There are 24 open security issues in bullseye.
There are 13 open security issues in buster.
commit 37335b5b79ee35feb89c359d086d1c94f287b6bd
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 21:54:05 2026 +0100
d/c/defines: Exclude old compat links for adreno
The adreno driver stopped using these old names in Linux 4.15,
which is long out of support.
commit 4095dab91a108cf45948608d269fc602db4f216a
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 21:15:13 2026 +0100
d/b/check_upstream.py: Check for links not included in binary packages
Check for and report links listed in WHENCE that aren't included in
any binary packages, similarly to what we do for files.
The checks are a bit different, though:
- Since these links are only defined in WHENCE and created by
copy-firmware.sh, they aren't affected by debian/copyright's
Files-Excluded. So check that the link *target* is not excluded,
and also support a new config field in debian/config/defines for
symlinks we want to exclude. There are some compatibility links in
the top-level firmware directory that we probably shouldn't bother
adding.
- Check that the link target is a file listed in the same group.
Handling links to directories, or files in another group, would be
much more complicated to do correctly.
commit 0d366622ec1c6146cae6fd0b84f13780ab39c316
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 20:30:37 2026 +0100
check_upstream.py: Replace use of os.path with pathlib
commit 72063b342715fd4e49c59a64d293d6f71b918063
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 21:02:21 2026 +0100
d/b/check_upstream.py: Ignore file existence when checking license status
The tests for file existence here date from when firmware-nonfree was
a native package, or immediately after. They don't make sense now,
because whether a file will be copied from upstream into the source or
binary is determined by the exclusion and inclusion patterns that we
are already checking.
Rearrange the per-file checks so we first check whether the file will
be included in the source package, and never check whether the file is
currently present.
commit cca15a9ddcb30d69fed938390bd833509588e2d4
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 20:27:59 2026 +0100
d/b/check_upstream.py: Remove support for encoding file version in filename
Commit 658f5e733956 removed support in debian/bin/gencontrol.py for
extra or overriding files under debian/config that included a version
suffix in their filename. However check_upstream.py also supported
this, and doesn't need to any more. Remove that support.
commit febfc38e00dfc6c438bb7558e15a62f0521ed036
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 20:15:02 2026 +0100
debian_firmware.firmware: Parse Link fields and include in FirmwareGroup
commit 02acbd724a50e9242937f4156039f7b32e1ef38d
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 20:08:35 2026 +0100
debian_firmware.firmware: Use dataclasses to define Firmware{File,Group}
commit cb8e165e456e7041db7befcf501135c3e7d853f2
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 19:59:26 2026 +0100
Move Python debian_linux.firmware module into debian_firmware package
This is actually a copy rather than a move, since debian_linux is
supposed to be copied from src:linux. I will delete it from src:linux
later.
Update the one script that uses it.
commit e7005b4754c3c422da29d76e404872c81285e778
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 19:55:44 2026 +0100
Replace sys.path manipulation in debian/bin with symlink to debian_firmware
Use a symlink to the debian_firmware package under debian/bin, the
same way we do with the debian_linux package. Remove the
now-redundant change to sys.path in several scripts in debian/bin.
commit 19e296ab1dd00eb50ec3f2dab4fe68f5c0a21fc4
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 19:51:31 2026 +0100
Move Python config module into a debian_firmware package
commit 8a03038469b14694997e68a14f8f699aa38bf72b
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 18:43:33 2026 +0100
d/config: Simplify filename patterns ending in '**/*'
Following the fix to config.pattern_to_re, we can replace '**/*' with
the more obvious '**'.
commit 55bfc30a99c0528ad0d31a74f715fad265b6510f
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 18:40:56 2026 +0100
Change our filename pattern matching to handle '**' without following '/'
Our filename pattern matching is supposed to follow the behaviour of
glob.glob or pathlib.Path.glob. That means we should handle '**'
without a following '/' as matching all descendents. Currently
config.pattern_to_re effectively treats it as equivalent to '*'.
commit d3f536139b28fd44a15c96586b160e05ee8a9bfc
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 21:53:25 2026 +0100
misc-nonfree: Include more symlinks to tas2781 and tas2783 firmware
commit 695f8e8c0757932c32d888aada16a30c6b599268
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 18:54:01 2026 +0100
intel-graphics: Include ipu3-fw.bin symlink
Closes: #1126797
commit f77353b521839d630a8b993a1f89c42e67ba84e7
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 18:26:21 2026 +0100
misc-nonfree: Fix wildcard for TI audio firmware
With the current translation of globs to regexps, '**' without a
following '/' isn't treated specially and so the subdirectories of
ti/audio aren't actually being included. Add a '/*' so that they are
included.
This was a regression in 20251111-1.
commit be0ffc7f3be1edae3dfc48c2a4f64fc36c9673da
Merge: b0a47f5 a5d4dde
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 23:31:46 2026 +0100
Merge branch 'update-20260221' into 'debian/latest'
Update to 20260221
See merge request kernel-team/firmware-nonfree!139
commit a5d4dde0c24d32bd69401a3690c0595fcac3905d
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 19:42:24 2026 +0100
mediatek: Override lintian warnings for any firmware in ELF format
The lintian warnings we already override have also triggered on
the new file mediatek/mt8188/scp_c0.img. Change the overrides
to match all firmware files.
commit 6bc6b56d42ba94c8322d4de5e993a3ddac5b1bc4
Author: Ben Hutchings <benh@debian.org>
Date: Thu Feb 26 18:13:54 2026 +0100
Update to 20260221
- d/copyright: Delete exclusion of Intel BT fw files that are now symlinks
No other changes seem to be needed in d/copyright, as all new files
match existing patterns.
commit b0a47f5e51fdd7eb75738ea29cfc01ab53220634
Author: Ben Hutchings <benh@debian.org>
Date: Wed Feb 25 23:48:57 2026 +0100
CI: Update build jobs to work after another common pipeline change
pipieline commit bfa96b788547 "Don't rebuild source package in sbuild"
changed things around so that the packed source package is expected to
be generated in ${BUILD_DIR}. A new command in
.build-script-run-build-command moves it to the artifact directory
${WORKING_DIR} after building binary packages. Additionally it's
expected that the current directory at this point is a subdirectory of
${BUILD_DIR}.
Our build job always puts the source package in ${WORKING_DIR} before
including .build-script-run-build-command, so the second move fails.
It also keeps the current directory set to the Git working tree.
Change .local-build-script-extract-source to:
- Put the cached orig tarball, packed and unpacked source package in
${BUILD_DIR}
- Set current directory to the unpacked source package under
${BUILD_DIR}
Change the build job to:
- Make ${BUILD_DIR} owned by the build user
- Leave the sbuild command line unchanged
Change the 'build source' job to:
- Create ${BUILD_DIR} before .local-build-script-extract-source
- Move all the source artifacts into ${WORKING_DIR} afterwards
There is 1 open security issue in trixie.
You can find information about how to handle this issue in the security team's documentation.
Among the 4 debian patches available in version 20260110-1 of the package, we noticed the following issues:
There are 13 open security issues in bookworm.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/f/firmware-nonfree.png){kind=link}