Mornin', On 9/19/26 12:09 AM, Sylvain Beucler wrote: > Hi, > > I assume this targets > CVE-2026-62437,CVE-2026-79602,CVE-2026-79603,CVE-2026-79604 > https://security-tracker.debian.org/tracker/source-package/xen > > In which case we'd request that they be fixed first in unstable, then > proposed to trixie, and last pushed to bookworm-lts.
Ah, yes, ok, Fair enough. I was not planning to go full circle with new updates right now. By the way, for Xen we work from upstream stable branch lines, not from random patches. And, this one is now on 4.17, and trixie + unstable are both on 4.20. So, purely technically version wise it would not matter to do them out of order. > Or, if the above means too much delay, you could publish the current > bookworm version as-is and propose another update when everything else > is ready, as you wish :) Let's then first of all just work with what we already prepared earlier yes. I mean, I know this effect where I think... "oh but now it's a bit later and can't we also..." but that can pretty quickly end up in only more delays. :D > Do you have a draft for the DLA e-mail? I do not. I think team security mostly just uses the short thing that is not very specific, like in: https://lists.debian.org/debian-security-announce/2026/msg00335.html Thanks Hans > > Cheers! > Sylvain > > On 18/09/2026 23:00, Hans van Kranenburg wrote: >> Hi Sylvain! >> >> Thanks for responding. >> >> If we are going to do this now, it makes sense that I provide an updated >> package which includes the current security fixes up to XSA-513: >> https://xenbits.xen.org/xsa/ >> >> I expect to be able to prepare this during current weekend. >> Is that OK?
