[DRE-maint] Bug#1151708: passenger: warning for security vulnerability

[Wim Bertels]

Package: passenger
Version: 6.0.26+ds-1.1
Severity: normal
Tags: security
X-Debbugs-Cc: wim.bertels at ucll.be, Debian Security Team <team at security.debian.org>

Dear Maintainer,

cf as these log entries say:

[ E 2026-10-22 00:15:24.9242 20500/T6 age/Cor/SecurityUpdateChecker.h:521 ]: A security update is availa
ble for your version (6.0.26) of Phusion Passenger(R). We strongly recommend upgrading to version 6.2.1.
[ E 2026-10-22 00:15:24.9242 20500/T6 age/Cor/SecurityUpdateChecker.h:526 ]: Additional security update check information: 
- [Fixed in 6.2.0] [CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, CVE number pending] Various vulnerabilities in Nginx addressed by bumping Passenger Standalone's Nginx engine to 1.30.4, please see referenced CVEs. Also a LPE bug in Passenger Watchdog's API server was fixed, CVE pending.

Likely solution:
make version 6.2.0 from forky available in trixie,
unwanted side effects to be tested

hth,
wim

-- System Information:
Debian Release: 13.7
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.113+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=nl_BE.UTF-8, LC_CTYPE=nl_BE.UTF-8 (charmap=UTF-8), LANGUAGE=nl_BE:nl
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages passenger depends on:
ii  libc6        2.41-12+deb13u4
ii  libcurl4t64  8.14.1-2+deb13u7
ii  libev4t64    1:4.33-2.1+b1
ii  libgcc-s1    14.2.0-19
ii  libruby      1:3.3+b1
ii  libruby3.3   3.3.8-2
ii  libssl3t64   3.5.7-1~deb13u3
ii  libstdc++6   14.2.0-19
ii  libuv1t64    1.50.0-2
ii  ruby         1:3.3+b1
ii  ruby-rack    3.1.20-0+deb13u2

passenger recommends no packages.

Versions of packages passenger suggests:
ii  nodejs   20.19.2+dfsg-1+deb13u3
ii  python3  3.13.5-1
pn  rails    <none>

-- no debconf information