-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 22 Oct 2026 02:22:40 +0200 Source: rclone Architecture: source Version: 1.75.2-2 Distribution: unstable Urgency: medium Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org> Changed-By: Drew Parsons <dparsons@debian.org> Closes: 1134470 1134734 1134735 1135744 1140817 1142269 1143842 1145670 1147404 1148669 1150418 1150968 Changes: rclone (1.75.2-2) unstable; urgency=medium . * Team upload. * drop deprecated Depends: golang-github-artyom-mtab-dev * update 0018-Disable-unsupported-backends-and-commands-in-Debian.patch to reinstate supported backends: compress, dropbox, iclouddrive, mega - Depends: golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0~) * drop deprecated patches 0019-Disable-extsort-and-adjust-go-ordered-map-import.patch 0020-Disable-IBM-Cloud-IAM-authenticator.patch * disable_backend_archive_no_diskfs.patch and disable_backend_internxt.patch are merged into 0018-Disable-unsupported-backends-and-commands-in-Debian.patch * new release updates pcloud support. Closes: #1134470 * golang-github-rclone-proton-api-bridge-dev replaces golang-github-henrybear327-proton-api-bridge-dev supporting Proton Drive. Closes: #1135744 . rclone (1.75.2-1) unstable; urgency=medium . * Team upload. * Fixes security vulnerabilities: - CVE-2026-41176 (Closes: #1134734) - CVE-2026-41179 (Closes: #1134735) - CVE-2026-49980 (Closes: #1140817) - CVE-2026-54572, CVE-2026-59732, CVE-2026-59733 (Closes: #1142269) - CVE-2026-71309, CVE-2026-71310, CVE-2026-71311, CVE-2026-71312, CVE-2026-71313 (Closes: #1143842) - CVE-2026-79775, CVE-2026-79776, CVE-2026-79777, CVE-2026-79778, CVE-2026-79779, CVE-2026-79780, CVE-2026-79781, CVE-2026-79782, CVE-2026-79783 (Closes: #1145670) - CVE-2026-88013, CVE-2026-88014, CVE-2026-88015, CVE-2026-88016, CVE-2026-88017, CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88046 (Closes: #1147404) - CVE-2026-93986, CVE-2026-93987 (Closes: #1148669) * Refresh patches against upstream 1.75.2. * dlna: use slog.Default() for ssdp.Server.Logger (Closes: #1150968). * debian/control: - Add golang-github-wk8-go-ordered-map-dev to Build-Depends and Depends. - Replace obsolete golang-gopkg-yaml.v2-dev with golang-gopkg-yaml.v3-dev. - Drop obsolete golang-github-anacrolix-log-dev. * Disable backends with dependencies not yet updated/available in Debian: - backend/dropbox: disabled because it requires golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0) with ContextClient support (Debian currently has 6.0.5). - backend/mega: disabled because it requires golang-github-t3rm1n4l-go-mega-dev updated to commit c6acd6a5bd04 or newer for LoginWithKeys and session export APIs. - backend/compress: disabled due to unpackaged zstd-seekable-format-go. - backend/archive, backend/filen, backend/internxt, backend/protondrive, cmd/archive, cmd/serve/nfs, cmd/serve/s3: disabled due to unpackaged dependencies. - dropbox and mega backends, drop unused log in dlna * debian/rules: expand DH_GOLANG_EXCLUDES to include all disabled backends. * d/changelog, d/watch, d/copyright: