cdk (1:2.13-1) unstable; urgency=medium . * New upstream version 2.13 * Adjust to the removal of a pair of POMs. * Fix API incompatibility with libbeam-java (Closes: #1149405) composer (2.11.1-1) unstable; urgency=medium . [ Jordi Boggiano ] * Update ca-bundle to fix a php 8.6 deprecation * Release 2.11.1 . [ Alessandro Lai ] * Revert back to HTTP Basic Auth for GitLab Package registry (#13180) * Refactor `AuthHelper::addAuthenticationOptions()` (#13181) . [ Nicolas Grekas ] * Keep empty link and repositories keys unless a removal emptied them (#13178) . [ David Prévot ] * Group no_exotic_arch for test failing under armhf, ppc64el, riscv64, s390sx… composer (2.11.0-1) unstable; urgency=medium . * Upload release to unstable . [ Jordi Boggiano ] * Fix svn password redaction in debug output (#13171) * Sanitize URLs in hg and fossil error output (#13172) * Escape additional arguments passed to @composer scripts (#13169) * Release 2.11.0 + Fixed package names in `vendor/composer/installed.json` being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p) + Fixed inline repository HTTP headers, such as API tokens, being written into `composer.lock` (GHSA-fm2w-xgf2-f9fh) . [ Srayuth Kamma ] * Ignore OS/editor metadata entries when locating a package archive top-level directory (#13168) * Fix composer config corrupting composer.json when extra/scripts is a JSON array (#13167) . [ Daniel Pinto ] * PoolOptimizer: Reduce Intervals::compactConstraint() calls (#13174) composer (2.11.0~rc1-1) experimental; urgency=medium . * Upload RC to experimental . [ Jordi Boggiano ] * Add batching to the security advisories API queries for projects with very large dep count (#13051) * Add installed version to sub-dependencies in show --tree JSON output (#13049) * Load more classes pre-emptively before swapping the phar file, fixes #13079 * Warn about paths only differing in casing in optimized autoload dumps (#13085) * Pass along agent name as well as agent (#13087) * Bump plugin API version to 2.11 * Remove source-fallback option that was added in 2.10 as a stop-gap measure (#13050) * Fix clear-cache --no-cache reporting missing dirs instead of disabled cache (#13092) * Retry downloads of truncated zip archives (#13094) * Escape package controlled data interpolated into the generated bin proxies (#13056) * Stop requesting HTTP/3, as hosts Composer talks to do not support it yet (#13096) * Track why policies removed each version in one map on the pool (#13100) * Parse package release/published dates lazily (#13103) * Load package metadata in parallel before outdated/show --latest lookups (#13113) * Make outdated and show --latest respect the cooldown policy (#13102) * Bump >=10 style lower bounds without loosening OR constraints (#13133) * Bump minimum required justinrainbow/json-schema * Count authentication retries separately from network retries (#13135) * Fix repository transport options matching dist URLs on other hosts (#13142) * Fix secure-http check skipping malformed URLs and git transport prefixes (#13144) * Avoid warnings when finding packages within inline packages without uid (#13148) * Reject TLS connections presenting distrusted intermediate certificates (#13146) * Make sure the policy config is reflected in the lock file (#13149) * Add --no-cooldown flag to update/require/remove/create-project (#13153) * Update changelog * Release 2.11.0-RC1 . [ Greg Roach ] * Fix: an empty command in a script should always be a NO-OP (#13053) . [ Pascal CESCON ] * Report the GitHub API rate limit when the clone fallback fails (#13059) . [ Markus Staab ] * Move getVersion() call out of loop (#13123) * RuleWatchGraph: Reduce getRule() calls (#13124) * Solver: Call getLiterals() only for enabled rules (#13132) . [ Eirik Stanghelle Morland ] * Support retrying requests honoring their retry-after header (#13082) * Send AI agent info as part of user agent (#13073) . [ Nicolas Grekas ] * Replace generated files instead of rewriting them in place (#13069) . [ Yanick Witschi ] * Reuse version lists within pool optimizer package groups (#13072) * Avoid repeated invariant constraint checks in pool optimization (#13071) * Add terminal program status reporting via OSC (#13117) . [ Samran Asif ] * Url: preserve SSH user in stripCredentials() (#13081) . [ Lazizbek Ergashev ] * Skip loading security advisories for named dev branches' packages in the pool filter (#13089) . [ MD Ali Kadar ] * Share the repeated warning dedup across all outputWarnings() callers (#13090) . [ Ben Younes ] * Exclude the vendor dir from root classmap scanning (#13018) * Fix suggest filtering for non-installed packages (#12992) (#13014) . [ Nicholas Ciechanowski ] * feat: add `strict-psr-autoloader` to options (#12893) . [ Alessandro Lai ] * Fix handling of GitLab CI job token auth (#12916) . [ Stephan ] * Custom policies: add block-scope config option to block during composer install (#12990) . [ Viktor Djupsjöbacka ] * Add cooldown policy config to filter newly released packages (#12692) . [ Tony Nguyen ] * Fail install when composer.lock has a content-hash merge conflict (#13105) . [ kevin ] * Fix JsonManipulator::addSubNode modifying a nested key with the same name (#13109) . [ Daler Azimov ] * Fix wildcard package updates with --minimal-changes (#13118) . [ Nguyen Quang Truong ] * Explain advisory-blocked versions in dependency conflicts (#13108) . [ PrinsFrank ] * Ask user if the composer.lock should be added to .gitattributes with export-ignore when initializing a library (#13127) . [ Bram Driesen ] * feat: Add support for -D (direct) in audit command (#13121) . [ qodelicious ] * Merge custom-headers from all config sources (#13141) . [ hershel-theodore-layton ] * Check plugin capability correctness before instantiating it (#13139) . [ Daniel Pinto ] * Treat packages with no installable version as up to date in outdated (#13138) . [ Soner ] * Add only-branches option to VCS repositories (#13086) . [ Adel Kaleche ] * Explain security-blocked versions with partial advisories instead of failing (#13075) . [ Maciej Pawłowski ] * Support Bitbucket Cloud’s new SSH hostname (#13152) . [ David Prévot ] * Document CVE in previous changelog entry django-ninja (1.7.1-2) unstable; urgency=medium . * Team upload. . [ Alexandre Detiste ] * Remove redundant Priority: optional from source stanza. * Add debian/upstream/metadata. . [ Colin Watson ] * tests: decimal JSON schema has no pattern since pydantic 2.14 (closes: #1150525). * Use dh-sequence-python3. django-ninja (1.7.1-1) unstable; urgency=medium . * Team Upload * New upstream version 1.7.1 * Build-depends on python3-flit instead of the whole 'flit' toolbox * Add debian/salsa-ci.yml * Drop 'Rules-Requires-Root: no': it is now the default * Apply multi-arch hints. * Switch to debhelper-compat 14 fastapi (0.162.0-1) unstable; urgency=medium . * New upstream release * debian/rules - run again the telemetry tests exporting via OTLP HTTP, #1151142 is fixed in opentelemetry 1.45.1-2 - update the reason for skipping the opentelemetry-instrumentation-fastapi telemetry tests: it is now in Debian, but it build-depends on fastapi and is not in testing git-lfs (3.8.1-2) unstable; urgency=medium . * Fix failing autopkgtest due to missing dependency git-lfs (3.8.1-1) unstable; urgency=medium . * New upstream release golang-github-nix-community-go-nix (0.0~git20250101.4bdde67+ds-1) unstable; urgency=medium . * Initial release (Closes: #1148637) golang-golang-x-net (1:0.62.0-1) unstable; urgency=medium . * Team upload * New upstream - CVE-2026-97045 - CVE-2026-78661 incus (7.0.2-3) unstable; urgency=high . * Cherry-pick fixes for the following security issues: - GHSA-5pgx-q9xx-j3qv - GHSA-jcw9-v2ff-8m79 - GHSA-xg75-xf37-cph9 - GHSA-p45f-gqqj-6qq3 - GHSA-q9fc-p923-6vp7 - GHSA-cwg9-8mc4-hf7j - GHSA-5c64-j5m6-8433 - GHSA-3wxw-5gh2-j2x2 - GHSA-3rgf-297m-775x - GHSA-9c46-v3hw-v6m8 - GHSA-h2j8-4crh-vhfc - GHSA-8r3h-vc36-6xpx - GHSA-v736-5xp3-jghf - GHSA-x6pw-mh5w-pq73 - GHSA-pf5w-m8m6-5265 - GHSA-f7xp-22ph-v444 - GHSA-9f75-5fjw-5jvv - GHSA-8mgx-h4v8-xqv2 * Drop unneeded lintian override libbeam-java (1.4-1) unstable; urgency=medium . * New upstream version 1.4 * Update debian/copyright. libspreadsheet-xlsx-perl (0.20-1) unstable; urgency=medium . * Import upstream version 0.20. . From 0.19: - Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files. A.k.a CVE-2026-115943 (closes: #1152516) . From 0.20: - Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata. - Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles. - Security: reject out-of-range date values to prevent excessive CPU usage. - Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows. . * Update years of packaging copyright. * Declare compliance with Debian Policy 4.7.4. * Remove «Rules-Requires-Root: no», which is the current default. * Remove «Priority: optional», which is the current default. * Set upstream metadata fields: Bug-Database, Bug-Submit. node-vscode-css-languageservice (6.3.10+ds-1) unstable; urgency=medium . * New upstream release. node-vscode-json-languageservice (5.7.2-1) unstable; urgency=medium . * New upstream release. node-vscode-uri (3.2.0-1) unstable; urgency=medium . * New upstream release. python-consul (1.6.0-2) unstable; urgency=medium . * Team upload. * Add patch to keep 'docs' directory out of the wheel and therefore fix FTBFS with recent dh-python (Closes: #1151899). * Update Standards-Version to 4.7.4 (no changes required). python-gevent (26.9.0-1) unstable; urgency=medium . * Team upload. * Install the libev and libuv CFFI backends, including architecture-qualified abi3 extensions, replacing their exclusion. (Closes: #1144998) * debian/control: Require CFFI for all builds and add the CFFI backend runtime dependency. * debian/rules: Install one stable-ABI extension per CFFI backend, built with the oldest supported Python, before normalizing extension names. * debian/tests: Exercise both CFFI backends under every supported Python. * New upstream release with Python 3.15 compatibility fixes. * debian/patches: + use-local-intersphinx-inventory.patch: Use local inventories for all external projects and link to the Python 3.15 documentation. + forward-fileobject-keywords.patch: Preserve encoding and errors on first pipe creation. + fix-subprocess-timeout.patch: Fix subprocess timeouts with inherited pipes, preserve partial output, and cover timeout cleanup and text buffering in tests. + include-python315-subprocessdata.patch: Include the missing Python 3.15 subprocess test data. + fix-timer-resolution-test.patch: Use an idle socket pair in the timer resolution test. * debian/rules: Disable tracemalloc during tests to avoid CPython subinterpreter crashes, retaining the other debug checks. * debian/tests: Add installed-runtime coverage for all supported Python versions, including monkey-patching, SSL APIs, executor shutdown, subprocess timeouts, first-pipe encoding and text buffering. * debian/source/include-binaries: Include all vendored documentation inventories in the source package. * debian/*.inv: Refresh the Python inventory to 3.15 and add greenlet, zope.event and zope.component inventories for offline documentation builds. * debian/copyright: Record the documentation inventories and their licenses. * debian/copyright: Add missing license texts and references, document the copied Python tests and upstream contributors, and drop a stale path. python-opentelemetry (1.45.2-1) unstable; urgency=medium . * [bd7a954] New upstream version 1.45.2 r-cran-ecosolver (0.6.2+dfsg-1) unstable; urgency=medium . * Team upload. * Packaging update (routine-update) * Use uscan v5 $template template. (routine-update) * New upstream version * Standards-Version: 4.7.4 (routine-update) * Restrict to R packages team core architectures (routine-update) * Drop 'Rules-Requires-Root: no' from d/control (routine-update) * Set upstream metadata fields: Repository. ruby-ethon (0.19.1-1) unstable; urgency=medium . * Team upload. * Upgrade the watch file