libnet-oauth-perl (0.33-1) unstable; urgency=medium . * Import upstream version 0.33. - Restrict the verification algorithm to those specified in the allowed_signature_methods, which is now required. This is a breaking change. (CVE-2026-72889) (Closes: #1144854) - HMAC_SHA1, HMAC_SHA256 and PLAINTEXT signature verification now use constant-time comparison (CVE-2026-75589). (Closes: #1144855) - HMAC_SHA1 and HMAC_SHA256 signature keys cannot be blank. * Add note about breaking change to debian/NEWS.Developer. * debian/libnet-oauth-perl.docs: CONTRIBUTING.md is gone. * Update years of upstream copyright. * Update debian/upstream/metadata. libnet-oauth-perl (0.32-1) unstable; urgency=medium . * Import upstream version 0.32. - Net::OAuth::Client no longer allows silent downgrades from OAuth 1.0a to 1.0 when the remote provider drops the oauth_verifier. The behavior can be re-enabled with the allow_v1a_downgrade option. CVE-2026-72887 - The Net::OAuth smart_require function no longer memoizes failures, which allowed attackers to exhaust memory with requests for invalid signature methods. CVE-2026-72888 (Closes: #1144539) * Update upstream email addresses. * The upstream examples are gone. * Install new CONTRIBUTING.md file. * Drop 0001-Pin-PKCS-1-v1.5-padding-and-SHA-1-for-RSA-SHA1-signa.patch which was taken from upstream Git. * Update dependencies. node-yjs (13.6.32-2) unstable; urgency=medium . * Team upload * Fix build with TypeScript 6 php-doctrine-cache (2.2.0-7) unstable; urgency=medium . * Compatibility with recent php-cache-integration-tests (1) * Remove redundant Priority: optional from source stanza * Upgrade upstream signing key to new packet format * Update standards version to 4.7.4 * Update watch file format version to 5 * Removed Rules-Requires-Root * Use debhelper-compat 14 * Document nocheck tag qemu (1:11.1.0+ds-2) unstable; urgency=medium . * fix the bug# closed by the previous upload * d/rules: install & ship pegasos1.dtb & pegasos2.dtb * target-loongarch-Fixes-for-endianness-problems-in-ve.patch: add back This patch is still needed for loong64-on-s390x to work * target-loongarch-fix-data-race-in-CSR_ESTAT.patch: re-add with adjustments for 11.1.x qemu (1:11.1.0+ds-1) unstable; urgency=medium . * new major upstream release, with the following security issues fixed: o CVE-2026-6502: Use-after-free within the virtio-gpu subsystem o CVE-2026-8348: Host memory exhaustion in 9pfs by limiting xattr fids o CVE-2026-9238: DoS in 9pfs via uncapped Treaddir allocation o CVE-2026-16457: Infinite loop in virtio_queue_empty() when evaluating packed vrings https://gitlab.com/qemu-project/qemu/-/work_items/3968 o CVE-2026-50626: OOB memory access in virtio-mmio transport mechanism https://gitlab.com/qemu-project/qemu/-/work_items/3882 https://gitlab.com/qemu-project/qemu/-/work_items/3921 https://gitlab.com/qemu-project/qemu/-/work_items/3923 https://gitlab.com/qemu-project/qemu/-/work_items/3613 o CVE-2026-63318: Read-only export bypass via O_TRUNC in 9pfs https://gitlab.com/qemu-project/qemu/-/work_items/4000 o CVE-2026-63319: Infinite loop or crash trigger in the usb-redir device https://gitlab.com/qemu-project/qemu/-/work_items/3995 o CVE-2026-66021: OOB read via DMA buffers in virtio-gpu blob handling https://gitlab.com/qemu-project/qemu/-/work_items/3945 * rules: do git checkout on vdso files on clean, if .git is present * gbp.conf, d/watch: switch to 11.1 * patches/: remove 4 now-unused patches * patches/: refresh gnu-hurd.patch riscv-on-ppc64-gcc15-121689.patch * control: add gcc-sh4-linux-gnu & libc6-dev-sh4-cross to build-deps for sh4 vdso * rules: export cross_prefix_sh4 for sh4 vdso files * rules: specify compiler to build sh4eb vdso * control.mk: add 2 vdso files for sh4; set vdso-version to 11.1.0~ * control.mk: checked-version := 11.1.0+ds * control,rules: remove glusterfs (removed upstream) * qemu-block-extra.NEWS: add a note about glusterfs remvoval * control.mk: add qemu-system-hexagon to qemu-system-misc * rules: remove --as-needed linker flag (it is enabled by default) * control: remove Priority: optional and Rules-Requires-Root: no (these are the default now) * control: Standards-Version: 4.7.4 * control: drop oss4-dev (does not exist anymore) * lintian-overrdies * u-boot-cmd_process-fix-return-type.diff * seabios-hppa-work-around-1143851.diff: work around gcc-hppa bug #1143851 * openbios-no-error-unused-but-set-variable.diff * work-around -Wa,-many issue by adding local gcc override to b/bin/ (Closes: #1143807) qemu (1:11.1.0~rc3+ds-2) experimental; urgency=medium . * d/rules: -Wno-error=unused-but-set-variable for openbios and -Wa,-many for openbios-ppc, to work around new gcc-16 (#1143807) * skiboot-add-many-bug1143807.diff: the same for skiboot qemu (1:11.1.0~rc3+ds-1) experimental; urgency=medium . * new upstream Release Candidate * remove patches applied upstream * d/rules: perform git checkout for linux-user vdso files if we have .git/ qemu (1:11.1.0~rc1+ds-1) experimental; urgency=medium . * new upstream RC * remove vfio-no-kvm-h.diff pvscsi-translate-data-endianness.patch * d/control: checked-version := 11.1.0~rc0+ds qemu (1:11.1.0~rc0+ds-2) experimental; urgency=medium . * vfio-no-kvm-h.diff: try removing #include kvm.h - checking if sparc64 will work this way qemu (1:11.1.0~rc0+ds-1) experimental; urgency=medium . * new upstream version (release candidate) * control.mk: add 2 vdso files for sh4; set vdso-version to 11.1.0~ * control.mk: checked-version := 11.1.0~rc0+ds * control,rules: remove glusterfs (removed upstream) * control.mk: add qemu-system-hexagon to qemu-system-misc * patches/: remove 4 patches which are applied upstream * patches/pvscsi-translate-data-endianness.patch: use the new version * patches/: refresh gnu-hurd.patch riscv-on-ppc64-gcc15-121689.patch * qemu-block-extra.NEWS: add a note about glusterfs remvoval * rules: remove --as-needed linker flag (it is enabled by default) * control: remove Priority: optional and Rules-Requires-Root: no (these are the default now) * control: Standards-Version: 4.7.4 * control: drop oss4-dev (does not exist anymore) * control: add gcc-sh4-linux-gnu & libc6-dev-sh4-cross to build-deps for sh4 vdso * rules: export cross_prefix_sh4 for sh4 vdso files * rules: specify compiler to build sh4eb vdso * add spelling-happend.patch * update lintian-overrdies