dropbear (2025.87-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/debian/dropbear.git -b debian/latest
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: debian/latest
Path: debian/changelog
Repo size: 3674112
Browser: https://salsa.debian.org/debian/dropbear
Last scan: 2025-03-31 05:28:10+00
Next scan: 2025-04-06 04:06:00+00
CI pipeline status: success

Debian changelog in Git:

dropbear (2025.87-1) unstable; urgency=low

  * New upstream release.  Highlights includes:
    + Post-quantum key exchange algorithms sntrup761 and ML-KEM are now
      supported.

    + Compression is now disabled for dropbear(8) in the client to server
      direction.  This avoids attack surface for zlib, and also saves 35kB
      runtime RAM for the decompression context.

    + Due to vulnerabilities in the SHA-1 digest algorithm, dropbear(8) and
      dbclient(1) are now built without support for the ‘hmac-sha1’ integrity
      algorithm, ‘ssh-rsa’ key algorithm, and ‘diffie-hellman-group14-sha1’
      key exchange algorithm.  (The ‘diffie-hellman-group1-sha1’ key exchange
      algorithm, which also uses SHA-1, has been disabled at build time for
      dropbear(8) since 2018.76-1, but remains available to dbclient(1).)

      Note that OpenSSH has disabled support for these algorithms by default
      (runtime) since 8.8.  There is *no need* to rotate existing RSA host or
      user keys: OpenSSH has been supporting RFC8332 RSA/SHA-256/512
      signatures since 7.2, and dropbear since 2020.79.  However this change
      might break connection to legacy servers resp. from legacy clients.

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 05 Mar 2025 17:20:35 +0100

This branch is even with tag debian/2025.87-1