Hello, On 10/16/26 09:36, ChangZhuo Chen (陳昌倬) wrote:
On Fri, Oct 16, 2026 at 08:01:26AM -0500, Simon Quigley wrote:[0] https://salsa.debian.org/debian/jq/-/blob/debian/trixie/debian/patches/CVE-2026-47770.patch?ref_type=headsThe guard I mean isn't in Trixie's CVE-2026-47770.patch, which is a straight upstream cherry-pick like you say. It's in Aron's fix-invalid-jv-propagation.patch, the one that makes jv_delpaths() return the invalid jv instead of aborting. Trixie already shipped that in 1.7.1-6+deb13u3 (DSA-6416-1), so Bookworm would be following Trixie here, not diverging.So the patch is [0]. If upstream also has this problem, and this patch can solve the problem, we shall provide the patch to upstream. [0] https://salsa.debian.org/debian/jq/-/blob/debian/trixie/debian/patches/fix-invalid-jv-propagation.patchtrixie diverting isn't a sufficient reason to align all other dists IMHO, maybe it's an error in trixie, maybe it isn't, let's hear from the maintainer -- who is fortunately already in Cc:. @czchen, what do you think? Is this original fix a high regression or security issue that's worth fixing from unstable down?I thin the fix shall be in upstream -> unstable -> stable/oldstable order in general.Would you want to get this guard into upstream and then unstable? Would you like my help?Yes if appropriate.
Done now: https://github.com/jqlang/jq/pull/3681
In the meantime I'll keep the other fixes as a new DLA. Would you rather I drop this extra patch for Bookworm in the meantime?I think you can prepare the build without this patch first, and we will figure out how to handle this patch in the meantime.
Sounds good. I'll go ahead and get the other fixes uploaded with a DLA issued, in the next few hours, assuming no objections. Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
