jgit_7.7.1-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 04 Nov 2026 21:56:03 +0100
Source: jgit
Architecture: source
Version: 7.7.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
Changed-By: Pierre Gruet <pgt at debian.org>
Closes: 1106287 1132766
Changes:
 jgit (7.7.1-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version 7.7.1:
     - Now supports option gpg.format = ssh (Closes: #1132766)
     - Fixes CVE-2025-4949:
     In Eclipse JGit versions 7.2.0.202503040940-r and older, the
     ManifestParser class used by the repo command and the AmazonS3 class
     used to implement the experimental amazons3 git transport protocol
     allowing to store git pack files in an Amazon S3 bucket, are
     vulnerable to XML External Entity (XXE) attacks when parsing XML
     files. This vulnerability can lead to information disclosure, denial
     of service, and other security issues.
     (Closes: #1106287)
   * Refreshing patches
   * Raising Standards version to 4.7.4:
     - Removing Priority: optional, which is now defaults
     - Removing R-R-R: no, which is now defaults
   * Switching to debhelper-compat 14, removing misc:Depends substvar
   * Raising d/watch version to 5
   * Removing unneeded versioned B-D
   * Set upstream metadata fields: Repository, Repository-Browse.
   * Changing names of packages of servlet-api
   * Updating Maven rules and ignoreRules
   * Adding B-D on libjackson2-core-java
   * Adding versioned B-D on libmina-sshd-java
   * Refreshing the list of POM files
   * Specifying a HOME directory under /tmp for groovy in d/rules
Checksums-Sha1:
 1af4cca9cfcf65de9c2bf302f66edb744bdc9bc5 2568 jgit_7.7.1-1.dsc
 3e82dc789f5e1ef9018f2f150fa8ae1442420b30 8467627 jgit_7.7.1.orig.tar.gz
 aaad1d91c9c7dc57a8e4d66f5ae54610bb466b8d 14288 jgit_7.7.1-1.debian.tar.xz
 8fd8d3ff3d369b2a4a95b6376e9604d13ec0d0a0 22081 jgit_7.7.1-1_amd64.buildinfo
Checksums-Sha256:
 c9b7b3bab00cb4f278c20a362bd747dc08e5b6adb602c3170340f91969095c2c 2568 jgit_7.7.1-1.dsc
 2d606b6b760808fea3eabfcc280690a879e6a38a7bf27e6f2dc8d64e2f52c4ba 8467627 jgit_7.7.1.orig.tar.gz
 847020bc4d183a5d05479944c3c662bfe31a4dabac9fca682e0a60efa288b7b9 14288 jgit_7.7.1-1.debian.tar.xz
 5ceb35251a27c6403a76e884941ac8e781a93a246edac7b5fff7a7cd3e904289 22081 jgit_7.7.1-1_amd64.buildinfo
Files:
 6f4bda7720cf9942d27617a76b523c7d 2568 java optional jgit_7.7.1-1.dsc
 3d618daa263c0a947f09330b16348b01 8467627 java optional jgit_7.7.1.orig.tar.gz
 1bda941be6692e0224cc2c5d10080a1a 14288 java optional jgit_7.7.1-1.debian.tar.xz
 8951159e14f657da34060e97f211eb9d 22081 java optional jgit_7.7.1-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrqqIACgkQYAMWptwn
dHYRohAAgC/AGuk6RTWNOJMFA6oDJGHY7nBSUmA62miOF0OrkSuy4UR2viwhnFVk
jtoUmGllwNYhXF7LYcUeJlZl3nVhPQCDTBG2yOHvC++uIknh2uptTpf0CJrUH9Rw
5w0XQEXiIJdHeW/0DlE2jY+9HL1dQt2AK36qaD7osDGPG4gP2E04kxkHXKl9roFc
J9EOYRSPc5lz7eTuDoG/vFxu4qMiiBoEM59ukKJa4W75miqqAPaHR3c6IZ5Rr/aW
EnR66dRrK8CxILjUcLAxtiQQusTyQKZLs/fGUCPmfCo17gqLoT/Vo7kLe5JLjGly
e+rXCjO7Rh6IAWkuUYYR+qmcppMrzHypVZnyqzy9D6bCatRcjsnAR0tuQAZIgZgH
/Br9pdiK9TEXW/oNBjq0VgHZNSR98aa3Ht25dy3K/hyScqZQsaCKBaa4/H7x3KjU
5+2AnoADI+A5SzLeKUvTHU1YuiGa7A6gCGI1xUtuKLFM7gg58JoXcbIw2rU4kmyI
BmbAJehhM/mcegK+OEzme7QEmPTB51EszjD+gK9zSEoYGXgCZX3WAwLFHCaMYGCl
9SWV+8PzT7eTTVK9TAMz+yjZ8IE2GfsS/H84yaCQWDBNOdhNHhAb+KRmAtkxZvT+
36rAkUesc1dfnlfP2jHrGbkUbOvHWMPMt350PlOXupOjmpFkptM=
=FydG
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261104/a0cc30ae/attachment.sig>