-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 04 Nov 2026 21:56:03 +0100 Source: jgit Architecture: source Version: 7.7.1-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1106287 1132766 Changes: jgit (7.7.1-1) unstable; urgency=medium . * Team upload * New upstream version 7.7.1: - Now supports option gpg.format = ssh (Closes: #1132766) - Fixes CVE-2025-4949: In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues. (Closes: #1106287) * Refreshing patches * Raising Standards version to 4.7.4: - Removing Priority: optional, which is now defaults - Removing R-R-R: no, which is now defaults * Switching to debhelper-compat 14, removing misc:Depends substvar * Raising d/watch version to 5 * Removing unneeded versioned B-D * Set upstream metadata fields: Repository, Repository-Browse. * Changing names of packages of servlet-api * Updating Maven rules and ignoreRules * Adding B-D on libjackson2-core-java * Adding versioned B-D on libmina-sshd-java * Refreshing the list of POM files * Specifying a HOME directory under /tmp for groovy in d/rules Checksums-Sha1: 1af4cca9cfcf65de9c2bf302f66edb744bdc9bc5 2568 jgit_7.7.1-1.dsc 3e82dc789f5e1ef9018f2f150fa8ae1442420b30 8467627 jgit_7.7.1.orig.tar.gz aaad1d91c9c7dc57a8e4d66f5ae54610bb466b8d 14288 jgit_7.7.1-1.debian.tar.xz 8fd8d3ff3d369b2a4a95b6376e9604d13ec0d0a0 22081 jgit_7.7.1-1_amd64.buildinfo Checksums-Sha256: c9b7b3bab00cb4f278c20a362bd747dc08e5b6adb602c3170340f91969095c2c 2568 jgit_7.7.1-1.dsc 2d606b6b760808fea3eabfcc280690a879e6a38a7bf27e6f2dc8d64e2f52c4ba 8467627 jgit_7.7.1.orig.tar.gz 847020bc4d183a5d05479944c3c662bfe31a4dabac9fca682e0a60efa288b7b9 14288 jgit_7.7.1-1.debian.tar.xz 5ceb35251a27c6403a76e884941ac8e781a93a246edac7b5fff7a7cd3e904289 22081 jgit_7.7.1-1_amd64.buildinfo Files: 6f4bda7720cf9942d27617a76b523c7d 2568 java optional jgit_7.7.1-1.dsc 3d618daa263c0a947f09330b16348b01 8467627 java optional jgit_7.7.1.orig.tar.gz 1bda941be6692e0224cc2c5d10080a1a 14288 java optional jgit_7.7.1-1.debian.tar.xz 8951159e14f657da34060e97f211eb9d 22081 java optional jgit_7.7.1-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrqqIACgkQYAMWptwn dHYRohAAgC/AGuk6RTWNOJMFA6oDJGHY7nBSUmA62miOF0OrkSuy4UR2viwhnFVk jtoUmGllwNYhXF7LYcUeJlZl3nVhPQCDTBG2yOHvC++uIknh2uptTpf0CJrUH9Rw 5w0XQEXiIJdHeW/0DlE2jY+9HL1dQt2AK36qaD7osDGPG4gP2E04kxkHXKl9roFc J9EOYRSPc5lz7eTuDoG/vFxu4qMiiBoEM59ukKJa4W75miqqAPaHR3c6IZ5Rr/aW EnR66dRrK8CxILjUcLAxtiQQusTyQKZLs/fGUCPmfCo17gqLoT/Vo7kLe5JLjGly e+rXCjO7Rh6IAWkuUYYR+qmcppMrzHypVZnyqzy9D6bCatRcjsnAR0tuQAZIgZgH /Br9pdiK9TEXW/oNBjq0VgHZNSR98aa3Ht25dy3K/hyScqZQsaCKBaa4/H7x3KjU 5+2AnoADI+A5SzLeKUvTHU1YuiGa7A6gCGI1xUtuKLFM7gg58JoXcbIw2rU4kmyI BmbAJehhM/mcegK+OEzme7QEmPTB51EszjD+gK9zSEoYGXgCZX3WAwLFHCaMYGCl 9SWV+8PzT7eTTVK9TAMz+yjZ8IE2GfsS/H84yaCQWDBNOdhNHhAb+KRmAtkxZvT+ 36rAkUesc1dfnlfP2jHrGbkUbOvHWMPMt350PlOXupOjmpFkptM= =FydG -----END PGP SIGNATURE-----
