracking from trixie to bullseye
- gen-DSA: tidy and document semi-unused template (doc/ELA.template)
- package-operations: fix LTS output when adding packages for a
single release
- elts-trim-unimportant: fix --help
- elts-retrieve-cve-severities
- track supported CVEs/packages in ELTS data
- drop obsolete data + allow removal in local Git hook
- optimize (don't modify CVE/list)
- update script copyright
- cve-ad
- avoid creating incorrect files e.g. due to typos
- validate before saving to disk (not after)
- default print action to ease scripting
- support explicitly (re)setting "tdb" (to-be-determined) value
- Re-routing ELTS tracker notifications
- Public documentation
- Development: ensure casual contributors don't confuse LTS and
Security teams
https://lts-team.pages.debian.net/wiki/Development.html
- Update bullseye LTS reference to ELTS
(many pages)
- Debian Wiki: update and link LTS Announcement page
https://wiki.debian.org/LTS/Announcement
- July/August recap
https://lists.debian.org/debian-lts/2026/09/msg00018.html
- Private documentation
- cve-additional-data: document "tbd" (to-be-determined) value
- Private documentation recap
- Guide casual LTS contributors
- Cyrus IMAP
https://salsa.debian.org/debian/cyrus-imapd/-/merge_requests/27#note_800973
https://lists.debian.org/debian-lts-announce/2026/09/msg00001.html
- Xen
https://lists.debian.org/debian-lts/2026/09/msg00073.html
- Tryton
https://lists.debian.org/debian-lts/2026/09/msg00071.html
- Crash
https://lists.debian.org/debian-lts/2026/09/msg00072.html
- User help
- Re: Revisiting the way we maintain LTS, and unifying it with stable-security
https://lists.debian.org/debian-lts/2026/09/msg00014.html
- Re: New contributor
https://lists.debian.org/debian-lts/2026/09/msg00068.html
- Bullseye Security Updates not available on archive.debian.org and broken on
security.debian.org
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147093
- Team
- New urgency/severity assessment
- Discussion on lists and GitLab issues
- One-off Jitsi meeting
- Reports from front-desk experiment
- Many topics on private mailing list
- Minimize spending time triaging CVEs unlikely to get fixed
- Usefulness of Salsa CI pipeline for LTS/ELTS (vs. debusine)
- Weekly stand-up meetings proposal
- deb.freexian.com becoming access-restricted
- Team meeting (IRC)
https://meetbot.debian.net/debian-lts/2026/debian-lts.2026-09-24-14.01.html
--
Sylvain Beucler
Debian LTS Team
