libgphoto2 (2.5.34-2) unstable; urgency=medium . * [be329ad] New patch: Drop the leading components from HAVE_CC (Closes: #1150179) * [a556711] Drop the now-superfluous Priority: optional declaration * [13e6dff] Drop the now-superfluous Rules-Requires-Root: no declaration * [255263b] Reformat Build-Depends * [20f74c3] Switch to Debhelper compatibility level 14 libgphoto2 (2.5.34-1) unstable; urgency=medium . * [8fb3b5b] New upstream version 2.5.34 (Closes: #1134329) Contains fixes for CVE-2026-40333, CVE-2026-40334, CVE-2026-40335, CVE-2026-40336, CVE-2026-40338, CVE-2026-40339, CVE-2026-40340 and CVE-2026-40341. * [988af35] Update Standards-Version to 4.7.4 (no changes required) * [da497dd] Update watch file to version 5 * [1254f9b] Adapt to new Lintian override format libzip (1.12-1) unstable; urgency=medium . * [a3c49df] New upstream version 1.12 * [aa7ed45] d/patches/cmake-4.patch: removed, now part of upstream * [6aa9f86] d/copyright: update for new upstream release * [57dfd72] d/libzip5.symbols: update for new upstream release. This drops zip_secure_random which was supposed to be internal and which is not used by anything in Debian. * [65d4865] d/tests/upstream: match new upstream directy layout logswan (2.1.17-1) unstable; urgency=medium . * New upstream version 2.1.17. * debian/copyright: Update copyright years and packaging information. * debian/watch: Use version 4 format for tool compatibility. mkbrr (1.27.0-1) unstable; urgency=medium . * New upstream version 1.27.0 nftables (1.1.7-3) unstable; urgency=medium . * [d9cd404] d/rules: remove obsolete dh_installexamples override * [0d69a1d] d/rules: put targets in execution order * [57beaba] d/rules: stop passing `SOURCE_DATE_EPOCH` explicitly to `dh_auto_build` * [3057c0f] d/rules: de-duplicate `dh_auto_*` overrides * [e2f7f71] d/rules: use `$(DH_OVERRIDDEN_COMMAND)` throughout * [032da50] d/t/control: internaltest-shell.sh: run tests in deterministic order * [e3cfdb5] d/t/control: internaltest-shell.sh: add dep on iputils-arping * [ace3057] d/t/control: internaltest-shell.sh: change isolation to "machine" & add "breaks-testbed" openssh (1:10.6p1-1) unstable; urgency=medium . * New upstream release: - scp(1): begin deprecating the -R flag, which is used to perform a remote-to-remote copy by executing scp on a remote host. This option is a fragile optimisation that is difficult to use because it requires credentials on the remote host. It also creates security risks if the shell quoting rules on the remote system where the copy is performed differ from the client's expectations. . From OpenSSH 10.6, this option will continue to work but will cause a deprecation warning to be emitted to standard error. In a future release, the option will be ignored and will leave in place the default remote-to-remote copy behaviour (copy via the host running scp). - SECURITY: sftp(1): more strictly validate paths returned from the server to avoid some cases where a server could return paths that could manipulate a recursive copy operation into writing outside its target directory. - SECURITY: sshd(8): when GSSAPIAuthentication is in use, only store GSSAPI credentials when authentication has succeeded. Avoids a situation where credentials from a failed GSSAPIAuthentication attempt may persist and be made inappropriately available if another authentication subsequently succeeds. - SECURITY: sshd(8): reset GSSAPIAuthentication before authentication, avoiding state from one authentication attempt being confused with that of a later attempt. - SECURITY: sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate side-channel leaks. A chosen-plaintext attack method exists which makes use of dictionary-based compression to recover secrets from one channel by interacting with the SSH session's shared compression dictionary through another channel. . Attacker-controlled input can recognizably reflect into the total length of transmitted ciphertexts by virtue of LZ77 replacing repeated strings with back-references into the SSH session's encoder search buffer, which is shared across all channels. For this reason, the documentation already recommended against enabling compression for connections that share trusted and untrusted traffic. . This change will