openrefine - Debian Package Tracker

general

source: openrefine (main)
version: 3.9.5-2
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Markus Koschany [DMD]
arch: all
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 3.6.2-2+deb12u3
stable: 3.8.7-1
unstable: 3.9.5-2

versioned links

3.6.2-2+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.8.7-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.9.5-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

openrefine (2 bugs: 0, 2, 0, 0)

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://github.com/OpenRefine/OpenRefine/tags failed: 500 Header line too long (limit is 8192)

Created: 2026-10-24 Last update: 2026-10-26 23:30

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-108553: OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

Created: 2026-10-10 Last update: 2026-10-16 18:30

2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:

CVE-2026-108553: OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

1 issue postponed or untriaged:

CVE-2024-47879: (needs triaging) OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains at least one row, and the attacker must convince the victim to open a malicious webpage. Version 3.8.3 fixes the issue.

Created: 2026-10-10 Last update: 2026-10-16 18:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-07-16 Last update: 2026-10-26 22:50

lintian reports 333 warnings normal

Lintian reports 333 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-01-21 Last update: 2026-01-21 16:32

AppStream hints: 1 warning normal

AppStream found metadata issues for packages:

openrefine: 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2022-02-21 Last update: 2022-02-21 05:33

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-108553: (needs triaging) OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-10-10 Last update: 2026-10-16 18:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

testing migrations

excuses:
- Migration status: Blocked. Can't migrate due to a non-migratable dependency. Check status below.
- Blocked by: libowasp-encoder-java
- Migration status for openrefine (- to 3.9.5-2): BLOCKED: Cannot migrate due to another item, which is blocked (please check which dependencies are stuck)
- Issues preventing migration:
- ∙ ∙ Build-Depends(-Arch): openrefine libowasp-encoder-java (not considered)
- ∙ ∙ Depends: openrefine libowasp-encoder-java (not considered)
- ∙ ∙ Invalidated by build-dependency
- ∙ ∙ Invalidated by dependency
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/o/openrefine.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 279 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-07-17] openrefine REMOVED from testing (Debian testing watch)
[2026-01-26] openrefine 3.9.5-2 MIGRATED to testing (Debian testing watch)
[2026-01-20] Accepted openrefine 3.9.5-2 (source) into unstable (Markus Koschany)
[2025-10-19] Accepted openrefine 3.6.2-2+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2025-10-04] openrefine 3.8.7-2 MIGRATED to testing (Debian testing watch)
[2025-09-27] Accepted openrefine 3.9.5-1 (source) into experimental (Markus Koschany)
[2025-09-27] Accepted openrefine 3.8.7-2 (source) into unstable (Markus Koschany)
[2025-05-25] Accepted openrefine 3.9.3-1 (source) into experimental (Markus Koschany)
[2025-01-09] openrefine 3.8.7-1 MIGRATED to testing (Debian testing watch)
[2025-01-03] Accepted openrefine 3.8.7-1 (source) into unstable (Markus Koschany)
[2024-11-25] openrefine REMOVED from testing (Debian testing watch)
[2024-04-12] openrefine 3.7.8-1 MIGRATED to testing (Debian testing watch)
[2024-04-06] Accepted openrefine 3.7.8-1 (source) into unstable (Markus Koschany)
[2024-03-19] openrefine REMOVED from testing (Debian testing watch)
[2023-12-08] openrefine 3.7.7-1 MIGRATED to testing (Debian testing watch)
[2023-12-03] Accepted openrefine 3.7.7-1 (source) into unstable (Markus Koschany)
[2023-12-03] openrefine REMOVED from testing (Debian testing watch)
[2023-10-23] openrefine 3.7.6-1 MIGRATED to testing (Debian testing watch)
[2023-10-17] Accepted openrefine 3.7.6-1 (source) into unstable (Markus Koschany)
[2023-10-09] Accepted openrefine 3.6.2-2~bpo11+2 (source) into bullseye-backports (Debian FTP Masters) (signed by: Markus Koschany)
[2023-10-07] Accepted openrefine 3.6.2-2+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2023-10-02] Accepted openrefine 3.6.2-2~bpo11+1 (source) into bullseye-backports (Debian FTP Masters) (signed by: Markus Koschany)
[2023-09-20] openrefine 3.7.5-1 MIGRATED to testing (Debian testing watch)
[2023-09-15] Accepted openrefine 3.7.5-1 (source) into unstable (Markus Koschany)
[2023-09-13] openrefine 3.7.4-1 MIGRATED to testing (Debian testing watch)
[2023-09-09] Accepted openrefine 3.6.2-2+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2023-09-08] Accepted openrefine 3.7.4-1 (source) into unstable (Markus Koschany)
[2023-08-23] openrefine 3.6.2-3 MIGRATED to testing (Debian testing watch)
[2023-08-18] Accepted openrefine 3.6.2-3 (source) into unstable (Markus Koschany)
[2023-04-26] openrefine 3.6.2-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 5
RC: 0
I&N: 3
M&W: 2
F&P: 0
patch: 0

links

homepage
lintian (0, 333)
buildd: logs
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.9.5-2build1