Debian Package Tracker

general

source: mercurial (main)
version: 4.9-2
maintainer: Python Applications Packaging Team (archive) [DMD]
uploaders: Javi Merino [DMD] – Tristan Seligmann [DMD] – Vincent Danjean [DMD]
arch: all any
std-ver: 4.0.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 3.1.2-2+deb8u4
old-sec: 3.1.2-2+deb8u7
stable: 4.0-1+deb9u1
stable-sec: 4.0-1+deb9u1
testing: 4.8.2-1
unstable: 4.9-2

versioned links

3.1.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2-2+deb8u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2-2+deb8u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2-2+deb8u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.0-1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.8.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.8.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.9-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

mercurial
mercurial-common

action needed

Debci reports failed tests (log) high

Debci reports test failures (log).

The tests ran in 0h 0m 27s

Last run: 2019-05-17 20:43:17

Previous status: fail

Created: 2019-02-07 Last update: 2019-05-22 08:38

A new upstream version is available: 5.0 high

A new upstream version 5.0 is available, you should consider packaging it.

Created: 2019-03-20 Last update: 2019-05-22 03:06

6 security issues in stretch high

There are 6 open security issues in stretch.

6 important issues:

CVE-2018-1000132: Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
CVE-2018-13347: mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
CVE-2019-3902: A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
CVE-2018-13348: The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
CVE-2017-17458: In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
CVE-2018-13346: The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

Please fix them.

Created: 2017-12-08 Last update: 2019-05-01 06:01

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2019-3902: A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

Please fix it.

Created: 2019-04-19 Last update: 2019-05-01 06:01

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2019-02-19 Last update: 2019-05-22 08:43

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2019-04-04 Last update: 2019-05-22 08:33

Depends on packages which need a new maintainer normal

The packages that mercurial depends on which need a new maintainer are:

qct (#827169)
- Suggests: qct
mgdiff (#770236)
- Suggests: mgdiff

Created: 2017-12-02 Last update: 2019-05-22 07:16

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2019-01-05 Last update: 2019-05-22 03:22

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.9-3, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 80abed7c2b41509eab21dc250c019eba6e9678f9
Author: Julien Cristau <jcristau@debian.org>
Date:   Mon Feb 18 22:18:06 2019 +0100

    Add autopkgtests dependencies
    
    - subversion (for test-subrepo-svn.t, test-convert-svn-*.t)
    - gettext (for test-gendoc-*.t)
    - pylint (for test-check-pylint.t)
    - python-pygments (for test-highlight.t)
    - git (for test-convert-git.t, test-subrepo-git.t)
    - python-docutils (for test-gendoc.t)
    - sqlite3 (for test-wireproto-exchangev2-shallow.t, test-sqlitestore.t)
    - python-fuzzywuzzy (for test-releasenotes-*.t)
    - python-vcr (for test-phabricator.t)
    - darcs (for test-convert-darcs.t)

commit 15bd4ee63414e53f60a2b84fb2c4f94bca885f9f
Author: Julien Cristau <jcristau@debian.org>
Date:   Mon Feb 18 21:54:19 2019 +0100

    Drop autopkgtests dependency on monotone.
    
    It's RC buggy, not in buster, and uninstallable in sid (closes: #919924).
    Thanks, Graham Inggs!

Created: 2019-02-18 Last update: 2019-05-21 10:31

lintian reports 10 warnings normal

Lintian reports 10 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2019-03-16 Last update: 2019-03-16 05:36

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.3.0 instead of 4.0.0).

Created: 2017-06-30 Last update: 2019-02-09 01:11

testing migrations

excuses:
- 102 days old (5 needed)
- Updating mercurial fixes old bugs: #927674
- Piuparts tested OK - https://piuparts.debian.org/sid/source/m/mercurial.html
- Not touching package due to block request by freeze (please contact debian-release if update is needed)
- Not considered

news

[rss feed]

[2019-04-25] Accepted mercurial 3.1.2-2+deb8u7 (source all amd64) into oldstable (Chris Lamb)
[2019-02-08] Accepted mercurial 4.9-2 (source) into unstable (Julien Cristau)
[2019-02-06] Accepted mercurial 4.9-1 (source) into unstable (Julien Cristau)
[2019-01-25] Accepted mercurial 4.9~rc0-1 (source) into experimental (Julien Cristau)
[2019-01-10] mercurial 4.8.2-1 MIGRATED to testing (Debian testing watch)
[2019-01-08] Accepted mercurial 4.8.2-1 (source) into unstable (Julien Cristau)
[2019-01-07] Accepted mercurial 4.8.1-3 (source) into unstable (Julien Cristau)
[2018-12-21] mercurial 4.8.1-2 MIGRATED to testing (Debian testing watch)
[2018-12-12] Accepted mercurial 4.8.1-2 (source) into unstable (Julien Cristau)
[2018-12-11] Accepted mercurial 4.8.1-1 (source) into unstable (Julien Cristau)
[2018-11-20] Accepted mercurial 4.8-2 (source) into unstable (Julien Cristau)
[2018-11-20] Accepted mercurial 4.8-1 (source) into unstable (Julien Cristau)
[2018-10-07] mercurial 4.7.2-1 MIGRATED to testing (Debian testing watch)
[2018-10-04] Accepted mercurial 4.7.2-1 (source) into unstable (Julien Cristau)
[2018-09-07] mercurial 4.7.1-1 MIGRATED to testing (Debian testing watch)
[2018-09-04] Accepted mercurial 4.7.1-1 (source) into unstable (Julien Cristau)
[2018-08-10] mercurial 4.7-1 MIGRATED to testing (Debian testing watch)
[2018-08-08] Accepted mercurial 4.7-1 (source) into unstable (Julien Cristau)
[2018-07-27] Accepted mercurial 3.1.2-2+deb8u6 (source all amd64) into oldstable (Antoine Beaupré)
[2018-07-05] Accepted mercurial 3.1.2-2+deb8u5 (source all amd64) into oldstable (Antoine Beaupré)
[2018-06-19] mercurial 4.6.1-1 MIGRATED to testing (Debian testing watch)
[2018-06-08] Accepted mercurial 4.6.1-1 (source) into unstable (Julien Cristau)
[2018-05-15] mercurial 4.6-2 MIGRATED to testing (Debian testing watch)
[2018-05-12] Accepted mercurial 4.6-2 (source) into unstable (Julien Cristau)
[2018-05-11] Accepted mercurial 4.6-1 (source) into unstable (Julien Cristau)
[2018-04-11] mercurial 4.5.3-1 MIGRATED to testing (Debian testing watch)
[2018-04-10] mercurial 4.5.3-1 MIGRATED to testing (Debian testing watch)
[2018-04-05] Accepted mercurial 4.5.3-1 (source) into unstable (Julien Cristau)
[2018-03-30] Accepted mercurial 2.2.2-4+deb7u7 (source all amd64) into oldoldstable (Antoine Beaupré)
[2018-03-30] Accepted mercurial 2.2.2-4+deb7u7 (source all amd64) into oldoldstable (Antoine Beaupré)

bugs [bug history graph]

all: 23 24
RC: 0
I&N: 14 15
M&W: 8
F&P: 1
patch: 1

links

homepage
lintian (0, 10)
buildd: logs, clang, reproducibility, cross
popcon
debci
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.8.2-1ubuntu3
24 bugs
patches for 4.8.2-1ubuntu3