to version 5. * New upstream release. * Update Standards-Version to 4.7.4. * Bump debhelper-compat to 14, dropping ${misc:Depends}, ${shlibs:Depends}, and ${ruby:Depends} from runtime dependencies. * Refresh the copyright file. * Run the upstream test suite. rust-auto-enums (0.8.10-1) unstable; urgency=medium . * Team upload. * Package auto_enums 0.8.10 from crates.io using debcargo 2.8.4 rust-bpaf (0.9.28-1) unstable; urgency=medium . * Team upload. * Package bpaf 0.9.28 from crates.io using debcargo 2.8.4 * Drop use-crate.patch, applied upstream. * Run the fenced code splitter test only with docgen. * Build feature-gated examples only with those features. rust-bpaf-derive (0.5.26-1) unstable; urgency=medium . * Team upload. * Package bpaf_derive 0.5.26 from crates.io using debcargo 2.8.4 rust-der (0.8.3-1) unstable; urgency=medium . * Team upload. * Package der 0.8.3 from crates.io using debcargo 2.8.4 rust-derive-utils (0.16.0-1) unstable; urgency=medium . * Team upload. * Package derive_utils 0.16.0 from crates.io using debcargo 2.8.4 rust-opaquerr (0.2.0-1) unstable; urgency=medium . * Package opaquerr 0.2.0 from crates.io using debcargo 2.8.3 rust-path-facts (0.4.0-1) unstable; urgency=medium . * Team upload. * Package path_facts 0.4.0 from crates.io using debcargo 2.8.4 * Isolate filesystem fixtures without cargo-nextest. * Run the tests one thread at a time. * Shorten the synopsis. rust-reword (8.0.0-1) unstable; urgency=medium . * Team upload. * Package reword 8.0.0 from crates.io using debcargo 2.8.4 rust-speedate (0.18.0-1) unstable; urgency=medium . * Team upload. * Package speedate 0.18.0 from crates.io using debcargo 2.8.4 * Drop relax-strum.patch, applied upstream. rust-spki (0.8.1-1) unstable; urgency=medium . * Team upload. * Package spki 0.8.1 from crates.io using debcargo 2.8.4 rust-subprocess (1.2.1-1) unstable; urgency=medium . * Team upload. * Package subprocess 1.2.1 from crates.io using debcargo 2.8.4 * Drop disable-windows.diff in favor of filter_targets. * Drop fix-test-race.diff, applied upstream. rust-yada (0.7.0-1) unstable; urgency=medium . * Team upload. * Package yada 0.7.0 from crates.io using debcargo 2.8.4 rust-zbar-rust (0.1.1-1) unstable; urgency=medium . * Team upload. * Package zbar-rust 0.1.1 from crates.io using debcargo 2.8.4 * Drop unpackaged qrcode-generator; its tests are not published. scalene (1.5.54-3) unstable; urgency=medium . * Team upload. * Let pybuild handle the abitag sphinx-automodapi (0.22.1-1) unstable; urgency=medium . * New upstream version 0.22.1 * Rediff patches. Remove pytest compatibility patch (applied upstream) sphinx-rtd-theme (3.1.0+dfsg-4) unstable; urgency=medium . * Build with dart-sass instead of ruby-sass (closes: #1149762). - Remove IE8 hack from wyrm's _form.sass. - Add a patch to fix dart-sass build errors in _theme_rst.sass. - Update sourcemap flag in debian/rules. - Disable i386 build in CI, dart-sass is not available there. tinyssh (20261101-1) unstable; urgency=medium . * New upstream version 20261101 * d/p/* remove, fixed in upstream tralics (3.0.1+dfsg1-1) unstable; urgency=medium . * Adopt the package (Closes: #1128983). * New upstream release. * debian/gbp.conf: Added. * debian/watch: Track GitHub releases using format 5 and repack the source. * debian/copyright: Exclude bundled libraries and the Maple and overword support files with restrictive redistribution terms. * debian/control: Take over maintenance, update the project and Vcs URLs, build with CMake and system libraries, and follow Standards-Version 4.7.4. Move the shared description to the source stanza and use debhelper 14 with the explicit single-binary sequence. * debian/rules: Enable all supported hardening options. * debian/rules: Replace the legacy rules with dh and honour distribution compiler and linker flags (Closes: #1119593). Run upstream regression tests separately and respect DEB_BUILD_OPTIONS=nocheck. * debian/patches/: - 0001-Include-unistd.h-for-sleep.patch: Dropped, obsolete