chromium (156.0.8078.79-1) unstable; urgency=high . [ Juan Manuel Méndez Rey ] * d/patches/upstream: new directory for fixes that are already upstream, with the two a component build needs. * d/rules: set use_mold=false and dcheck_always_on=false, which a component build needs because both default back on when is_official_build is off. * d/rules: turn off use_thin_lto in a component build. Thin lto adds -fwhole-program-vtables, which a component build makes unsound, and the browser then crashes in mojo at startup. * d/rules: keep dh_makeshlibs out of /usr/lib/chromium. That directory is private, and chromium-common was declaring libvulkan in its shlibs and activating an ldconfig trigger for it. * d/rules: add the component build configuration, off by default. Name an architecture in COMPONENT_BUILD_ARCHS to turn it on there. * d/rules: build chromium as a component build on armhf, the only configuration whose final link fits in a 32-bit address space. (Closes: #1150706) * d/README.armhf: new, why armhf is built this way and what to check on a version bump. . [ Andres Salomon ] * New upstream security release. - CVE-2026-76024: Memory corruption in MediaStream. Reported by Xinyang Ge. - CVE-2026-76025: Use after free in FileSystem. Reported by Google. - CVE-2026-76026: Memory corruption in Autofill. Reported by Google. - CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google. - CVE-2026-76028: Use after free in FileSystem. Reported by Google. - CVE-2026-76029: Memory corruption in Network. Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com). - CVE-2026-76030: Memory corruption in FileSystem. Reported by huntersnot4. - CVE-2026-76031: Use after free in Input. Reported by Arni Hardarson (Neonix Security). - CVE-2026-119260: Use after free in Frames. Reported by Google. - CVE-2026-119261: Improper input validation in Skia. Reported by Google. - CVE-2026-119262: Improper input validation in V8. Reported by Hyeonjun Ahn (@_deayzl). - CVE-2026-119263: Memory corruption in GarbageCollection. Reported by Xinyang Ge. - CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a. - CVE-2026-119265: Memory corruption in Quota. Reported by Google. - CVE-2026-119266: Use after free in Quota. Reported by Google. - CVE-2026-119267: Memory corruption in DOM. Reported by Xinyang Ge. - CVE-2026-119268: Integer overflow in Editing. Reported by Xinyang Ge. - CVE-2026-119269: Use after free in Blink. Reported by Google. - CVE-2026-119270: Improper input validation in CacheStorage. Reported by Google. - CVE-2026-119271: Use after free in Skia. Reported by Google. - CVE-2026-119272: Out of bounds read in FileSystem. Reported by Google. . [ Daniel Richard G. ] * d/deb_pre_gen.py: Rework script to be called directly by ninja, instead of being called by various upstream build scripts. * d/patches: - debianization/pre-gen.patch: stop patching various upstream scripts (eg, run_bindgen.py). - disable/node-ts.patch: drop, no longer needed with above rework. chromium (156.0.8078.73-1) unstable; urgency=high . [ Daniel Richard G. ] * d/clean: Drop files created by d/scripts/unbundle, as they are now cleaned up in the override_dh_auto_clean target in d/rules. * d/patches/ppc64le/regen: - regenerate_xnnpack_patch: Revised version of Tim's script for generating 0002-regenerate-xnn-buildgn.patch. - xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's, to support the regenerate_xnnpack_patch script. * d/rules: - Move the functionality of d/scripts/customize-typescript.sh into the override_dh_auto_configure target. - On cleaning, restore upstream files that were modified in said target. - Tweak what files get cleaned up, and delete any resulting empty dirs. - Don't clean up Cargo.toml.orig files, as the upstream tarball (not ours) has many of these. * d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here. * d/scripts/check-upstream: Error out if the upstream tarball has anything named *.upstream, as we use that suffix for our purposes. * d/scripts/customize-typescript.sh: Drop, now handled in d/rules. * d/scripts/unbundle: Use Python calls (instead of shell commands) to create symlinks, and preserve existing files. . [ Andres Salomon ] * New upstream security release. - CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge. - CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge. - CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge. - CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern). - CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118305: Memory corruption in Turbolev. Reported by Google. - CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge. - CVE-2026-118320: Memory corruption in V8. Reported by Google. - CVE-2026-118322: Memory corruption in ANGLE. Reported by Google. - CVE-2026-118329: Improper input validation in ANGLE. Reported by Google. - CVE-2026-118354: Improper input validation in Skia. Reported by Google. - CVE-2026-118340: Memory corruption in Skia. Reported by Google. - CVE-2026-118321: Improper input validation in Core. Reported by Google. - CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge. - CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge. - CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge. - CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge. - CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla. - CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous. - CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics. - CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. - CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407). - CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan. - CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben). - CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2. - CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118316: Improper input validation in V8. Reported by Google. - CVE-2026-118346: Use after free in Compositing. Reported by Google. - CVE-2026-118342: Out of bounds write in Editing. Reported by Google. - CVE-2026-118310: Improper input validation in Views. Reported by Google. - CVE-2026-118335: Improper input validation in Metrics. Reported by Google. - CVE-2026-118308: Use after free in SVG. Reported by Google. - CVE-2026-118314: Improper input validation in UI. Reported by Google. - CVE-2026-118347: Use after free in FileSystem. Reported by Google. - CVE-2026-118341: Use after free in Modularization. Reported by Google. - CVE-2026-118330: Use after free in Browser. Reported by Google. - CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118356: Use after free in WTF. Reported by malichamdan. - CVE-2026-118309: Improper input validation in UI. Reported by Google. - CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118312: Memory corruption in Paint. Reported by Google. - CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access. dnspython (2.8.0-7) unstable; urgency=medium . * Backport upstream fix for CVE-2026-114605: limit DNS compression pointer chains to 16 hops to prevent excessive CPU use (denial of service) when parsing untrusted wire-format messages (Closes: #1151842): - 0003-Limit-decompression-to-a-chain-length-of-at-most-16-.patch fuse-emulator-utils (1.5.1-1) unstable; urgency=medium . * New upstream release. * debian/control: - Require libspectrum >= 1.8.0. libdbd-pg-perl (3.21.2-2) unstable; urgency=medium . * Add patch to fix test setup on Perl 5.44 when DBDPG_INITDB is set. Thanks to Niko Tyni for creating the patch. (Closes: #1151887) * Convert debian/watch to version 5. qt-qml-models (0~0.0-1) unstable; urgency=medium . * Initial release (Closes: #980131) rust-env-filter (2.0.0-1) unstable; urgency=medium . * Team upload. * Package env_filter 2.0.0 from crates.io using debcargo 2.8.4 rust-env-logger (0.11.11-1) unstable; urgency=medium . * Team upload. * Package env_logger 0.11.11 from crates.io using debcargo 2.8.4 rust-rustc-hash (2.1.3-1) unstable; urgency=medium . * Team upload. * Package rustc-hash 2.1.3 from crates.io using debcargo 2.8.4 * Drop the nightly feature; it needs an unstable compiler. * Relax rand to 0.10. rust-sourceview5 (0.11.2-2) unstable; urgency=medium . * Team upload * Package sourceview5 0.11.2 from crates.io using debcargo 2.8.4 * Build with gtksourceview5 5.22 rust-sourceview5 (0.11.2-1) unstable; urgency=medium . * Team upload * Package sourceview5 0.11.2 from crates.io using debcargo 2.8.4 rust-sourceview5 (0.11.0-1) unstable; urgency=medium . * Package sourceview5 0.11.0 from crates.io using debcargo 2.8.2 * Fix deletion of gir files after install (Closes: #1133756) rust-sourceview5 (0.10.0-7) unstable; urgency=medium . * Team upload. * Package sourceview5 0.10.0 from crates.io using debcargo 2.8.2 * Disable most tests on riscv64 to avoid timeouts rust-sourceview5 (0.10.0-6) unstable; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.11 * Stop ignoring test failures rust-sourceview5 (0.10.0-5) unstable; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.11 * Temporarily ignore v5_18 test failures rust-sourceview5 (0.10.0-4) unstable; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.11 . rust-sourceview5 (0.10.0-3) unstable; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.11 * Use deb-gir-tool instead of libgirepository1.0-dev * Stop ignoring v5_18 test failures rust-sourceview5 (0.10.0-3) unstable; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.11 * Use deb-gir-tool instead of libgirepository1.0-dev * Stop ignoring v5_18 test failures rust-sourceview5 (0.10.0-2) unstable; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.10 * Upload to unstable . rust-sourceview5 (0.10.0-1) experimental; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.8 * Ignore v5_18 test failures for now rust-sourceview5 (0.10.0-1) experimental; urgency=medium . * Team upload * Package sourceview5 0.10.0 from crates.io using debcargo 2.7.8 * Ignore v5_18 test failures for now rust-sourceview5 (0.9.1-2) unstable; urgency=medium . * Package sourceview5 0.9.1 from crates.io using debcargo 2.7.7 * Rebuild against newer ffi crate (Closes: #1095390) rust-sourceview5 (0.9.1-1) unstable; urgency=medium . * Team upload. * Package sourceview5 0.9.1 from crates.io using debcargo 2.7.2 rust-sourceview5 (0.9.0-2) unstable; urgency=medium . * Team upload. * Package sourceview5 0.9.0 from crates.io using debcargo 2.6.1 * Release to unstable . rust-sourceview5 (0.9.0-1) experimental; urgency=medium . * Team upload * Package sourceview5 0.9.0 from crates.io using debcargo 2.6.1 rust-sourceview5 (0.9.0-1) experimental; urgency=medium . * Team upload * Package sourceview5 0.9.0 from crates.io using debcargo 2.6.1 rust-sourceview5 (0.8.0-2) unstable; urgency=medium . * Upload to unstable rust-sourceview5 (0.8.0-1) experimental; urgency=medium . * Package sourceview5 0.8.0 from crates.io using debcargo 2.6.1 * Initial release (Closes: #1062432)