On Fri, Oct 16, 2026 at 08:01:26AM -0500, Simon Quigley wrote: > > [0] > > https://salsa.debian.org/debian/jq/-/blob/debian/trixie/debian/patches/CVE-2026-47770.patch?ref_type=heads > > The guard I mean isn't in Trixie's CVE-2026-47770.patch, which is a straight > upstream cherry-pick like you say. It's in Aron's > fix-invalid-jv-propagation.patch, the one that makes jv_delpaths() return the > invalid jv instead of aborting. Trixie already shipped that in > 1.7.1-6+deb13u3 (DSA-6416-1), so Bookworm would be following Trixie here, not > diverging.
So the patch is [0]. If upstream also has this problem, and this patch can solve the problem, we shall provide the patch to upstream. [0] https://salsa.debian.org/debian/jq/-/blob/debian/trixie/debian/patches/fix-invalid-jv-propagation.patch > > > trixie diverting isn't a sufficient reason to align all other dists IMHO, > > > maybe it's an error in trixie, maybe it isn't, let's hear from the > > > maintainer -- who is fortunately already in Cc:. > > > > > > @czchen, what do you think? Is this original fix a high regression or > > > security issue that's worth fixing from unstable down? > > > > I thin the fix shall be in upstream -> unstable -> stable/oldstable > > order in general. > > Would you want to get this guard into upstream and then unstable? Would you > like my help? Yes if appropriate. > In the meantime I'll keep the other fixes as a new DLA. Would you rather I > drop this extra patch for Bookworm in the meantime? I think you can prepare the build without this patch first, and we will figure out how to handle this patch in the meantime. -- ChangZhuo Chen (陳昌倬) callsign: BU2HG email: [email protected] fingerprint = BA04 346D C2E1 FE63 C790 8793 CC65 B0CD EC27 5D5B
signature.asc
Description: PGP signature