reduce the effectiveness of the Compression option. Users are encouraged to use application-level compression over the SSH protocol where possible, as this will typically be more effective and will be completely immune to this type of attack. - SECURITY: ssh(1): disallow '$' and '\' characters in usernames entered on the command-line to avoid usernames from untrusted sources yielding injection in shell context via ProxyCommand, Match exec, etc. Usernames specified via the configuration files are not subject to this control. . We continue to recommend against directly exposing ssh(1) and other tools' command-lines to untrusted input. Mitigations such as this cannot be absolute given the variety of shells and user configurations in use. - SECURITY: ssh-keygen(1): correct handling of Daylight Saving Time when converting dates. Previous handling could cause errors of up to +/- 1 hour (unless you are in the Antarctica/Troll timezone, where the error could be +/- 2 hours). These errors could result in creation of certificates with incorrect expiry times. - SECURITY: sshd(8), ssh(1): ensure that compressed payloads don't inflate past the maximum supported packet length. - SECURITY: sshd(8): fully honor the authorized_keys "restrict" keyword, which was not being properly applied to tunnel forwarding (PermitTunnel, disabled by default). - SECURITY: sshd(8): correctly handle some options that accept "none". Some options, including AuthorizedPrincipalsFile, were documented as accepting "none" as a way to disable them; however, when overridden by an sshd_config(5) Match keyword, this argument was being incorrectly interpreted as a literal file. - All: enable hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm. Note that this no longer uses the "@openssh.com" vendor extension suffix that the previous experimental implementation used. Keys generated with the previous experimental support must be regenerated and/or removed. - sshd(8): Add the WarnWeakCrypto option to sshd_config(5). This option was previously available for the client only. This option is enabled by default and will log when the client uses a key agreement scheme that is not post-quantum safe. - ssh-keygen(1), ssh-add(1): preserve user-verification (PIN or biometric) requirement for resident keys loaded from a FIDO token, by checking the credential's credProtect policy. - ssh(1): include local and remote version strings in the ~I connection information display. - ssh-add(1): add a -P flag to skip PIN entry for FIDO and PKCS#11 tokens that do not require it. - sftp(1): add '-p' flag for mkdir/lmkdir to create directories as required. This flag has similar ergonomics to mkdir(1), and previously-existing directories do not cause an error. - ssh-keygen(1): add a "hexdump" key export mode that dumps the SSH wire-formatted key blob in hex format. Useful when writing documentation, tests, etc. E.g. `ssh-keygen -em hexdump -f /key`. - ssh(1), sshd(8): ChannelTimeout now accepts timeouts with fractional seconds. - sshd(8): allow specification of the location of $SSH_AUTH_SOCK used for agent forwarding using a new AgentSocketPath option. This supports both using a user-specific path, such as the default of a subdirectory of $HOME ("user:.ssh/agent"), and the previous approach of allowing agent forwarding sockets to be located in a shared directory (e.g. "shared:/tmp"). Sockets created in shared directories will be created inside a subdirectory with a randomised name. - ssh-agent(1): allow specification of agent socket directories using a -A flag. It accepts "user:" and "shared:" directory styles similar to the sshd AgentSocketPath option. - sshd(8): account for public key authentication "key ok" tests separately to auth attempts. Add a `PubkeyOptions max-pk-ok:nnnn` option to allow a number of PK_OK tests (asking whether the server might accept a given public key) that do not count against MaxAuthTries, defaulting to 6 attempts. After these attempts are exhausted, further attempts count as failed authentications against MaxAuthTries. Practically, this allows more keys on disk or held in ssh-agent to be checked for use before the server disconnects. - ssh(1), sshd(8): extend the existing TCPKeepAlive option to also support setting keepalives on