There are 4 open security issues in sid.
There are 4 open security issues in forky.
commit 84dea9176ae2a8216ec4aa48ee7c601a1d1b020b
Author: Reinhard Tartler <siretart@tauware.de>
Date: Fri Oct 2 17:50:39 2026 -0400
Update changelog for 1.46.0-2 release
commit fd347a1e56dbb40056421936abcf4f83e2d03aa0
Author: Reinhard Tartler <siretart@tauware.de>
Date: Fri Oct 2 14:16:43 2026 -0400
debian/control: upgrade to debhelper-compat (= 14)
commit 5f008374ee646ef3f03a99f278763fd149903647
Author: Reinhard Tartler <siretart@tauware.de>
Date: Fri Oct 2 14:07:03 2026 -0400
d/patches: clean up and standardize DEP-3 headers
commit fbcbfd20172051d16a5a79118abbc8bc76cd7e32
Author: Reinhard Tartler <siretart@tauware.de>
Date: Fri Oct 2 14:04:07 2026 -0400
d/lintian-overrides: suppress package-contains-documentation-outside-usr-share-doc
commit 4b830ffdd5d866e3c1cdb053b6655fc8fb2b597f
Merge: 96b1a73cd9 feda8c47e4
Author: Reinhard Tartler <siretart@tauware.de>
Date: Fri Oct 2 13:00:00 2026 -0400
Merge commit 'feda8c47e48a847764d7a076acc24693eb4e2245' into debian/sid
# Conflicts:
# debian/changelog
# debian/watch
commit 96b1a73cd9eef804d0adec1688e00ebf2328b05d
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Fri Oct 2 13:11:21 2026 +0200
d/changelog: prepare 1.46.0-1 for unstable
1.46.0-1~exp1 has been in experimental since 2026-09-27, so the unstable
entry goes on top of it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 49c694bb057c06c0cfbd7dcd521babb9eda27b70
Merge: 44857760ad 4232d3a7e6
Author: Andrew Lee (李健秋) <ajqlee@debian.org>
Date: Sun Sep 27 22:01:09 2026 +0200
Merge branch 'debian/experimental' into 'debian/experimental'
golang-opentelemetry-otel 1.46.0-1~exp1
See merge request go-team/packages/golang-opentelemetry-otel!4
commit 4232d3a7e6ce01cc6eed49a1fbeccafbdb483132
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Tue Sep 22 16:07:18 2026 +0200
d/control: add back golang-github-masterminds-semver-dev
schema/internal/parser_checks.go imports github.com/Masterminds/semver/v3
and schema/go.mod requires it, but the dependency was dropped in the July
cleanup. sbuild does not notice because another build dependency pulls
the package into the chroot; the autopkgtest installs only Depends and
fails with 'cannot find package github.com/Masterminds/semver/v3'.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 45f12be59c4593eddbbe19836043f7b7518ac2b9)
commit 3a8de349b9e3a55ec6646f59aca7fb721ed16b61
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Tue Sep 22 15:02:27 2026 +0200
d/salsa-ci.yml: switch to the standard Salsa CI pipeline
The project CI configuration path now points at debian/salsa-ci.yml, so
replace the pkg-go archive test job with the standard pipeline.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 73deed6cc309c812412fe1651d5a22bbe8eb3aa6)
commit a5c2c344260ee9b828d9b5d44690fcaba46823f5
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Tue Sep 22 14:16:47 2026 +0200
d/control: build against golang-github-cespare-xxhash-v2-dev
Andrew Lee renamed the source and binary in 2.3.0-1, now in unstable.
