-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Thu, 29 Oct 2026 18:18:24 +0100 Hefee <[email protected]> wrote: > Package: release.debian.org > Severity: normal > Tags: trixie > X-Debbugs-Cc: [email protected], Paulo Henrique de > Lima Santana <[email protected]>, [email protected] Control: affects -1 > + src:flask-socketio User: [email protected] > Usertags: pu > > [ Reason ] > Fixing CVE-2026-27205 within flask changed the API and broke > flask-socketio. The outcome was that onionshare chat cannot be used > anymore on Trixie (#1136892). > The API change in flask is known with 3.1.3 and flask-socketio 5.6.1 > already adopted the API change (#1132356), that got uploaded to > unstable. > > [ Impact ] > Every application used to write RequestContext.session is broken > and cannot be used anymore. One application is onionshare, the chat > mode. > > [ Tests ] > flask-socketio own testsuite discovered this breakage [1] and debusine > [2] shows that the testsuite is fixed with the current packported > patch. Built myself and tested locally. > > [1] https://lists.debian.org/debian-lts/2026/07/msg00080.html > [2] > https://debusine.debian.net/debian/developers/work-request/1558905/ > > [ Risks ] > The source of this patch is from upstream, that is stripped down to a > minimal change that fixes that adopt the API change done by fixing > CVE-2026-27205. > As the patch itself does not change the API of flask-socketio, I > expect that the risk of this fix is very minimal. Especially it uses > duck-typing, so it should adopt the corret API of flask in either way. > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable > > [ Changes ] > * Added part of upstream patch to adopt new flask API. > * Update gbp.conf debian-branch to debian/trixie. > > [ Other info ] > Myself is not the Mantainer of flask-socketio. I asked phls if I > should/can do the pu. > > phls answered me on 2026-10-28 by email: > > > I've never done a pu :-) > > So, If you can do it, go ahead. I will follow to learn how to do it. > > I hope this is enough evidence, that I work together with the > mantainer of flask-socketio. > > I didn't upload as I don't know if I should remark it somehow, that > I'm not the mantainer.
Thank you hefee! Let me know If I can help with anynthing. best regards, - -- Paulo Henrique de Lima Santana (phls) Belo Horizonte - Brasil Debian Developer Site: http://phls.com.br GPG ID: 0443C450 -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEQySpKy57hdp/nJxAxm0GtARDxFAFAmrkkNcACgkQxm0GtARD xFBp2g//VcYb8qDMrqO6NWVP+J9VpwL8whrqbgu8ixEdqOiEy2e1pPLfGdCLcs1N 4UfEHQkAtJgvY+rL7BraUDpe61AWtTOQ1cRMB2/CA5tCg7TDnL2KTBjltu2ZNT28 x1LqHKHcNWTMKqI1NXp7Abr9ycw35823fVmXg/clIphaCGVFKK5WdW/RqBYEF4Z1 rQD9iXZEwu2WWdnK39+bWfhSo/eeckBuemUjP5X6TGNple4eF9vod/3nTUY0J2LL 0zC5MG6wO3z18CEHA5Zdi0yPgVJbarnACyQfcjrgxKt32bCA0fEY2n4hG/dj/VlJ l+mPyYRBLFx3j7zcUSIPV0kgLgcshT6DFKSryH6CgOsdr2R5dqSpqZtQP2cnG5kd FoQQM2wwazfUvLKJRUliYjMg9FjXetEqDvsveXpiaQ3deEIKJKObqlcAeBgm62gi nwn8yucxMKoki0twokTKG3nDzv0XrZrXdw41RRzDZU5LskiodrvLM4EochxmmqUc 0rXasgtkCh1EHJSRP3A4jq1n8331zPgoZlwmaj4PheRlWuTX4dVxj+ms8MLVsoE/ zVVd9zz2hEUVSv/NGPnsdr+1v+Tdg9QSPbfr0rEGZhoKSCRbQbx5FAhlLSosznYe qSkFWaL0OcIuXDC/yYbwbPT2Nf+2yAQ3Iloc2YNFJ2ZajzNRDo4= =vAoR -----END PGP SIGNATURE-----