with the new upstream source. + 0001-Use-system-libraries-and-distribution-build-flags.patch: Add patch to use system libraries and distribution build flags, and separate the upstream regression tests from compilation. + 0002-Rename-the-modified-AMS-documentation-fixture.patch: Add patch to rename the modified AMS test source and expected XML according to the licence requirements. + 0003-Install-and-locate-the-Tralics-expl3-support-file.patch: Add patch to install the expl3 companion file and search configuration directories for input files after user-specified input paths. + 0004-Include-algorithm-where-standard-algorithms-are-used.patch: Add patch for missing direct includes exposed when using system libraries. * debian/copyright: Rewrite in machine-readable format. * debian/tralics.docs, debian/tralics.manpages: Replace legacy helper files. * debian/tralics.1: Expand the manually maintained reference using the current help and implementation. * debian/NEWS: Explain the UTF-8 output, configuration and support changes. * debian/README.source: Describe the recovered history and source workflow. * debian/tralics.lintian-overrides: Document intentionally retained Latin-1 input examples and entity tables. * debian/tests/*: Add installed translation, MathML, expl3 and configuration smoke tests. ucspi-tcp (1:0.88-16) unstable; urgency=medium . * Orphan the package as per #1143020. wpa (2:2.11-7) unstable; urgency=medium . * Start activated wpa_supplicant with -x/etc/wpa_supplicant/ (Closes: #1148985) . wpa (2:2.11-6) unstable; urgency=medium . [ Salvatore Bonaccorso ] * Honor permissions from the wpa_supplicant configuration target file (Closes: #1148985) * Use umask to limit access to temporary wpa_supplicant configuration file (Closes: #1148985) * Remove alternative wpa_config_write() path on failed memory allocation (Closes: #1148985) * Remove the temporary wpa_supplicant config file in error case (Closes: #1148985) * Use a random suffix in the temporary wpa_supplicant configuration file (Closes: #1148985) * Ensure the temporary config file gets created and is not a symlink (Closes: #1148985) * Verify that fclose() succeeds on temporary configuration file (Closes: #1148985) . [ Andrej Shadura ] * Add wpa_supplicant option to restrict configuration file location (Closes: #1148985) wpa (2:2.11-6) unstable; urgency=medium . [ Salvatore Bonaccorso ] * Honor permissions from the wpa_supplicant configuration target file (Closes: #1148985) * Use umask to limit access to temporary wpa_supplicant configuration file (Closes: #1148985) * Remove alternative wpa_config_write() path on failed memory allocation (Closes: #1148985) * Remove the temporary wpa_supplicant config file in error case (Closes: #1148985) * Use a random suffix in the temporary wpa_supplicant configuration file (Closes: #1148985) * Ensure the temporary config file gets created and is not a symlink (Closes: #1148985) * Verify that fclose() succeeds on temporary configuration file (Closes: #1148985) wpa (2:2.11-5) unstable; urgency=medium . * Fix SIGSEGV in AP mode on any received DPP chirp (Closes: #1149027) * Fix SAE reporting over D-Bus (Closes: #1147955) * Disable MAC randomization during P2P provisioning. xpra (3.1.5+dfsg1-0.5) unstable; urgency=medium . * Non-maintainer upload. * debian/rules: Keep build_info.py from the default Python interpreter to avoid conflicting metadata when merging modules built for multiple Python versions. (Closes: #1152003) * debian/xpra.pyremove: Remove the obsolete Python 3.8-specific metadata exclusion. * debian/control: Depend on python3-gi-cairo for the Cairo foreign converters used to draw forwarded windows. * debian/control: Update Standards-Version to 4.7.4; drop obsolete Priority and Rules-Requires-Root fields. * debian/patches: + clipboard-cleanup-gdk-window.patch: Backport the upstream fix for GTK crashes on exit when cleaning up the X11 clipboard window. REMOVED: django-redis 7.0.0-2 REMOVED: generator-scripting-language 4.1.5-6