On Fri, Oct 09, 2026 at 09:31:22AM +0200, Emilio Pozuelo Monfort wrote: > On 08/10/2026 22:00, Roberto C. Sánchez wrote: > > Hello Release Team, > > > > On Thu, Oct 08, 2026 at 04:21:01PM +0530, Jeevan Chalke wrote: > > > Package: src:mongo-c-driver > > > Version: 1.30.4-1+deb13u3 > > > Severity: grave > > > Tags: security patch > > > X-Debbugs-Cc: [1][email protected] > > > > > > Dear Maintainer, > > > > > > debian/patches/0009_CVE-2026-81524.patch (the backport of upstream > > > CDRIVER-6424, "validate db and collection names") breaks > > > mongoc_collection_aggregate() for every collection. It always > > > returns a > > > cursor in the error state: > > > > > I am already in the process of preparing a 1.30.4-1+deb13u4 version of > > mongo-c-driver to target the next point release. However, this bug > > report appears to be of somewhat higher urgency. Should I upload a > > 1.30.4-1+deb13u4 containing only the fix for #1150302 for immediate > > upload with the intent of a SUA to get the fix landed more quickly? I > > would then defer the other fixes I am working on to 1.30.4-1+deb13u5. > > > > Thanks in advance for your guidance. > > It's your call, but that sounds reasonable. > Thanks. I have enough issues queued up that I would rather get this fix out ASAP, as it the change is trivial and the problem has the potential to impact many users.
I will make an upload today. Do I understand correctly that I simply need to upload targeting 'trixie' then file a bug against release.debian.org with a debdiff requesting the upload be accepted (as for a normal SPU upload)? Is anything else required on my part for the SUA? Regards, -Roberto -- Roberto C. Sánchez