The new package ships the module at github.com/cespare/xxhash/v2, which
is the path go.mod imports, while golang-github-cespare-xxhash-dev ships
the v2 module under the non-v2 path.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 5f0f0ce24733842b2bba527adc71184901dd82ea)
commit 599063bb77062cab449684e8c6b405ec8f4a4ff2
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Sep 21 18:50:47 2026 +0200
d/control: bump prometheus-dev Breaks to 3.5.3+ds1-6~
3.5.3+ds1-5 also went to unstable without the semconv v1.43.0 update;
it was a kube-openapi dependency change. The semconv bump moves to -6.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 1abfff777091270b073e35952e27f8bd32f1a839)
commit 5a01fcbdd93a1628bc5f93eba9e949a0971c7c34
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sun Sep 20 21:58:50 2026 +0200
d/changelog: target experimental as 1.46.0-1~exp1
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit b72c97418657612c1e3b18abef8bdd569bb99a16
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sun Sep 20 21:58:32 2026 +0200
d/control: bump prometheus-dev Breaks to 3.5.3+ds1-5~
3.5.3+ds1-4 went to unstable without the semconv v1.43.0 update; that
patch now lands in 3.5.3+ds1-5.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 03324b4f2d94588b2e2151a86a7079be9465e2fa
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Wed Sep 16 01:16:34 2026 +0200
d/changelog: reference the siso bug that this unblocks
commit 0e35663819e2abc0fda6c4c59d6efd30170bf2ef
Merge: 79d31318b9 ac2d3b23b0
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Tue Sep 15 18:40:00 2026 +0200
Merge commit 'ac2d3b23' into debian/sid
commit 79d31318b9d722f68ed88edf164267bc0c513265
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Sep 14 21:16:39 2026 +0200
d/control: bump Breaks for prometheus and alertmanager
sdk/resource now uses semconv v1.43.0; prometheus 3.5.3+ds1-3 and
alertmanager 0.33.1-4 pin semconv v1.40.0 and fail tracer provider
setup with a conflicting schema URL.
commit f90e6610a94f5416c4b61d6d9ee04a93306f458f
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Sep 14 20:20:52 2026 +0200
d/changelog: mark as team upload
commit aea5518709986d9f8df2be90a63d87012dd309dd
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Sep 14 20:07:55 2026 +0200
New upstream version 1.46.0
- Merge the unreleased 1.44.0-1 entry (CVE-2026-45287, CVE-2026-41178)
- Drop 0001-Fix-import-comment.patch, applied upstream
commit c866a8fc5500dddd0ddabbbff8fff595d1a232a4
Merge: e406fbcf1e 4ae865da45
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Sep 14 20:06:30 2026 +0200
Update upstream source from tag 'upstream/1.46.0'
Update to upstream version '1.46.0'
with Debian dir 7a84c88a64d9fa5c64d2da5d6b5442170d1cdc42
commit 4ae865da45eb4cb08201d949500deb1e5b58bf4f
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Sep 14 20:06:30 2026 +0200
New upstream version 1.46.0
commit e406fbcf1e5ac367e2562721ef67920b2f20c113
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Sep 14 20:06:06 2026 +0200
d/watch: use GitHub refs API, ignore pre-releases and per-module tags
The GitHub tags page only shows the latest tags, which are flooded by
per-module tags (and release candidates), hiding the stable vX.Y.Z tags.
commit 7f2d2305ffc666f566d033609cfb1810b7174773
Author: Juan Manuel Mendez Rey <juan.mendezr@proton.me>
Date: Mon Jun 8 04:01:38 2026 +0200
New upstream version 1.44.0, fixing CVE-2026-45287 and CVE-2026-41178
- CVE-2026-45287: file descriptor leak in schema ParseFile (Closes: #1139168)
- CVE-2026-41178: DoS via oversized baggage headers (Closes: #1139167)
- Bump Breaks for prometheus-alertmanager-dev and prometheus-dev
due to semconv schema URL conflict (v1.40.0 vs v1.41.0)
commit f2f08fccf285458c61fb8fb14deb773f9c7ff82a
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Jun 8 04:09:44 2026 +0200
New upstream version 1.44.0
commit 485e8c9b6526776a637a0df8bf4d4c8dcad232b3
Merge: 252efa1f08 f2f08fccf2
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Mon Jun 8 04:09:44 2026 +0200
Update upstream source from tag 'upstream/1.44.0'
Update to upstream version '1.44.0'
with Debian dir d7fd5ec5ddadaced44b8fd11c19d1b5dbce7d352
There are 8 open security issues in trixie.
You can find information about how to handle these issues in the security team's documentation.