libnet-oauth-perl_0.32-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 16 Aug 2026 17:54:05 +0200
Source: libnet-oauth-perl
Architecture: source
Version: 0.32-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers at lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa at debian.org>
Closes: 1144539
Changes:
 libnet-oauth-perl (0.32-1) unstable; urgency=medium
 .
   * Import upstream version 0.32.
     - Net::OAuth::Client no longer allows silent downgrades from
       OAuth 1.0a to 1.0 when the remote provider drops the
       oauth_verifier.  The behavior can be re-enabled with the
       allow_v1a_downgrade option. CVE-2026-72887
     - The Net::OAuth smart_require function no longer memoizes
       failures, which allowed attackers to exhaust memory with
       requests for invalid signature methods. CVE-2026-72888
     (Closes: #1144539)
   * Update upstream email addresses.
   * The upstream examples are gone.
   * Install new CONTRIBUTING.md file.
   * Drop 0001-Pin-PKCS-1-v1.5-padding-and-SHA-1-for-RSA-SHA1-signa.patch
     which was taken from upstream Git.
   * Update dependencies.
Checksums-Sha1:
 ed259c19131920ffde84542d82b1cfe40666d50c 2646 libnet-oauth-perl_0.32-1.dsc
 4c8cfa90d058f0ce99ac4bdc20882eb319bea9eb 32274 libnet-oauth-perl_0.32.orig.tar.gz
 7d8c5154f7a30505fe555bf9721e54a31da3fea5 4428 libnet-oauth-perl_0.32-1.debian.tar.xz
 0ecc7a5044b660b2051408cd5a9876a2c3ef1650 106176 libnet-oauth-perl_0.32-1.git.tar.xz
 070168cba2128976ad29beed8a2a60084dd2d9a7 17588 libnet-oauth-perl_0.32-1_source.buildinfo
Checksums-Sha256:
 3d45f2a2ffcc3f8c02c0ab25178a390a7653897e8ec8c78478c8d6e78b673fd1 2646 libnet-oauth-perl_0.32-1.dsc
 163180cf34b03bba31372d5f4cae24d382c41ab828abf34cafad7d9b5727a74a 32274 libnet-oauth-perl_0.32.orig.tar.gz
 b39719e9e76a0e6fc87adfd889b8315847c0f7d8ee3ca8182aeb6fe07c5009f8 4428 libnet-oauth-perl_0.32-1.debian.tar.xz
 4c77f2ba87162bfd79ce1d6d675ee3945c8762c513e22460084660cd62c2011a 106176 libnet-oauth-perl_0.32-1.git.tar.xz
 76d3712cef45e488913cca564344e5a0265f3348623cc92da1be42eeb9803c1d 17588 libnet-oauth-perl_0.32-1_source.buildinfo
Files:
 2ecd9eb3a191c71c5e4a319b30abd05b 2646 perl optional libnet-oauth-perl_0.32-1.dsc
 be08a8e9a6ac5c86d0c9cd521980d07d 32274 perl optional libnet-oauth-perl_0.32.orig.tar.gz
 1b9c1a8af5a643a4d5b7e26ec21b6094 4428 perl optional libnet-oauth-perl_0.32-1.debian.tar.xz
 13547fe2bed1eafe2cbec1481ff2c032 106176 perl None libnet-oauth-perl_0.32-1.git.tar.xz
 c7f553c36af8118fc95ba934a8258c76 17588 perl optional libnet-oauth-perl_0.32-1_source.buildinfo
Git-Tag-Info: tag=e7955ba346336f104f53741bf939df2a18539fd6 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa at debian.org>

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqB3jgACgkQYG0ITkaD
wHkcDQ//b6Lz6WWz7dAbih9cUodYRoymttt8GiS+0K6mPepJM8tsHTRhsX+DdC57
QOFTFg2HlgR/xraIhSSJiZr3tqQmojJ3CO78xU2mcFztATtTeQZaWKFCzhvKpg9k
zxnoNXOlTp8o//gYodubtXAZ+FQhR5LstPF+ZVkSJlE1y3ViswEzeid6ZfTlXRzH
VD8kqp9659E7Uxc1kJr73qys9cHYF86Ix38H75MzFRaowz273+L7dYMyitVVnTCm
EEIQ/5Pxwf9jqUCYWbyuy0V6fSc0abUh49Qp4AO4+hNTnReMCd+QnI406233lTVD
nh5IRDmnu41zcgt3dLvRPxrPlwC65R4zOj9iSmwPfI9QKYXb3YQR7WnWCXVXMQ1X
QEpRCQQPhY+U0lo6zRv+r2BueArmbD4dAywhbaPlSkdwpNERYRg6BwrJIaTZ/Ogd
mOjzeRKghHwVCZG4yO5JEQ/EhA4iv8BXpPxZTn2Xm7uwCsjAHaJI2OeFiszSt7Bi
eRvKwdTXddmYQDRlnealzzaJ+3B2rgDNAuI1isDUcCRLSBk6TUzVFB2glySW2Uzz
ZaIHaIYEOk+TsgKoy5HH8tMxyfZf143pGa2idoHkXQH7Ec4gkBBP9XDiIW0n9OQA
jZci/KUenJ0wPcyQkCwS7t7K3hbVJTVlD8fo/PEfwsNpmFiihLM=
=MTBO
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-perl-maintainers/attachments/20260816/7b72c770/attachment.sig>