sockets created for forwarding connections. Previously this option controlled keepalives on the connection socket only. TCPKeepAlive "yes" or "transport" enables keepalives on the connection socket. "TCPKeepAlive all" additionally enables them for forwarding sockets. - sshd(8), ssh(1): fix configuration matching on more Turkic languages which have disjoint dotted and dotless i/I characters, specifically Azerbaijani and Crimean Tatar. - ssh(1), sshd(8): don't attempt to set TCP_NODELAY on non-IP/IPv6 sockets. Eliminates some noise in debug logs. - ssh(1): fix case for ssh -G option output. - ssh(1), sshd(8): Fix ChannelTimeout specificity; previously a more specific channel type (e.g. "session:shell") could clobber a user-specified ChannelTimeout if it was less specific (e.g. "session"). Also, in some cases, the debug messages were printing 0 instead of the effective timeout. - sftp(1): avoid NULL dereference crash in some circumstances when a server fails a stat/lstat operation. - sshd(8): close a race condition where a SIGTERM/SIGQUIT would be ignored if it was received by the server while it was processing a SIGHUP restart request. - sshd(8), ssh(1): check key and CA signature types during key parsing against allowlists (PubkeyAcceptedAlgorithms, etc) as early as possible. This reduces the attack surface presented by disabled algorithms. - All: switch the fallback implementation of the ed25519 signature algorithm used when libcrypto is disabled from SUPERCOP ed25519 to libsodium. The libsodium implementation includes a number of strictness checks over the original reference implementation we have used to this point and a more ergonomic API. - ssh-add(1), ssh(1), ssh-keygen(1): fix spin on password entry when the program attempting to read a password was started in a background process group, with no TTY and with certain signals ignored. - scp(1): disallow nul byte in received scp -O filename. This was not reachable in normal operation. - ssh-keygen(1), ssh(1), sshd(8): implement a maximum number of KDF rounds that will be accepted when writing an OpenSSH-format private key or when loading one. This limit is set quite high (1M), but ensures that a service that is passed a bad key with a ridiculously high number of rounds will eventually complete parsing it. - ssh-keygen(1): bump the default number of KDF rounds from 24 to 32 (this is a linear increase, not like bcrypt(3) which is exponential). - ssh(1): make StreamLocalBindMask properly respect Host/Match blocks and make it first-match-wins as documented. - sshd(8): make StreamLocalBindMask properly first-match-wins. - sshd(8): don't link sshd against libselinux when SELinux support is enabled (note: this library is still linked for the sshd-auth and sshd-session helper binaries). - sshd(8): restrict mremap(2) flags accepted by the seccomp sandbox. Only MREMAP_MAYMOVE is now accepted as other flags may have some utility in attack chains. - sshd(8): allow PAMServiceName in Match (regressed in 10.4). During the refactor of server option parsing, the ability to set PAMServiceName in Match blocks was accidentally disabled. * Generate MLDSA44-ED25519 host key by default (closes: #1142934). * Remove Lintian overrides that now only apply to openssh-gssapi. * Remove copyright entry that now only applies to openssh-gssapi. * Skip purging if openssh-{client,server}-gssapi is installed (closes: #1148080). openssh-gssapi (1:10.6p1-1) unstable; urgency=medium . * New upstream release: - scp(1): begin deprecating the -R flag, which is used to perform a remote-to-remote copy by executing scp on a remote host. This option is a fragile optimisation that is difficult to use because it requires credentials on the remote host. It also creates security risks if the shell quoting rules on the remote system where the copy is performed differ from the client's expectations. . From OpenSSH 10.6, this option will continue to work but will cause a deprecation warning to be emitted to standard error. In a future release, the option will be ignored and will leave in place the default remote-to-remote copy behaviour (copy via the host running scp). - SECURITY: sftp(1): more strictly validate paths returned from the server to avoid some cases where a server could