On 24/09/2026 16:52, Thomas Goirand wrote:
On 9/11/26 2:02 PM, Salvatore Bonaccorso wrote:
On Fri, Sep 04, 2026 at 12:20:23PM +0100, Adam D. Barratt wrote:
Control: tags -1 + confirmed
On Sun, 2026-08-16 at 20:59 +0200, Thomas Goirand wrote:
I'd like to update Nova to address CVE-2026-46448 / OSSA-2026-022
and OSSN-0101 (see bugs #1140149 and #1142113).
Please go ahead.
AFAICS this needs now to be rebased on the most current version in
trixie, and the version bumped to 2:31.0.0-6+deb13u3.
Regards,
Salvatore
Hi Salvatore,
I believe that's not correct and that the next version of Nova in Trixie
should be 2:31.0.0-6+deb13u2, which I just uploaded. Let me know if I'm
wrong.
That's wrong. trixie already has deb13u2, which was copied from trixie-security
during the last point release from [1].
So your update should be versioned deb13u3, and should include the changes in
that trixie-security upload to not lose them.
In fact, according to rmadison, there's already a deb13u3 in stable-new, not
sure who uploaded that or what changes it contains.
nova | 2:31.0.0-6+deb13u2 | stable | source
nova | 2:31.0.0-6+deb13u3 | stable-new | source
Cheers,
Emilio
[1] https://lists.debian.org/debian-security-announce/2026/msg00054.html
