Hi Federico On 23/10/26 03:06, Federico Molara wrote:
Hi Aryan, hi Python Team,Thank you, Aryan, for reviewing and merging MR !2 and uploading pymongo 4.19.0-1. Its official Salsa CI has passed, and the Security Tracker now records CVE-2026-106435 as fixed in sid. I would now like to arrange review of the first focused trixie update. I have prepared a local 4.10.1-6+deb13u1 candidate, still UNRELEASED, containing only the upstream fix for CVE-2026-106435 / #1150462. The trixie build passes: 806 passed, 3703 skipped and 788 deselected. In the separate BSON suite, the upstream regression fails on the baseline and passes on the candidate (84 passed, one pre-existing skip). Runtime checks confirmed both C extensions were in use and their hashes matched the built packages. The release's generated autopkgtest passes as a superficial import test; BSON/C coverage was checked separately. Source and binary debdiffs and test logs are ready. The Security Tracker marks this issue no-dsa for trixie. From Developer's Reference section 5.5.1, I understand that the formal route is a release.debian.org trixie-pu request with the source debdiff and test results, following review and coordination of the upload. To organise that review, could you help with these points? - Are there existing Security Team or Stable Release Team discussions, contacts or plans for trixie that I should follow, including any plans for the other outstanding pymongo CVEs? - Where would you prefer the first stable branch/debdiff to be presented for review, and with whom should I coordinate the subsequent upload? - For bookworm, do you have a reference to an LTS discussion or a confirmed assignment? Otherwise, I would ask on debian-lts before starting work for that release.
It's recommended to get in touch with the security team at [email protected] when it comes to fixing bugs in stable and oldstable. I reached out to them in the past and they told me to have a look at this manual page: https://www.debian.org/doc/manuals/developers-reference/pkgs.en.html#special-case-uploads-to-the-stable-and-oldstable-distributions.
The security team might give an advice in this situation. Unfortunately, I'm not a DD yet so I cannot make any uploads for these CVEs to stable and oldstable.
I have not yet filed a trixie-pu request or published the stable branch. The current candidate is limited to #1150462; the remaining stable fixes will need separate preparation and review. https://bugs.debian.org/1150462 https://security-tracker.debian.org/tracker/CVE-2026-106435 https://salsa.debian.org/python-team/packages/pymongo/-/pipelines/1195993 https://www.debian.org/doc/manuals/developers-reference/pkgs.en.html#special-case-uploads-to-the-stable-and-oldstable-distributions Best regards, Federico Molara
-- Regards, Aryan Karamtoth, Debian Maintainer "Sic Parvis Magna" - Sir Francis Drake IRC: spaciouskarter78 Matrix: @spaciouskarter78:matrix.debian.social GPG Fingerprint: 7A7D 9308 2BD1 9BAF A83B 7E34 FE90 07B8 ED64 0421
OpenPGP_0xFE9007B8ED640421.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