return paths that could manipulate a recursive copy operation into writing outside its target directory. - SECURITY: sshd(8): when GSSAPIAuthentication is in use, only store GSSAPI credentials when authentication has succeeded. Avoids a situation where credentials from a failed GSSAPIAuthentication attempt may persist and be made inappropriately available if another authentication subsequently succeeds. - SECURITY: sshd(8): reset GSSAPIAuthentication before authentication, avoiding state from one authentication attempt being confused with that of a later attempt. - SECURITY: sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate side-channel leaks. A chosen-plaintext attack method exists which makes use of dictionary-based compression to recover secrets from one channel by interacting with the SSH session's shared compression dictionary through another channel. . Attacker-controlled input can recognizably reflect into the total length of transmitted ciphertexts by virtue of LZ77 replacing repeated strings with back-references into the SSH session's encoder search buffer, which is shared across all channels. For this reason, the documentation already recommended against enabling compression for connections that share trusted and untrusted traffic. . This change will reduce the effectiveness of the Compression option. Users are encouraged to use application-level compression over the SSH protocol where possible, as this will typically be more effective and will be completely immune to this type of attack. - SECURITY: ssh(1): disallow '$' and '\' characters in usernames entered on the command-line to avoid usernames from untrusted sources yielding injection in shell context via ProxyCommand, Match exec, etc. Usernames specified via the configuration files are not subject to this control. . We continue to recommend against directly exposing ssh(1) and other tools' command-lines to untrusted input. Mitigations such as this cannot be absolute given the variety of shells and user configurations in use. - SECURITY: ssh-keygen(1): correct handling of Daylight Saving Time when converting dates. Previous handling could cause errors of up to +/- 1 hour (unless you are in the Antarctica/Troll timezone, where the error could be +/- 2 hours). These errors could result in creation of certificates with incorrect expiry times. - SECURITY: sshd(8), ssh(1): ensure that compressed payloads don't inflate past the maximum supported packet length. - SECURITY: sshd(8): fully honor the authorized_keys "restrict" keyword, which was not being properly applied to tunnel forwarding (PermitTunnel, disabled by default). - SECURITY: sshd(8): correctly handle some options that accept "none". Some options, including AuthorizedPrincipalsFile, were documented as accepting "none" as a way to disable them; however, when overridden by an sshd_config(5) Match keyword, this argument was being incorrectly interpreted as a literal file. - All: enable hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm. Note that this no longer uses the "@openssh.com" vendor extension suffix that the previous experimental implementation used. Keys generated with the previous experimental support must be regenerated and/or removed. - sshd(8): Add the WarnWeakCrypto option to sshd_config(5). This option was previously available for the client only. This option is enabled by default and will log when the client uses a key agreement scheme that is not post-quantum safe. - ssh-keygen(1), ssh-add(1): preserve user-verification (PIN or biometric) requirement for resident keys loaded from a FIDO token, by checking the credential's credProtect policy. - ssh(1): include local and remote version strings in the ~I connection information display. - ssh-add(1): add a -P flag to skip PIN entry for FIDO and PKCS#11 tokens that do not require it. - sftp(1): add '-p' flag for mkdir/lmkdir to create directories as required. This flag has similar ergonomics to mkdir(1), and previously-existing directories do not cause an error. - ssh-keygen(1): add a "hexdump" key export mode that dumps the SSH wire-formatted key blob in hex format. Useful when writing documentation, tests, etc. E.g. `ssh-keygen -em hexdump -f /key`. - ssh(1), sshd(8): ChannelTimeout now accepts