During the month of August 2026 and on behalf of Freexian, I worked on the following:
### ca-certificates / LTS / ELTS Reviewed and tested the updates for bookworm and buster (with Bastien Roucaries). Uploaded `20250419~deb12u1~deb11u1~deb10u1~deb9u1` (stretch), issued ELA-1810-1. This is a backport update in order to get fairly up-to-date CA certificates in Debian stretch. More precisely, it corresponds to Mozilla certificate authority bundle version 2.74. ### ca-certificates-java / ELTS Uploaded `20230710~deb12u1~deb11u1~deb10u2` (buster) and `20230710~deb12u1~deb11u1~deb10u2~deb9u1` (stretch), issued ELA-1809-1. This is a bugfix update to resolve a circular dependency between Java packages and ca-certificates, and thus clear the way to backport `ca-certificates` to Debian 9 stretch. ### xorg-server / LTS Uploaded `2:21.1.7-3+deb12u13` (bookworm), issued DLA 4737-1, fixing: * CVE-2022-49737 * CVE-2026-50256 * CVE-2026-50257 * CVE-2026-50258 * CVE-2026-50259 * CVE-2026-50260 * CVE-2026-50261 * CVE-2026-50262 * CVE-2026-50263 * CVE-2026-50264 Uploaded `2:1.20.11-1+deb11u18` (bullseye), issued DLA 4738-1, fixing all the CVEs listed above, plus those 5: * CVE-2026-33999 * CVE-2026-34000 * CVE-2026-34001 * CVE-2026-34002 * CVE-2026-34003 ### Thanks Thanks to our sponsors for making this possible, and to Freexian for handling the offering: <https://www.freexian.com/lts/debian/#sponsors>. -- Arnaud
