-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 26 Oct 2026 00:21:19 +0100 Source: starman Architecture: source Version: 0.4019-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1152054 Changes: starman (0.4019-1) unstable; urgency=medium . * Team upload. * Import upstream version 0.4019. - Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) - Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) - Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) - Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Closes: #1152054 * Mention behaviour changes in debian/NEWS.Developer. * Update test dependencies. * Convert debian/watch to version 5. Checksums-Sha1: eb625ffa40192b369c2f49c3a9ccce39eb9859b0 2580 starman_0.4019-1.dsc 8f8e18d4e275df8641256a3516069dcb7060d2d7 45120 starman_0.4019.orig.tar.gz 1623e3eaade4859cd347b976c27fb6ef5105a7a7 4808 starman_0.4019-1.debian.tar.xz 9d20d9380ee2174f00978bccb8a0981812f3cebb 105876 starman_0.4019-1.git.tar.xz 075ca65d25cedaf8ca743d3160ed10aaf7f963e0 17736 starman_0.4019-1_source.buildinfo Checksums-Sha256: 68b4e7a3acace09ba89ed5de95338a3e7f8d1eae04cf8484b6a1edb07803041f 2580 starman_0.4019-1.dsc 4a33f20a6a3250938fc85e21779e34c56e156895fe4a8fa8c83ac4e96ecaef61 45120 starman_0.4019.orig.tar.gz 4503e0b720a6ba6e73134a92b7dd5b8e795bfbdc627cc956f95ea724193501e5 4808 starman_0.4019-1.debian.tar.xz a5da90b7dbdc0935a99cef1c467f0794293237a118f1e6d976c6abf601f2742e 105876 starman_0.4019-1.git.tar.xz 7f4c1308d5c4c5ef89a601ffe3c7c0d34d8271f426cfa2630d9c37dde2a81f5e 17736 starman_0.4019-1_source.buildinfo Files: 68afdfa5ce6cad728f37790a748f3c2c 2580 perl optional starman_0.4019-1.dsc b172f13b7c20b46e1499b07a91b69e4e 45120 perl optional starman_0.4019.orig.tar.gz 1e36d2b2ff9d5b20b35bcf18e662b2ba 4808 perl optional starman_0.4019-1.debian.tar.xz 211930932dfeab1beb41a71943027d37 105876 perl None starman_0.4019-1.git.tar.xz a52615d1040124e4a7453a37967212d7 17736 perl optional starman_0.4019-1_source.buildinfo Git-Tag-Info: tag=4a247424f4d0e3ca2abb34f4560f29dc483b78b9 fp=d1e1316e93a760a8104d85fabb3a68018649aa06 Git-Tag-Tagger: gregor herrmann <gregoa@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrekA4ACgkQYG0ITkaD wHmNChAA7dFs8pa0yUnWFQpYfJnEJMJ9BbIoCrZNEXA1tpyuaerRpBaIHr6KzcVj BzzWoI0NhOX5jzFkeq9YAubR+GwBdakQzsdYHQ7m1ZASaJYMtVnrE5naAAxhO4nC HUH0fVhM+ppJIiuXm17AvHddHYYm9Q5onQgB6IOf2qGlYcWqEaCH2R742x3fhZ5+ hdgEPP8r6p+eveLgU1mV0kir0VFaxGInuQ5lIXJVCUecYH0KPOqCotuNo4TGD+hI 7mJUUX/6nN4+Js0ru/NHiaFN1BQy5RxGEoUMWsUlOJCzapsNxVNqaWo22bM75iAG Fp8kHYwRK5cmOFIYJTr+vbx6SjSNnlhEzj8OHedDFNExF5v2FEJnZXfEEg8TFP6l PGFHe8Cbc9OdCcbh70RYqa/aqhBRTEr4M2Sqp+E/otdz9EIh5cIkBPrev7YZbQGd EXq6pCb9o3HsDo1fEJ4SsZ4jeRQONpqb154fdyYRs7ZQDF8ZNLjvUBQbG+w1DfGC QM8y8xvAn1Eu6ZE/1wc4lUhaps5zteZl9U+bkpGbhqMbhmLtYsLg7xOQwgZUundq av7rQSDlTNbscYWQYo2s2k4pZeyoRIzp1GXfnus8O7Wmxp3U0D2fFbkktg2W3e/g EbqoMh3vgRrwSp6vIXuI0AxX3F21hg6L2RGn1EhqECIIb0YfIFs= =/Scf -----END PGP SIGNATURE-----
