rust-broot - Debian Package Tracker

general

source: rust-broot (main)
version: 1.57.0+ds-3
maintainer: Debian Rust Maintainers (archive) (DMD)
uploaders: NoisyCoil [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 1.46.3-2
testing: 1.57.0+ds-2
unstable: 1.57.0+ds-3

versioned links

1.46.3-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.57.0+ds-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.57.0+ds-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

broot
librust-broot-dev

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:07:27
Last run: 2026-05-27T14:14:45.000Z
Previous status: unknown

testing: fail (log)
The tests ran in 0:06:13
Last run: 2026-08-15T01:29:49.000Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:10:29
Last run: 2026-07-18T11:02:44.000Z
Previous status: unknown

Created: 2026-08-15 Last update: 2026-08-26 15:30

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-72847: broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted.

Created: 2026-08-21 Last update: 2026-08-26 03:21

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-72847: broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted.

Created: 2026-08-21 Last update: 2026-08-26 03:21

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: shallow file has changed since we read it

Created: 2026-08-25 Last update: 2026-08-25 22:50

debian/patches: 8 patches to forward upstream low

Among the 9 debian patches available in version 1.57.0+ds-3 of the package, we noticed the following issues:

8 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-11-23 Last update: 2026-08-26 09:30

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-72847: (needs triaging) broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-08-21 Last update: 2026-08-26 03:21

testing migrations

excuses:
- Migrates after: rust-lfs-core
- Migration status for rust-broot (1.57.0+ds-2 to 1.57.0+ds-3): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ rust-broot unsatisfiable Build-Depends(-Arch) on riscv64: librust-lfs-core-0.20+default-dev
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest for rust-broot/1.57.0+ds-3: amd64: Pass, arm64: Test triggered, armhf: Pass, i386: Test triggered, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Lintian check waiting for test results on riscv64 - info
- ∙ ∙ Too young, only 0 of 5 days old
- ∙ ∙ Build-Depends(-Arch): rust-broot rust-lfs-core (not considered)
- ∙ ∙ Depends: rust-broot rust-lfs-core (not considered)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/r/rust-broot.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-08-25] Accepted rust-broot 1.57.0+ds-3 (source) into unstable (Simon Quigley)
[2026-08-25] rust-broot 1.57.0+ds-2 MIGRATED to testing (Debian testing watch)
[2026-08-10] Accepted rust-broot 1.57.0+ds-2 (source) into unstable (Simon Quigley)
[2026-08-10] Accepted rust-broot 1.57.0+ds-1 (source) into unstable (Simon Quigley)
[2026-07-13] Accepted rust-broot 1.57.0+dfsg-3 (source) into unstable (Juan Manuel Méndez Rey) (signed by: capitol@debian.org)
[2026-07-03] rust-broot 1.57.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-06-25] Accepted rust-broot 1.57.0+dfsg-2 (source) into unstable (Peter Michael Green)
[2026-06-22] rust-broot 1.57.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-06-18] Accepted rust-broot 1.57.0+dfsg-1 (source) into unstable (NoisyCoil)
[2026-05-27] rust-broot 1.56.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-23] Accepted rust-broot 1.56.4+dfsg-1 (source) into unstable (NoisyCoil)
[2026-04-24] rust-broot 1.56.2+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-04-18] Accepted rust-broot 1.56.2+dfsg-2 (source) into unstable (Peter Michael Green)
[2026-04-02] rust-broot 1.56.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-03-26] Accepted rust-broot 1.56.2+dfsg-1 (source) into unstable (NoisyCoil)
[2026-02-12] rust-broot 1.55.0-1 MIGRATED to testing (Debian testing watch)
[2026-02-09] Accepted rust-broot 1.55.0-1 (source) into unstable (NoisyCoil)
[2026-01-20] rust-broot 1.54.0-4 MIGRATED to testing (Debian testing watch)
[2026-01-15] Accepted rust-broot 1.54.0-4 (source) into unstable (NoisyCoil)
[2025-12-28] rust-broot 1.54.0-3 MIGRATED to testing (Debian testing watch)
[2025-12-26] Accepted rust-broot 1.54.0-3 (source) into unstable (Peter Michael Green)
[2025-12-26] rust-broot 1.54.0-2 MIGRATED to testing (Debian testing watch)
[2025-12-24] Accepted rust-broot 1.54.0-2 (source) into unstable (NoisyCoil)
[2025-12-11] rust-broot 1.54.0-1 MIGRATED to testing (Debian testing watch)
[2025-12-03] Accepted rust-broot 1.54.0-1 (source) into unstable (NoisyCoil)
[2025-11-26] rust-broot 1.53.0-2 MIGRATED to testing (Debian testing watch)
[2025-11-23] Accepted rust-broot 1.53.0-2 (source) into unstable (Fabian Grünbichler) (signed by: Fabian Gruenbichler)
[2025-11-12] rust-broot 1.53.0-1 MIGRATED to testing (Debian testing watch)
[2025-11-10] Accepted rust-broot 1.53.0-1 (source) into unstable (NoisyCoil)
[2025-11-03] rust-broot 1.52.0-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.57.0+ds-2