prosody - Debian Package Tracker

general

source: prosody (main)
version: 13.0.5-1
maintainer: Debian XMPP Maintainers (archive) (DMD)
uploaders: Sergei Golovan [DMD] – Matthew James Wild [DMD] – Victor Seva [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.11.9-2+deb11u2
o-o-sec: 0.11.9-2+deb11u2
oldstable: 0.12.3-1
old-sec: 0.12.3-1+deb12u1
old-bpo: 13.0.1-1~bpo12+1
old-p-u: 0.12.3-1+deb12u1
stable: 13.0.1-1
stable-sec: 13.0.1-1+deb131u
stable-bpo: 13.0.5-1~bpo13+1
stable-p-u: 13.0.1-1+deb131u
testing: 13.0.5-1
unstable: 13.0.5-1

versioned links

0.11.9-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.12.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.12.3-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.1-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.1-1+deb131u: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.4-2~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.5-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.5-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

prosody (10 bugs: 0, 6, 4, 0)

action needed

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2026-43504: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43505: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43506: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.
CVE-2026-43507: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.

Created: 2026-05-01 Last update: 2026-05-07 21:00

4 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 590c16ae83ac95eba51663d6080779446dd8e109
Merge: b7cfe87 fbd199a
Author: Victor Seva <vseva@debian.org>
Date:   Mon May 11 12:24:42 2026 +0200

    Merge branch 'sysusers' into 'debian/master'
    
    Install and use sysusers.d/tmpfiles.d config files
    
    See merge request xmpp-team/prosody!1

commit fbd199ae4074ec844a5edb8dc04ac54a5b1d54ff
Author: Luca Boccassi <luca.boccassi@gmail.com>
Date:   Sat May 2 16:14:10 2026 +0100

    Drop obsolete workarounds
    
    These workarounds were added in version 0.8.2-2 which is 14 years
    old, and are no longer necessary since Wheezy (debian 7), so drop
    them

commit f50a61a638907326a810305c26b680cd29f00659
Author: Luca Boccassi <luca.boccassi@gmail.com>
Date:   Sat May 2 16:11:23 2026 +0100

    Install and use sysusers.d/tmpfiles.d config files
    
    sysusers.d/tmpfiles.d config files allow a package to use
    declarative configuration instead of manually written
    maintainer scripts. This also allows image-based systems to
    be created with /usr/ only, and also allows for factory
    resetting a system and recreating /etc/ on boot.
    
    https://www.freedesktop.org/software/systemd/man/latest/sysusers.d.html

commit 6015a392777d3aca4934cc7878cde50428b97103
Author: Luca Boccassi <luca.boccassi@gmail.com>
Date:   Sat May 2 16:10:11 2026 +0100

    Stop deleting system user on remove/purge
    
    This is widely considered bad practice, as the kernel recycles
    UIDs/GIDs. So any potential leftover file/directory can then
    become owned by the next user/group that gets added, with
    unpredictable consequences.

Created: 2026-05-11 Last update: 2026-05-11 12:31

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-03 Last update: 2026-03-18 14:01

debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 13.0.5-1 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-05-01 22:02

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-05-11] Accepted prosody 13.0.5-1~bpo13+1 (source amd64) into stable-backports (Victor Seva)
[2026-05-08] Accepted prosody 0.12.3-1+deb12u1 (source amd64) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Victor Seva)
[2026-05-08] Accepted prosody 13.0.1-1+deb131u (source amd64) into proposed-updates (Debian FTP Masters) (signed by: Victor Seva)
[2026-05-07] Accepted prosody 0.12.3-1+deb12u1 (source amd64) into oldstable-security (Debian FTP Masters) (signed by: Victor Seva)
[2026-05-07] Accepted prosody 13.0.1-1+deb131u (source amd64) into stable-security (Debian FTP Masters) (signed by: Victor Seva)
[2026-05-07] prosody 13.0.5-1 MIGRATED to testing (Debian testing watch)
[2026-05-01] Accepted prosody 13.0.5-1 (source) into unstable (Victor Seva)
[2026-03-08] Accepted prosody 13.0.4-2~bpo13+1 (source amd64) into stable-backports (Debian FTP Masters) (signed by: Martin)
[2026-02-12] prosody 13.0.4-2 MIGRATED to testing (Debian testing watch)
[2026-02-06] Accepted prosody 13.0.4-2 (source) into unstable (Victor Seva)
[2026-01-26] Accepted prosody 13.0.4-1 (source) into unstable (Victor Seva)
[2026-01-13] Accepted prosody 13.0.3-1 (source) into unstable (Victor Seva)
[2025-09-10] prosody 13.0.2-1 MIGRATED to testing (Debian testing watch)
[2025-09-03] Accepted prosody 13.0.2-1 (source) into unstable (Victor Seva)
[2025-04-09] Accepted prosody 13.0.1-1~bpo12+1 (source) into stable-backports (Martin)
[2025-04-09] prosody 13.0.1-1 MIGRATED to testing (Debian testing watch)
[2025-04-04] Accepted prosody 13.0.1-1 (source) into unstable (Martin)
[2025-03-24] Accepted prosody 13.0.0-1~bpo12+1 (source) into stable-backports (Martin)
[2025-03-24] prosody 13.0.0-1 MIGRATED to testing (Debian testing watch)
[2025-03-18] Accepted prosody 13.0.0-1 (source) into unstable (Martin)
[2025-01-09] Accepted prosody 0.12.5-1~bpo12+1 (source) into stable-backports (Martin)
[2025-01-09] prosody 0.12.5-1 MIGRATED to testing (Debian testing watch)
[2025-01-04] Accepted prosody 0.12.5-1 (source) into unstable (Victor Seva)
[2024-11-10] prosody 0.12.4-2 MIGRATED to testing (Debian testing watch)
[2024-11-05] Accepted prosody 0.12.4-2 (source) into unstable (Victor Seva)
[2023-10-02] Accepted prosody 0.12.4-1~bpo12+1 (source amd64) into stable-backports (Debian FTP Masters) (signed by: W. Martin Borgert)
[2023-09-18] prosody 0.12.4-1 MIGRATED to testing (Debian testing watch)
[2023-09-13] Accepted prosody 0.12.4-1 (source) into unstable (Victor Seva)
[2023-03-04] Accepted prosody 0.12.3-1~bpo11+1 (source) into bullseye-backports (Martin) (signed by: W. Martin Borgert)
[2023-03-04] prosody 0.12.3-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 9 10
RC: 0
I&N: 6
M&W: 3 4
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 13.0.4-2
5 bugs (1 patch)