drop +dfsg suffix for 1.75.2-1 * d/rules, d/changelog: fix lintian warnings for nproc, changelog line length, and privacy breaches * debian/patches: amend FTP patch to drop cmd/all import, renumber and DEP-3 hygiene * d/control, d/changelog: replace obsolete yaml.v2 with yaml.v3, drop anacrolix-log * debian/patches: consolidate and fold backend/dlna patches via gbp pq * debian/control: upgrade debhelper-compat to 14 . rclone (1.74.3-1) experimental; urgency=medium . * Team upload. . [ Drew Parsons ] * New upstream version 1.74.3 - fixes RC authentication [CVE-2026-41176][CVE-2026-41179] Closes: #1134734, #1134735 - fixes authentication vulnerability [CVE-2026-49980]. Closes: #1140817 * README.Debian documents backends, commands and other features disabled in the debian build since dependencies are not (yet) packaged for Debian. * update patches disabling features due to missing dependencies - disable_backend_archive_no_diskfs.patch: disables the new archive (squashfs) backend (requires diskfs) - disable_backend_internxt.patch: internxt backend requres internxt/rclone-adapter - update disable_backend_file.patch to disable filen backend (requires FilenCloudDienste/filen-sdk-go) - serve_dlna_slog.patch uses slog instead of anacrolix/log with serve/dlna (for anacrolix/dms 1.8.0). See upstream commit 8a91f15. * drop Files-Excluded from debian/copyright and Repack from debian/watch * update Dependencies against current go.mod - new Depends: golang-github-adrg-xdg-dev golang-github-a1ex3-zstd-seekable-format-go-dev golang-github-golang-jwt-jwt-v5-dev (>= 5.3.1~) golang-github-ibm-go-sdk-core-v5-dev golang-github-lanrat-extsort-dev golang-github-mattn-go-runewidth-dev golang-github-mholt-archives-dev golang-github-minio-minio-go-v7-dev golang-github-muesli-reflow-dev golang-github-peterh-liner-dev golang-github-pmezard-go-difflib-dev golang-github-prometheus-client-golang-dev golang-github-rclone-go-proton-api-dev golang-github-rclone-proton-api-bridge-dev golang-github-rivo-uniseg-dev golang-github-rogpeppe-go-internal-dev golang-github-wk8-go-ordered-map-dev golang-github-zeebo-blake3-dev golang-github-zeebo-xxh3-dev golang-golang-x-oauth2-dev golang-golang-x-sync-dev golang-gopkg-natefinch-lumberjack.v2-dev golang-gopkg-yaml.v3-dev golang-github-moul-http2curl-dev golang-github-protonmail-go-crypto-dev golang-github-pkg-xattr-dev golang-github-pquerna-otp-dev golang-golang-x-mobile-dev golang-golang-x-term-dev - update versioned Dependencies: golang-github-aalpar-deheap-dev (>= 1.1.2~) golang-github-anacrolix-dms-dev (>= 1.7.2~) golang-github-anacrolix-log-dev (>= 0.17.0~) golang-github-atotto-clipboard-dev (>= 0.1.4~) golang-github-aws-aws-sdk-go-v2-dev (>= 1.41.5~) golang-github-cloudsoda-go-smb2-dev (>= 0.0~20250228.d4c70e6~) golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.0.5~) golang-github-go-chi-chi-dev (>= 5.2.5~) golang-github-hanwen-go-fuse-dev (>= 2.9.0~) golang-github-klauspost-compress-dev (>= 1.18.5~) golang-github-mattn-go-colorable-dev (>= 0.1.14~) golang-github-ncw-swift-v2-dev (>= 2.0.5~) golang-github-pkg-sftp-dev (>= 1.13.10~) golang-github-rfjakob-eme-dev (>= 1.2.0~) golang-github-shirou-gopsutil-dev (>= 4.26.3~) golang-github-spf13-cobra-dev (>= 1.10.2~) golang-github-spf13-pflag-dev (>= 1.0.10~) golang-github-stretchr-testify-dev (>= 1.11.1~) golang-github-t3rm1n4l-go-mega-dev (>= 0.0~git20251120.6845944~) golang-golang-x-text-dev (>= 0.37.0~) golang-google-api-dev (>= 0.275.0~) golang-github-golang-jwt-jwt-dev (>= 5.0.0+really4.5.2~) - removed Dependencies no longer required golang-github-djherbis-times-dev golang-github-henrybear327-go-proton-api-dev golang-github-henrybear327-proton-api-bridge-dev golang-github-hirochachacha-go-smb2-dev golang-github-iguanesolutions-go-systemd-dev golang-github-go-chi-chi-dev golang-github-ncw-go-acd-dev golang-github-nsf-termbox-go-dev golang-github-okzk-sdnotify-dev golang-github-pkg-errors-dev golang-github-pkg-sftp-dev golang-github-pkg-xattr-dev golang-github-protonmail-go-crypto-dev golang-github-rclone-ftp-dev golang-github-sevlyar-go-daemon-dev golang-github-sirupsen-logrus-dev golang-golang-x-oauth2-google-dev golang-gopkg-yaml.v2-dev * update Depends: golang-bazil-fuse-dev (>= 0.0~git20230120.62a210f~) Closes: #1150418 * update DH_GOLANG_INSTALL_EXTRA installing extra files required during build * enable iclouddrive backend: remove iclouddrive skips in disable_backend_file.patch . [ Marcos Talau ] * debian/salsa-ci.yml: Add to provide CI tests for Salsa * Enable Salsa CI using default template Checksums-Sha1: 71df31c0ff87c5c2249311297653e77477815f1d 5507 rclone_1.75.2-2.dsc b205fd5072c7fe68f06a58cad150b0cd22a64e0e 27984 rclone_1.75.2-2.debian.tar.xz bc4d08702e89ecf4460d8f12ed3b519c556d4e32 27302 rclone_1.75.2-2_amd64.buildinfo Checksums-Sha256: 2f70f4ed51dbd20bc8772b1621a2b0bac760cea032b531c38c91d3883dd34670 5507 rclone_1.75.2-2.dsc 5c45ec7749cbd921cefbeaff2cc86e779afd0df92f05539adea95b8ad30afb61 27984 rclone_1.75.2-2.debian.tar.xz eef476407cb26d3a92bb25992087a3faa2a51a945afe6d950e719615ab7056ef 27302 rclone_1.75.2-2_amd64.buildinfo Files: 735dbf44246caccf46af936a76fda4e8 5507 net optional rclone_1.75.2-2.dsc c5f89030d94fbda8a2ff3f348abe2c91 27984 net optional rclone_1.75.2-2.debian.tar.xz 4aae5205fa8ae7e5fb32bd49b59d8599 27302 net optional rclone_1.75.2-2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEI8mpPlhYGekSbQo2Vz7x5L1aAfoFAmrZYzsACgkQVz7x5L1a AfqmSw/+Jzt1tTuFRR5mQ4W6nH+E+AadrhKZCbY2IynyUkDzAtGSSkkaF2nqhlGh Vize2Cp9HEdeFpQFSZ5wn77TGvXMD3CST8MJgx5OKKiniqDNPthTUVMsk5OwWAYo ml5C0WFTxWkJPLg4gqz0/LqsfUoC20T5C4CBM3OQLBzXTC+3S7JmOtV71sGwOM9O DwfPjiQ29g0f+urhIdU67aU3Ik8BHMdXOjIApghCncXHJG8kAwzPx4wouunfiZpk YjBiix4cyfEL4kcqCo3KdvnBPFLfZaGeBPo2qcbARyGXpXK4eUQuWBtKyEiGacJs 8rbN9zukoocjwuLzcTihzXjqPhhKdmL5YW9vWVoXBmLKbxqgJp3uOcCyxzMBuNsg j6NinbAELNh891OX559lcqJ+6ThZX8BFzcW36c/O1Q7eNceJftjTWtvBpmvll+EU jezJrCcd6dcZ/rmHFPyjOoiTxQZ0BCyGTPWmksO3bWdKTg/isdH1rVMadB08a/bF v1umw3udYgrm/+7d+zPtuWSD0lbvjge86AEOfvMYByn480cfUutf3S1jxReUf0aK w+h7kEglz5fkNnRx7PncBGh71dZP3HVktCJ7VP4Q8LSHBPwVzrWB7ClX3ok6bq0u 8UUiFeVIBPsZfaDTVipwD7uWT28UUTx+ncWIRbjzW2Byfy9KJEw= =6v+V -----END PGP SIGNATURE-----
