Hi, On Tue, Oct 13, 2026 at 02:41:40PM -0500, Simon Quigley wrote: > Fair point about mixing the regression fix with new security > fixes. Would you rather I keep them in, or drop them and ship just > the regression fixes?
No strong preference. > And if they stay, should this go out as a new DLA instead of > DLA-4662-2? Indeed. > CVE-2026-32316-2 explains why it is original; upstream's fix adds > jv_string_repeat(), and that symbol would change the libjq1 ABI. OK, please keep Aron Xu's authorship header. > CVE-2026-47770-2 explains why there is no upstream series to > pick. jv_delpaths() on master still does not check what jv_sort() > returns. You also mention "Upstream still asserts on this input, so the patch is original." Do you mean we're fixing behavior that is unfixed upstream and/or unstable? We shouldn't divert that way. Cheers! Sylvain Beucler Debian LTS Team
