Hello Release Team, On Thu, Oct 08, 2026 at 04:21:01PM +0530, Jeevan Chalke wrote: > Package: src:mongo-c-driver > Version: 1.30.4-1+deb13u3 > Severity: grave > Tags: security patch > X-Debbugs-Cc: [1][email protected] > > Dear Maintainer, > > debian/patches/0009_CVE-2026-81524.patch (the backport of upstream > CDRIVER-6424, "validate db and collection names") breaks > mongoc_collection_aggregate() for every collection. It always returns a > cursor in the error state: > I am already in the process of preparing a 1.30.4-1+deb13u4 version of mongo-c-driver to target the next point release. However, this bug report appears to be of somewhat higher urgency. Should I upload a 1.30.4-1+deb13u4 containing only the fix for #1150302 for immediate upload with the intent of a SUA to get the fix landed more quickly? I would then defer the other fixes I am working on to 1.30.4-1+deb13u5.
Thanks in advance for your guidance. Regards, -Roberto -- Roberto C. Sánchez
