-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 07 Nov 2026 01:08:59 +0500
Source: python-scrapy
Architecture: source
Version: 2.19.0-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Andrey Rakhmatullin <wrar@debian.org>
Changes:
python-scrapy (2.19.0-3) unstable; urgency=medium
.
* Backport security fixes from the 2.20.0 release:
+ 0005-Unbounded-Content-Encoding-decompression-chain-allow.patch
(GHSA-j72p-v7rm-cwm3)
+ 0006-Redirects-to-no_proxy-hosts-sent-through-the-environ.patch
(GHSA-x3px-j3qh-fp5w)
+ 0007-Files-and-images-pipelines-send-S3-requests-over-pla.patch
(GHSA-fwm7-29m4-rrj9)
+ 0008-Only-send-http_user-http_pass-to-the-origin-they-wer.patch
(related to and a prereq for the next one)
+ 0009-Per-request-http_user-and-http_pass-credentials-leak.patch
(GHSA-466x-p45j-m4fx)
Checksums-Sha1:
a501ce62a948368e1eddaed54343c318c54a37ea 3904 python-scrapy_2.19.0-3.dsc
b876254d1eedc36f6bc32c5668d9e1ae360038d9 17512 python-scrapy_2.19.0-3.debian.tar.xz
feda4124625e90dae405522cfbb7969c52d3f753 13736 python-scrapy_2.19.0-3_amd64.buildinfo
Checksums-Sha256:
d583bc01e99956bd45e6576f831a0556a14ca17116460d950df4e1b8203cfc4f 3904 python-scrapy_2.19.0-3.dsc
f52feed0243d078638217016817053cfe416c731f17a59bbe511913bf0909585 17512 python-scrapy_2.19.0-3.debian.tar.xz
bc40bd4bce7fbd94df151490d6f7327baa793a4e2c12d1f309efa98026ad9947 13736 python-scrapy_2.19.0-3_amd64.buildinfo
Files:
c7e8f410fdf68685183868f6c1a1ccae 3904 python optional python-scrapy_2.19.0-3.dsc
5381ce1a5735ec97c0d969e916e59432 17512 python optional python-scrapy_2.19.0-3.debian.tar.xz
9563fceb01fa2e3569e18b39065c71fc 13736 python optional python-scrapy_2.19.0-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEolIP6gqGcKZh3YxVM2L3AxpJkuEFAmruOi8ACgkQM2L3AxpJ
kuFR0g/+PTeRErOybbsV9yjcRLNzs5QUs6wnTLR/yjOlcuukmdF6d6Exznsj+DX4
JRvS/bbCzN6Vp/gheOm16x2nQYQco7E22B2TMCQpCNLD1Hmz7fphhYeyLY/SNmME
hNk4LwyFAaCApZcIH+IFqKJyGQfYq5kQK1S4CJ10+q1sRAa4h78NZH25gdO9H6bb
9+EcsjKkKib7YcoN4UXIk9ySeXNeApA3bMCucdtC23DJHj4CXf7CWmwr/l9D/Sss
yY92wcK5yOihubHZZledTCXDFD+FgluO/sAJ1qK9fx0ERW/9MlwAXnPctya+juJ9
kb+Mdb6dobm+Vbvg0T6BGMnK2ZgG82bNk1QRTh876rE5yJyK/ptQDm/VUPKdXtyT
IuEypDnCOoxjWLelt0XVgHh64TFuUa7RhMWBZlvXWedPsjgbrHpI3qZEnuWtAm+N
ApmSwbIrCpY86j205q7xGvT/AuKchMDZEo/BjJUoqZbEq1umXIeIfrIv9KhkATeW
ICFLQ+BzF/GAYt/h72LVnmKPNTs6E4iACznKT5hSr8axB8aDtdbPAkSxQP8jLYbk
erHNfh5IgXFZgMpXT6LfRHjv6IAB22KO8Qr39OmXqSWkKdtaKmXJHCmoLg3zp4iC
bUCqpdpBrLy862yM/ljNGDibjjZRh4uv4N78b585H3M1MRWLuaE=
=nFpK
-----END PGP SIGNATURE-----
