Hi Roberto, [disclaimer, no speaking autoritatively but I think the answer might still be of help for you]
On Wed, Nov 11, 2026 at 12:28:26PM -0500, Roberto C. Sánchez wrote: > Hi Release Managers, > > I wanted to thank you for reviewing and accepting #1152976 > (libmongocrypt/1.13.2-1+deb13u2). However, I am a bit confused by the > lack of movement on #1150479. I originally opened #1150479 on 9 October > to address #1150302 with mongo-c-driver/1.30.4-1+deb13u4 and have > subsequently prepared and uploaded 1.30.4-1+deb13u5 to address several > new CVEs (and I also updated #1150479 with the information related to > 1.30.4-1+deb13u5). I would like to know if I need to do anything in > order to help ensure that 1.30.4-1+deb13u5 is accepted into the point > release scheduled for this weekend. Whenever you are fairly confident the SRM would accept the changes as you are proposing them, along with a proposed update debdiff you can already upload (this is part of the improved workflow, you can take advantage of this if you are sure the changes are ok to be accepted). This helps the SRM insofar, that when checking for packages in pu-NEW then can decide on what to followup on bugs and ack the upload. See: https://lists.debian.org/debian-devel-announce/2025/08/msg00003.html If some changes are disputable or might be subject to change then still do not immediately upload please. With my security-team member hat on I would welcome if we have those all known CVE fixes addressed for the next point release. Regards, Salvatore