timeouts with fractional seconds. - sshd(8): allow specification of the location of $SSH_AUTH_SOCK used for agent forwarding using a new AgentSocketPath option. This supports both using a user-specific path, such as the default of a subdirectory of $HOME ("user:.ssh/agent"), and the previous approach of allowing agent forwarding sockets to be located in a shared directory (e.g. "shared:/tmp"). Sockets created in shared directories will be created inside a subdirectory with a randomised name. - ssh-agent(1): allow specification of agent socket directories using a -A flag. It accepts "user:" and "shared:" directory styles similar to the sshd AgentSocketPath option. - sshd(8): account for public key authentication "key ok" tests separately to auth attempts. Add a `PubkeyOptions max-pk-ok:nnnn` option to allow a number of PK_OK tests (asking whether the server might accept a given public key) that do not count against MaxAuthTries, defaulting to 6 attempts. After these attempts are exhausted, further attempts count as failed authentications against MaxAuthTries. Practically, this allows more keys on disk or held in ssh-agent to be checked for use before the server disconnects. - ssh(1), sshd(8): extend the existing TCPKeepAlive option to also support setting keepalives on sockets created for forwarding connections. Previously this option controlled keepalives on the connection socket only. TCPKeepAlive "yes" or "transport" enables keepalives on the connection socket. "TCPKeepAlive all" additionally enables them for forwarding sockets. - sshd(8), ssh(1): fix configuration matching on more Turkic languages which have disjoint dotted and dotless i/I characters, specifically Azerbaijani and Crimean Tatar. - ssh(1), sshd(8): don't attempt to set TCP_NODELAY on non-IP/IPv6 sockets. Eliminates some noise in debug logs. - ssh(1): fix case for ssh -G option output. - ssh(1), sshd(8): Fix ChannelTimeout specificity; previously a more specific channel type (e.g. "session:shell") could clobber a user-specified ChannelTimeout if it was less specific (e.g. "session"). Also, in some cases, the debug messages were printing 0 instead of the effective timeout. - sftp(1): avoid NULL dereference crash in some circumstances when a server fails a stat/lstat operation. - sshd(8): close a race condition where a SIGTERM/SIGQUIT would be ignored if it was received by the server while it was processing a SIGHUP restart request. - sshd(8), ssh(1): check key and CA signature types during key parsing against allowlists (PubkeyAcceptedAlgorithms, etc) as early as possible. This reduces the attack surface presented by disabled algorithms. - All: switch the fallback implementation of the ed25519 signature algorithm used when libcrypto is disabled from SUPERCOP ed25519 to libsodium. The libsodium implementation includes a number of strictness checks over the original reference implementation we have used to this point and a more ergonomic API. - ssh-add(1), ssh(1), ssh-keygen(1): fix spin on password entry when the program attempting to read a password was started in a background process group, with no TTY and with certain signals ignored. - scp(1): disallow nul byte in received scp -O filename. This was not reachable in normal operation. - ssh-keygen(1), ssh(1), sshd(8): implement a maximum number of KDF rounds that will be accepted when writing an OpenSSH-format private key or when loading one. This limit is set quite high (1M), but ensures that a service that is passed a bad key with a ridiculously high number of rounds will eventually complete parsing it. - ssh-keygen(1): bump the default number of KDF rounds from 24 to 32 (this is a linear increase, not like bcrypt(3) which is exponential). - ssh(1): make StreamLocalBindMask properly respect Host/Match blocks and make it first-match-wins as documented. - sshd(8): make StreamLocalBindMask properly first-match-wins. - sshd(8): don't link sshd against libselinux when SELinux support is enabled (note: this library is still linked for the sshd-auth and sshd-session helper binaries). - sshd(8): restrict mremap(2) flags accepted by the seccomp sandbox. Only MREMAP_MAYMOVE is now accepted as other flags may have some utility in attack chains. - sshd(8): allow PAMServiceName in