Hi Aryan, hi Python Team, Thank you, Aryan, for reviewing and merging MR !2 and uploading pymongo 4.19.0-1. Its official Salsa CI has passed, and the Security Tracker now records CVE-2026-106435 as fixed in sid. I would now like to arrange review of the first focused trixie update.
I have prepared a local 4.10.1-6+deb13u1 candidate, still UNRELEASED, containing only the upstream fix for CVE-2026-106435 / #1150462. The trixie build passes: 806 passed, 3703 skipped and 788 deselected. In the separate BSON suite, the upstream regression fails on the baseline and passes on the candidate (84 passed, one pre-existing skip). Runtime checks confirmed both C extensions were in use and their hashes matched the built packages. The release's generated autopkgtest passes as a superficial import test; BSON/C coverage was checked separately. Source and binary debdiffs and test logs are ready. The Security Tracker marks this issue no-dsa for trixie. From Developer's Reference section 5.5.1, I understand that the formal route is a release.debian.org trixie-pu request with the source debdiff and test results, following review and coordination of the upload. To organise that review, could you help with these points? - Are there existing Security Team or Stable Release Team discussions, contacts or plans for trixie that I should follow, including any plans for the other outstanding pymongo CVEs? - Where would you prefer the first stable branch/debdiff to be presented for review, and with whom should I coordinate the subsequent upload? - For bookworm, do you have a reference to an LTS discussion or a confirmed assignment? Otherwise, I would ask on debian-lts before starting work for that release. I have not yet filed a trixie-pu request or published the stable branch. The current candidate is limited to #1150462; the remaining stable fixes will need separate preparation and review. https://bugs.debian.org/1150462 https://security-tracker.debian.org/tracker/CVE-2026-106435 https://salsa.debian.org/python-team/packages/pymongo/-/pipelines/1195993 https://www.debian.org/doc/manuals/developers-reference/pkgs.en.html#special-case-uploads-to-the-stable-and-oldstable-distributions Best regards, Federico Molara
