On Fri, Oct 16, 2026 at 09:50:55AM +0200, Sylvain Beucler wrote: > Hi, > > On 15/10/2026 22:21, Simon Quigley wrote: > > On 10/15/26 07:33, Sylvain Beucler wrote: > > > On Tue, Oct 13, 2026 at 02:41:40PM -0500, Simon Quigley wrote: > > > You also mention "Upstream still asserts on this input, so the patch > > > is original." Do you mean we're fixing behavior that is unfixed > > > upstream and/or unstable? We shouldn't divert that way. > > > > On CVE-2026-47770, right, upstream still asserts in jv_delpaths() on > > this input. The fix I'm carrying is the same guard Trixie already > > shipped in 1.7.1-6+deb13u3 (DSA-6416-1), so Bookworm is catching up to > > Trixie, not going its own way. It also stops the abort that deb12u2 > > introduced after DLA-4662-1. I'm happy to reword the patch header to say > > that, or drop it if you don't think Trixie shipping this before unstable > > warrants including it.
I am confused about this. What patch is unfixed in upstream/unstable in Trixie? The patch for CVE-2026-47770 in Trixie is [0]. Looks like it is cherry-pick from upstream. Do you mean this patch contains change in Trixie only due to jq version? [0] https://salsa.debian.org/debian/jq/-/blob/debian/trixie/debian/patches/CVE-2026-47770.patch?ref_type=heads > trixie diverting isn't a sufficient reason to align all other dists IMHO, > maybe it's an error in trixie, maybe it isn't, let's hear from the > maintainer -- who is fortunately already in Cc:. > > @czchen, what do you think? Is this original fix a high regression or > security issue that's worth fixing from unstable down? I thin the fix shall be in upstream -> unstable -> stable/oldstable order in general. -- ChangZhuo Chen (陳昌倬) callsign: BU2HG email: [email protected] fingerprint = BA04 346D C2E1 FE63 C790 8793 CC65 B0CD EC27 5D5B
signature.asc
Description: PGP signature
