Hey Sylvain, ti 14.7.2026 klo 12.14 Sylvain Beucler ([email protected]) kirjoitti: > On 14/07/2026 09:00, Salvatore Bonaccorso wrote: > > On Tue, Jul 14, 2026 at 08:41:51AM +0300, Martin-Éric Racine wrote: > >> My dashboard shows CVE-2025-70102 as still being unfixed for > >> oldoldstable. Since Bullseye is LTS at this point, this goes via the > >> Security team. The enclosed patch includes the fix for the CVE and > >> some basic packaging touchups to silence Lintian and CI. You're > >> welcome to use it. > > There's no particular urgency for dhcpcd5 at the moment,
I agree. These are minor fixes, and Bullseye is one month away from moving to archive.d.o anyhow. > but if Martin-Éric wants, he can push an update following: > https://lts-team.pages.debian.net/wiki/Development.html > We can help with the administrative tasks. Noted. > - According to > https://security-tracker.debian.org/tracker/source-package/dhcpcd5 > please also fix CVE-2026-56114, to avoid a single-CVE DLA with low-severity. That one doesn't show on my dashboard for dhcpcd5. It's easily added, since it's a one character fix. > - Please explain why we need a new dependency to sysvinit-utils during a > stable release. Lintian complains loudly about an outdated Depends. Adding that alternative to lsb-base quiets it. > - Please attempt to de-noise the debdiff, by avoiding patch refreshes dpkg-source complains without it. > and changes related to upstream tarballs, while we'll remain on the same > v7.1.0 anyway. Salsa CI fails without the added PGP key and updated watch recipe. > - Please name the patches according to the CVE rather than the Git > commit ID, so it's easier to understand which is fixing which. Noted. > - No need for a 7.1.0-2+deb11u2 if 7.1.0-2+deb11u1 never was released. Shrugs. I could consolidate the changes since I'm still in Salsa Git at this point. > - Target dist should be bullseye-security. Noted. > - Please explain how you tested the update. See Bug#1141987. I don't have any Bullseye host left, but the fixes are one-character changes that have been verified to boot on Bookworm and Trixie. Martin-Éric
