-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 20 Oct 2026 20:33:14 +0200 Source: git-lfs Architecture: source Version: 3.3.0-1+deb12u2 Distribution: bookworm-security Urgency: high Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org> Changed-By: Sylvain Beucler <beuc@debian.org> Changes: git-lfs (3.3.0-1+deb12u2) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2025-26625: when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. * Fix test for CVE 2024-53263 in previous upload. * gbp.conf: update Debian branch. * Salsa-CI: enable. * autopkgtest: run integration tests (imported from sid). Checksums-Sha1: ac8dd7f0f204890a09fce615da13cc304f398cfe 2770 git-lfs_3.3.0-1+deb12u2.dsc 255d1474c437684d1fcb59e03ea549c2ec98ac97 656080 git-lfs_3.3.0.orig.tar.gz 9811add976d057335b3ef44c39bef98ae943c699 43660 git-lfs_3.3.0-1+deb12u2.debian.tar.xz 2c6655e0c43a89e00242063be02ed1463faf7f0e 10195 git-lfs_3.3.0-1+deb12u2_source.buildinfo Checksums-Sha256: f2d3079efae12523b7cb14428cd12fc7fc92dbaff1426239620d6fcb76958960 2770 git-lfs_3.3.0-1+deb12u2.dsc d5eeb9ee33188d3dd6a391f8a39b96d271f10295129789e5b3a1ac0e9f5114f5 656080 git-lfs_3.3.0.orig.tar.gz bda1a30f4b32f1b3149d0c2ac2ab5db15c347f4af986c774c3f67dcf3245867d 43660 git-lfs_3.3.0-1+deb12u2.debian.tar.xz dee4ed31019736b10ce582b5f1546dcc1e1cdf0dc997aa6da1965b7953721ae8 10195 git-lfs_3.3.0-1+deb12u2_source.buildinfo Files: 95e1ed4e2e83422d4aa5111bf7b17beb 2770 vcs optional git-lfs_3.3.0-1+deb12u2.dsc 8cc2526bc455f8185e58cd0380bf9b31 656080 vcs optional git-lfs_3.3.0.orig.tar.gz 23c8879a62f35386364b7b2c9c6198f3 43660 vcs optional git-lfs_3.3.0-1+deb12u2.debian.tar.xz 3b9054cb641b88844a0b470e2d0733c6 10195 vcs optional git-lfs_3.3.0-1+deb12u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmrYabkACgkQDTl9HeUl XjCj3A//ZDewDYkSEEnJGvgKThDHhImkKiISmfHFW4M/Lf46b8l7OSnRQtxuytqw Y2zKzm2RHgeSB/iDchomLm657K7QGySkn3tMa6jPKnjxMZpQxKezaXC9ezxCjtkc Z90RnRwCOnNcFoa7M3jCEpMZWgKEAaKY7GVqj8nc8J72hx2XK824w5H2rwAR0r8/ IDvZ0rbmmb1YyNcZcoXKUq/3vFYL4Q2vrD0yOGB8P79xfedl48wm8+GfE9hQ8UIB 9+FqMlHomy6KbqZXsees58NXyLcqsydURaQ/RxlOJNs+mYZS2jpmcPI6aGr8KeZA 44nlkeBH+muQN8mNVarOHISMbHbRIlRzTbNaffKkmWqfr/tbxo4+uIj/kkSARIs8 XxL20cP7LWJ+paaTDrfKZem+Z/EVCHmaXvAJHbDXbCSGLn8PMr5eCsfrS1sO0FvJ 7KY5MW7my+QV9A1S7wEdAsuY6AgzGe1byzccTnsIaNp07B8xmShUhjg4rIMCtHrQ MxqifhbQBOpaTwgxlLaaVC5uYcc1bMpB0GCg64U+2njdShlUoqtZaaUvwSnuqamf URgrffai/80wW/acO0mmmRU2OO/mrdgUnxRd1/F5djxg/GSrUDMTQNLfTbSVe0Jp hNGWo7EfWkl/atT81r17rvBTwmRKrDtlOZpJmwiaA8GCE3znEzU= =i+56 -----END PGP SIGNATURE-----
