[From nobody Wed Nov 4 22:37:07 2026 Received: (at 1106287-close) by bugs.debian.org; 4 Nov 2026 22:34:25 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 121; hammy, 150; neutral, 221; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:58776) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOjYn-00CAz6-1r for 1106287-close@bugs.debian.org; Wed, 04 Nov 2026 22:34:25 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOjYm-00Avjt-0t for 1106287-close@bugs.debian.org; Wed, 04 Nov 2026 22:34:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=/Ooaw3up6Ng3iwepej/kgAhZ+nyPrcIlEgL3iHiXYMw=; b=ZjzMJU9rTrMQyBrEBfbUozlI1G VhpzxzGOgR1XEHR3afyfCv3qo4ocBaWSWbz7fDIdI92o/JddeR57KfSfgd6Df900YkHD7D7St09OR vV+LaTQ8WySrbpF1B+wYdNA0yGT8eqdE8VumGn5J2ZT2abs1frDKq9f08xHHGAAMG+Hs2nfA35VY7 Ept2E4xsnnoLjP+4Q+4SP06wSVEpu2lVpGnVQgUVVoqNJWgcZv4s4kzuzx4A1vp/CN+Ed2B27lcjU ALsc7IDAhBy94Vv/5f16+jJX05X4YnfqCs3cHcuvo0R1qjJKnekxvdorDA8/7qnKLW8+l+4pX8/V+ 4C7/tMyg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xOjYl-00000001hXu-1mQK; Wed, 04 Nov 2026 22:34:23 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Pierre Gruet <pgt@debian.org> To: 1106287-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: jgit Debian: DAK Debian-Changes: jgit_7.7.1-1_source.changes Debian-Source: jgit Debian-Version: 7.7.1-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1106287: fixed in jgit 7.7.1-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1429964402720126873==" Message-Id: <E1xOjYl-00000001hXu-1mQK@fasolo.debian.org> Date: Wed, 04 Nov 2026 22:34:23 +0000 --===============1429964402720126873== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: jgit Source-Version: 7.7.1-1 Done: Pierre Gruet <pgt@debian.org> We believe that the bug you reported is fixed in the latest version of jgit, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1106287@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Pierre Gruet <pgt@debian.org> (supplier of updated jgit package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 04 Nov 2026 21:56:03 +0100 Source: jgit Architecture: source Version: 7.7.1-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1106287 1132766 Changes: jgit (7.7.1-1) unstable; urgency=3Dmedium . * Team upload * New upstream version 7.7.1: - Now supports option gpg.format =3D ssh (Closes: #1132766) - Fixes CVE-2025-4949: In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues. (Closes: #1106287) * Refreshing patches * Raising Standards version to 4.7.4: - Removing Priority: optional, which is now defaults - Removing R-R-R: no, which is now defaults * Switching to debhelper-compat 14, removing misc:Depends substvar * Raising d/watch version to 5 * Removing unneeded versioned B-D * Set upstream metadata fields: Repository, Repository-Browse. * Changing names of packages of servlet-api * Updating Maven rules and ignoreRules * Adding B-D on libjackson2-core-java * Adding versioned B-D on libmina-sshd-java * Refreshing the list of POM files * Specifying a HOME directory under /tmp for groovy in d/rules Checksums-Sha1: 1af4cca9cfcf65de9c2bf302f66edb744bdc9bc5 2568 jgit_7.7.1-1.dsc 3e82dc789f5e1ef9018f2f150fa8ae1442420b30 8467627 jgit_7.7.1.orig.tar.gz aaad1d91c9c7dc57a8e4d66f5ae54610bb466b8d 14288 jgit_7.7.1-1.debian.tar.xz 8fd8d3ff3d369b2a4a95b6376e9604d13ec0d0a0 22081 jgit_7.7.1-1_amd64.buildinfo Checksums-Sha256: c9b7b3bab00cb4f278c20a362bd747dc08e5b6adb602c3170340f91969095c2c 2568 jgit_7= .7.1-1.dsc 2d606b6b760808fea3eabfcc280690a879e6a38a7bf27e6f2dc8d64e2f52c4ba 8467627 jgi= t_7.7.1.orig.tar.gz 847020bc4d183a5d05479944c3c662bfe31a4dabac9fca682e0a60efa288b7b9 14288 jgit_= 7.7.1-1.debian.tar.xz 5ceb35251a27c6403a76e884941ac8e781a93a246edac7b5fff7a7cd3e904289 22081 jgit_= 7.7.1-1_amd64.buildinfo Files: 6f4bda7720cf9942d27617a76b523c7d 2568 java optional jgit_7.7.1-1.dsc 3d618daa263c0a947f09330b16348b01 8467627 java optional jgit_7.7.1.orig.tar.gz 1bda941be6692e0224cc2c5d10080a1a 14288 java optional jgit_7.7.1-1.debian.tar= .xz 8951159e14f657da34060e97f211eb9d 22081 java optional jgit_7.7.1-1_amd64.buil= dinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrqqIACgkQYAMWptwn dHYRohAAgC/AGuk6RTWNOJMFA6oDJGHY7nBSUmA62miOF0OrkSuy4UR2viwhnFVk jtoUmGllwNYhXF7LYcUeJlZl3nVhPQCDTBG2yOHvC++uIknh2uptTpf0CJrUH9Rw 5w0XQEXiIJdHeW/0DlE2jY+9HL1dQt2AK36qaD7osDGPG4gP2E04kxkHXKl9roFc J9EOYRSPc5lz7eTuDoG/vFxu4qMiiBoEM59ukKJa4W75miqqAPaHR3c6IZ5Rr/aW EnR66dRrK8CxILjUcLAxtiQQusTyQKZLs/fGUCPmfCo17gqLoT/Vo7kLe5JLjGly e+rXCjO7Rh6IAWkuUYYR+qmcppMrzHypVZnyqzy9D6bCatRcjsnAR0tuQAZIgZgH /Br9pdiK9TEXW/oNBjq0VgHZNSR98aa3Ht25dy3K/hyScqZQsaCKBaa4/H7x3KjU 5+2AnoADI+A5SzLeKUvTHU1YuiGa7A6gCGI1xUtuKLFM7gg58JoXcbIw2rU4kmyI BmbAJehhM/mcegK+OEzme7QEmPTB51EszjD+gK9zSEoYGXgCZX3WAwLFHCaMYGCl 9SWV+8PzT7eTTVK9TAMz+yjZ8IE2GfsS/H84yaCQWDBNOdhNHhAb+KRmAtkxZvT+ 36rAkUesc1dfnlfP2jHrGbkUbOvHWMPMt350PlOXupOjmpFkptM=3D =3DFydG -----END PGP SIGNATURE----- --===============1429964402720126873== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCauuy7wAKCRCb9qggYcy5 IQadAP0U3lIQHk9ZQ+ygbceppfimFW2oFwC9hDWlX4urpL2BYAEAo/PNDjxSC6Es eDWQ6OhaZTJ3vtiWZ4qlqeLa3gjpZQI= =W+Sv -----END PGP SIGNATURE----- --===============1429964402720126873==-- ]