Hi, Andreas, hi team, El 01/10/26 a las 02:57, Andreas Henriksson escribió: [snip] > ## gawk > > Did some initial work to backport patches for the outstanding CVEs > as requested in dla-needed.txt for both unstable/testing and bullseye, but > since unstable/testing/... was also unfixed discussion proceeded in > [bts#1142071] and stalled.
[snip] As of today, gawk has four CVE open: CVE-2026-40467, CVE-2026-40468, CVE-2026-40469 and CVE-2026-40553. They have been marked as <no-dsa> by the sec team for trixie, and none of them as a severity >= high. As a first comment, I wonder if gawk should be listed in dla-needed.txt. That was a Front Desk decision, but I think we can defer a bookworm update, marking the CVEs as <no-dsa> (postponed), and removing gawk from the work queue. There are packages with more important CVEs that are needing our attention. Andreas, if you agree, would you mind applying the changes please? Otherwise, please, let me know. Second, regarding the unstable NMU, while I value that we can contribute to more recent releases, given the severity of the gawk issues, I think it is important to give maintainer(s) time to prepare the update. Especially when the maintainers are active Debian contributors. Actually, in our context, unstable NMUs should be exceptional, and for very severe cases. As a general comment, my suggestion is also to contact the maintainers first before preparing a stable point update. That also helps to avoid double work in case they are already preparing the update. TTBOMK, contrary to *la-needed.txt, there is no general method to know when somebody is working on an unstable update or stable pu. Does the above make sense? Cheers, -- Santiago
signature.asc
Description: PGP signature
