libspreadsheet-xlsx-perl_0.20-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 30 Oct 2026 17:50:26 +0100
Source: libspreadsheet-xlsx-perl
Architecture: source
Version: 0.20-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers at lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa at debian.org>
Closes: 1152516
Changes:
 libspreadsheet-xlsx-perl (0.20-1) unstable; urgency=medium
 .
   * Import upstream version 0.20.
 .
     From 0.19:
     - Security: replace string eval of number-format conditions with strict
       numeric comparisons; invalid conditions use the fallback format section.
       Prevents arbitrary Perl code execution when parsing crafted XLSX files.
     A.k.a CVE-2026-115943 (closes: #1152516)
 .
     From 0.20:
     - Security: limit ZIP entry counts and uncompressed sizes; read members
       incrementally and reject inconsistent size metadata.
     - Security: validate number format IDs and escape regex lookups to prevent
       regex injection from crafted styles.
     - Security: reject out-of-range date values to prevent excessive CPU usage.
     - Security: validate cell references against XLSX worksheet limits before
       indexing cell arrays, preventing excessive allocation from invalid rows.
 .
   * Update years of packaging copyright.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Rules-Requires-Root: no», which is the current default.
   * Remove «Priority: optional», which is the current default.
   * Set upstream metadata fields: Bug-Database, Bug-Submit.
Checksums-Sha1:
 1b33fcc60fce97478badeab7fda2eb3c81f10aef 2569 libspreadsheet-xlsx-perl_0.20-1.dsc
 559f7bba6d1ba461dbf6dbbf2b6f76ccf9a02204 89884 libspreadsheet-xlsx-perl_0.20.orig.tar.gz
 10f264b4c45f53833a45255a7f14091990a1a642 3584 libspreadsheet-xlsx-perl_0.20-1.debian.tar.xz
 f59015384cffe7ef7f9aad2de2714418bd11dfce 135392 libspreadsheet-xlsx-perl_0.20-1.git.tar.xz
 905a98ebef77d494f84992fa3eb0e3c3801315d7 17801 libspreadsheet-xlsx-perl_0.20-1_source.buildinfo
Checksums-Sha256:
 e5212023f0aa3c186b0ad1c7fed8b0f4b807dfe46a0197cf144d55661bbd2783 2569 libspreadsheet-xlsx-perl_0.20-1.dsc
 5add7b91c4845809b065a1b61e326627b0019aaec91078b1efa54842c9a7ab5d 89884 libspreadsheet-xlsx-perl_0.20.orig.tar.gz
 adb18a86dfb37e1116fe4b1e0144a421a3ed7408cf325af7e6b43140e1d40a4c 3584 libspreadsheet-xlsx-perl_0.20-1.debian.tar.xz
 2fce0babb5d416f2d5b6c423e1424d3a7463235c685c1f52bc00e1b5123b1fc2 135392 libspreadsheet-xlsx-perl_0.20-1.git.tar.xz
 1d262efcba0c5278424c451fa32ed2210d4ebb891cd58fa896179fe791b2f237 17801 libspreadsheet-xlsx-perl_0.20-1_source.buildinfo
Files:
 6e3a871b4379b649b6be6ee32c52d162 2569 perl optional libspreadsheet-xlsx-perl_0.20-1.dsc
 84efc2a287e018ff45ce0c6aeed5bb8a 89884 perl optional libspreadsheet-xlsx-perl_0.20.orig.tar.gz
 f25a66ced90f4ec7a8acfc73edff2852 3584 perl optional libspreadsheet-xlsx-perl_0.20-1.debian.tar.xz
 de2c9805834db62978f8eeaeeb1d8b9d 135392 perl None libspreadsheet-xlsx-perl_0.20-1.git.tar.xz
 d4c1bb56340da5efd052653264a724ae 17801 perl optional libspreadsheet-xlsx-perl_0.20-1_source.buildinfo
Git-Tag-Info: tag=08e1ca1819f3c7e0dabc6cc5f1123b15eaa251a7 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa at debian.org>

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrky6oACgkQYG0ITkaD
wHlbWw//WOfxsCgiyQ4P6BBwl1dxwtWCa+rceeFQZtohy9lYP6//AL6HrBDsUjQB
gaHafOGumuGtACRqZDsTSzmLy3+7JVg4Tk20olJF+AKk+r7j3XpiLGOOuGUjL98n
aNCmJ889VOVKuP3EWw4myzDpbDQH4KOCyAP5G++wiRykoo7fUff/D3aDIW4HilX5
2RQ19mYLVju86fEgqAHWzxYlCFy3rUVqeNw/XPsfGBlJW/dh+DnuiXLJy53+5up5
jHI2WM6B1wC+YW4Ug/GTx5dM/Jj2bdsa0bgCdms2JrIFnnP4B8eomuxq64vx/N7O
hiJyMQgbqeUk+n2NbA3OTd6ExSYxMbhO3AdslSsGvI4UjVY62PYuGUoq0Zd8EDqC
yhLVJo+H3hGJS/UYnfG6h4p0lfIF6uRYJnzzeqSQeBTVuAlWWjwEGIoI+97ENg1J
TD58Qs4UtFmx9tQHNU3fZ7rAaLjCPcmomF82NMdJNQ5orABCKI15OvBWu257TS6u
pYcyQtK2IJzrekTySIC3Ibu5OznCo1AlYAUe1WYrmxOjnUdPuWPk7FTf+o6hO0zV
kMh+kBL5GeqjynUhWBufFbU9AOdZes9CHrGaVFL0A6Qyr5V1p8WeH7zyOpdgxWWU
/3Sf6yvQi5l30hBSTg4AOf/vr0MnmfLCy613F2j6UeivV9HSKv8=
=ez0O
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-perl-maintainers/attachments/20261030/c3f2613b/attachment.sig>