Here is my public monthly report.
Thanks to our sponsors for making this possible, and to Freexian for
handling the offering.
https://www.freexian.com/lts/debian/#sponsors
LTS
- Many non-team upload review
- Review Ruby uploads from Simon Quigley
- ruby-oj (DLA-4803-1)
late review, point at newer CVE-less fixes, precise process
https://lists.debian.org/debian-lts/2026/10/threads.html#00011
- ruby-oauth2 (DLA-4822-1): review
https://lists.debian.org/debian-lts/2026/10/msg00021.html
- rails (DLA 4829-1): review
https://lists.debian.org/debian-lts/2026/10/msg00038.html
- Review NMUs from Simon Quigley
- libgit2 (DLA-4831-1): review
https://lists.debian.org/debian-lts/2026/10/msg00047.html
- jq (DLA-4840-1)
review, request clarifications, coordinate with maintainer
https://lists.debian.org/debian-lts/2026/10/threads.html#00049
- xen (DLA-4818-1)
basic checks, sponsored upload for the maintainers, announcement
https://lists.debian.org/debian-lts/2026/10/msg00020.html
https://lists.debian.org/debian-lts-announce/2026/10/msg00010.html
- nagios4: send missing announcement for DLA-4832-1
https://lists.debian.org/debian-lts-announce/2026/10/msg00025.html
https://lists.debian.org/debian-lts/2026/10/msg00052.html
- crash: follow-up from last month, review and test non-security fix
(waiting for maintainer/uploader feedback)
https://lists.debian.org/debian-lts/2026/10/msg00013.html
- tryton: review
(waiting for maintainer/uploader feedback)
https://lists.debian.org/debian-lts/2026/10/msg00015.html
- wolfssl: review, update security tracker
(waiting for fix in unstable and stable/SPU)
https://lists.debian.org/debian-lts/2026/10/msg00022.html
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ddf1c129876908cc505df90e4bdd87db4246ebf
- mariadb
- Review
https://lists.debian.org/debian-lts/2026/10/msg00033.html
https://salsa.debian.org/mariadb-team/mariadb-server/-/merge_requests/180
- Debug issue with first upload to security archive
- Issue DLA-4835-1
https://lists.debian.org/debian-lts-announce/2026/10/msg00029.html
- Try to reproduce isolated upgrade issue from tobi (no success)
- tiff: team review
https://lists.debian.org/debian-lts/2026/10/msg00063.html
- git-lfs
- Review non-Debian contribution, with many points to address
https://salsa.debian.org/go-team/packages/git-lfs/-/merge_requests/5#note_816597
https://lists.debian.org/debian-lts/2026/10/msg00042.html
- Identify missing patches and incorrect patch order for CVE-2025-26625
https://security-tracker.debian.org/tracker/CVE-2025-26625
- Rework update from scratch
- Backport integration tests, stabilize test suite, setup Salsa CI
- Contact maintainer about improving tests, import new autopkgtest
https://salsa.debian.org/go-team/packages/git-lfs/-/merge_requests/5#note_819874
- Report trixie regression / incomplete update
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1118339#24
- DLA-4846-1
https://lists.debian.org/debian-lts-announce/2026/10/msg00040.html
https://salsa.debian.org/go-team/packages/git-lfs/-/merge_requests/7
ELTS
- xz-utils
- Reference actual patches and test cases
(CVE-2026-34743 and GHSA-5qpq-xqfv-j9pg)
- Backport test cases, test framework and autopkgtest to bullseye
- Propose test improvements for bookworm-lts
https://salsa.debian.org/debian/xz-utils/-/merge_requests/9
- Investigate xz-utils suspicious tarball change in bullseye
https://salsa.debian.org/lts-team/lts-updates-tasks/-/work_items/401#note_816450
- Tidy Salsa: setup Salsa CI, clean-up branches
https://salsa.debian.org/debian/xz-utils/-/tree/debian/11-bullseye
- ELA-1843-1 for bullseye and ELA-1844-1 for buster & stretch
https://www.freexian.com/lts/extended/updates/ela-1843-1-xz-utils/
https://www.freexian.com/lts/extended/updates/ela-1844-1-xz-utils/
- elts security-tracker
Fixed invalid data that blocked updates, a couple times.
Common documentation and tooling
- Tooling
- cvehist
- Attempt to get back access (following technical changes) to
https://salsa.debian.org/lts-team/cvehist, without success
- Handle CVEExtendFile (ELTS)
improve cvesplit-v4.c to drop auto-EOL entries
https://salsa.debian.org/lts-team/cvehist/-/commit/eee05a57fc0b01e01d6a7e41963d8bd226dda661
- security-tracker Git performance issues
- Report and test issues with repacked security-tracker service
- Publish the year+volume split/merge rewrite, for the record
(I believe people in charge now want to do it differently)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908678#194
- Opt out of further involvement due to poor communication, as
well as broken access above
- Public documentation
- Development: DLA upload/announcement
Reference proofread procedure and tidy some text
https://lts-team.pages.debian.net/wiki/Development.html#announce-the-update
- TestSuites: git-lfs: new entry, stabilize test suite
https://lts-team.pages.debian.net/wiki/TestSuites/git-lfs.html
- Review and merge switch from deb.freexian.com to password-
restricted security.freexian.com (public and private docs)
https://salsa.debian.org/lts-team/lts-team.pages.debian.net/-/merge_requests/35
- User help
- Point at the right security contact point
https://lists.debian.org/debian-security/2026/10/msg00000.html
- Point contributor at the NM process again
https://lists.debian.org/debian-lts/2026/10/msg00007.html
- Team discussion
- cve-ad (additional data for Freexian)
- Argue against automated severity copy, only committing manual
assessments
- Argue against TEMP support
- Suggest dropping 'urgency' field
https://gitlab.com/freexian/services/deblts-team/debian-lts/-/merge_requests/71
- Recommend more temporization before adding packages to the work queue
https://lists.debian.org/debian-lts/2026/10/msg00076.html
- Team meeting (Jitsi)