Match (regressed in 10.4). During the refactor of server option parsing, the ability to set PAMServiceName in Match blocks was accidentally disabled. * Generate MLDSA44-ED25519 host key by default (closes: #1142934). * Skip purging if openssh-{client,server}-gssapi is installed (closes: #1148624). phpunit (13.4.1+ds-2) unstable; urgency=medium . * Drop tests failing on 32-bit architectures phpunit (13.4.1+ds-1) unstable; urgency=medium . [ Sebastian Bergmann ] * Start development of PHPUnit 13.4 * Prepare release . [ David Prévot ] * Build-depend on versioned php-text-template pyelectra (1.2.6-1) unstable; urgency=medium . * New upstream release. pyelectra (1.2.5-1) unstable; urgency=medium . * New upstream release. * Remove debian/gbp.conf, switch to dgit. * Remove defaults from debian/control. * Update Standards-Version. * Update to debhelper compatibility level 14. * Add dh-sequence-single-binary. * Remove debhelper compat 14 auto-applied substvars. * Prefix debhelper files with the binary package name. * Update copyright year. * Update debian/watch to format version 5. * Add debian/salsa-ci.yml. * Simplify debian/rules. * Run test suite. python-bellows (1.1.0-1) unstable; urgency=medium . * New upstream release. * Update to debhelper compatibility level 14. * Add dh-sequence-single-binary. * Remove debhelper compat 14 auto-applied substvars. python-glyphsets (1.1.3-1) unstable; urgency=medium . * Team upload * New upstream version 1.1.3 * Test with pytest python-glyphsets (1.1.0-1) unstable; urgency=medium . * Team upload * Rebase patches * Use pyproject.toml * Add new Build-Depends with a replacement . [ Alexandre Detiste ] * New upstream version 1.1.0 python-nanoemoji (0.16.0-4) unstable; urgency=medium . * debian/patches/0003-Ship-the-default-config-as-package-data.patch: Drop the patch. The release tarball ships .git_archival.txt, so setuptools_scm lists all source files and the default config gets installed without it. The same change has been merged upstream in ab705e60dccb9c12668ba9dc0758edf05dcb7126 . python-raygeo (1.61.0-2) unstable; urgency=medium . * Fix test-suite byte-order assumptions on big-endian architectures. python-raygeo (1.61.0-1) unstable; urgency=medium . * New upstream release. * Refresh Debian dependency compatibility patches. * Correct the Salsa repository URL. python-raygeo (1.52.0-1) unstable; urgency=medium . * New upstream release. * Update Debian dependency relaxations. * Remove obsolete Rust API compatibility patch. * Disable the global mimalloc allocator. rshim-user-space (2.7.3+ds-1) unstable; urgency=medium . * New upstream release. rshim-user-space (2.7.2+ds-1) unstable; urgency=medium . * New upstream release rshim-user-space (2.7.1+ds-1) unstable; urgency=medium . * New upstream release rshim-user-space (2.6.6+ds-1) unstable; urgency=medium . * New upstream release rshim-user-space (2.6.5+ds-1) unstable; urgency=medium . * New upstream release. rshim-user-space (2.6.4+ds-1) unstable; urgency=medium . * New upstream release. rshim-user-space (2.6.3+ds-1) unstable; urgency=medium . * New upstream release. * Install new upstream systemd link file for tmfifo_net devices. ruby-rspec-pending-for (0.1.28-1) unstable; urgency=medium . * Team upload. * New upstream release. rubygems (4.0.22-1) unstable; urgency=medium . * Team upload. * Add Uversion-Mangle: auto to watch. * New upstream release. rust-pkg-config (0.3.34-1) unstable; urgency=medium . * Team upload * Package pkg-config 0.3.34 from crates.io using debcargo 2.8.4 REMOVED: golang-github-microsoft-didx509go 0.0.3-2 REMOVED: golang-github-wenerme-astgo 0.0~git20230926.1b5bc38-3 REMOVED: golang-github-jamesruan-go-rfc1924 0.0~git20170108.2767ca7-2 REMOVED: golang-github-jacobsa-gcloud 0.0~git20240721.15c4fa4-2 REMOVED: r-cran-mlbench 2.1-8-1 REMOVED: golang-github-schollz-peerdiscovery 1.7.4-1 REMOVED: golang-github-vulcand-predicate 1.1.0-2 REMOVED: golang-github-codahale-hdrhistogram 0.0~git20161010.3a0bb77-3 REMOVED: golang-github-drone-envsubst 1.0.3-3 REMOVED: golang-github-dropbox-dropbox-sdk-go-unofficial 6.0.5-2 REMOVED: golang-github-valyala-tcplisten 1.0.0-2 REMOVED: golang-github-hashicorp-terraform-registry-address 0.2.0-1.1 REMOVED: golang-github-bsm-go-vlq 0.0~git20150828.ec6e8d4-2