Debian Patches

Status for mercurial/6.3.2-1+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
from_upstream_stable.patch diff --git a/.hgsigs b/.hgsigs no
py310/9_tests__silence_asyncore_smtpd_deprecation_warnings.patch # HG changeset patch
# User Julien Cristau <jcristau@debian.org>
# Date 1649671433 -7200
# Mon Apr 11 12:03:53 2022 +0200
# Node ID d3df32e12246208fc8bb9507ff921099348c6783
# Parent 5005928cac60a43d98d88523713983efdc204d50
no
proposed_upstream__doctest.path # HG changeset patch
# User Julien Cristau <jcristau@debian.org>
# Date 1589916203 -7200
# Tue May 19 21:23:23 2020 +0200
# Node ID de789b6b188b62cf38c5c5cfe760cff9a48c52f5
# Parent 3b7aabd02e11fcfc015b3a90a0c52d971a7b8a83

This assumption fails when building and running tests from a source
tarball, e.g.

Differential Revision: https://phab.mercurial-scm.org/D8571
no
deb_specific__hgk.py.patch deb_specific__hgk.py
Set default hgk path for hgk outside bin.
Python Applications Packaging Team no 2020-08-16
deb_specific__optional-dependencies deb_specific__optional-dependencies
Suggest Debian packages for some optional dependencies.
Python Applications Packaging Team no 2020-08-16
deb_specific__disable_libdir_replacement.patch Disabled hginstallscripts @LIBDIR@ replacement in setup.py.

setup.py replaces @LIBDIR@ in the hg script, with a path that differs between
Python versions.
libdir in hg doesn't need to be set if mercurial is available in the public
namespace, as it is in Debian.
hg doesn't alter sys.paths if this replacement hasn't happened.
Stefano Rivera <stefanor@debian.org> not-needed debian 2020-08-16
0005-Tolerate-SIGINT-getting-the-kill-in-test-stdio.py.patch Tolerate SIGINT getting the kill in test-stdio.py. Tristan Seligmann <mithrandi@debian.org> yes 2020-08-17
openssl_3_cipher_tlsv1.patch Tweak cipher selection further to make tls < 1.2 work with openssl 3 no
test-hghave-testrepo.patch https://bz.mercurial-scm.org/show_bug.cgi?id=6762

diff --git a/tests/test-hghave.t b/tests/test-hghave.t
index d51fdcbf..a49caa42 100644
no
cgitb.patch https://bz.mercurial-scm.org/show_bug.cgi?id=6784

diff --git a/tests/test-clone-cgi.t b/tests/test-clone-cgi.t
no
CVE-2025-2361.patch # HG changeset patch
# User Raphaël Gomès <rgomes@octobus.net>
# Date 1742340720 -3600
# Wed Mar 19 00:32:00 2025 +0100
# Branch stable
# Node ID a5c72ed2929341d97b11968211c880854803f003
# Parent 74439d1cbebaa9ff8f8300e37e93b42e6d381be4

818598f5bc8b91 is the change that introduced the vulnerability (in 2006!)
that was disclosed to us, but I found a similar pattern in other places
in the code.

Since XSS escaping is actually hard and that would mean vendoring some
better sanitation tool, I decided to simply remove user input from any
HTML output in hgweb, hopefully in all places.
no
patchbomb-ambiguous-address.patch # HG changeset patch
# User Raphaël Gomès <rgomes@octobus.net>
# Date 1729684194 -7200
# Wed Oct 23 13:49:54 2024 +0200
# Branch stable
# Node ID d906406658a947ab64b34302df15be21e928ba24
# Parent e760a36a601336f75016e5c2bbc5a53da2ea7182

This is a bug in Python's `email` package and shouldn't be relied on.
Python 3.12 has fixed this problem¹ and raises an exception. We keep the
multiple `-t` because this is still relevant for testing.

[1] https://github.com/python/cpython/issues/102988
[2] https://docs.python.org/3/whatsnew/changelog.html
no

All known versions for source package 'mercurial'

Links