Good catch, thanks - you're right. I checked sources.debian.org: trixie ships caddy 2.6.2-12+deb13u1, same 2.6.2 upstream base as bookworm's 2.6.2-5, so it's exposed to the same 8 CVEs (sid/forky already moved to 2.11.4, where all of these are fixed upstream).
I'll prepare the same patch set for trixie once the bookworm side is through review - the fixes themselves should carry over directly since it's the same base version, just a different Debian revision to diff against. Will follow up here once that's ready. Ivo On Tue, Sep 15, 2026 at 6:45 AM, Bastian Blank wrote: > On Mon, Sep 14, 2026 at 11:01:36PM -0700, Ivo Marino wrote: > > Starting work on caddy for bookworm - it's on dla-needed.txt (added by > > Front-Desk back in July) and still unclaimed as far as I can tell, so > > flagging here per the LTS wiki's guidance for casual contributors > > rather than editing dla-needed.txt myself. > > What about trixie? It's the same version, so needs to be done as well. > > Bastian > > -- > I'm a soldier, not a diplomat. I can only tell the truth. > -- Kirk, "Errand of Mercy", stardate 3198.9 > >
