roundcube (1.6.19+dfsg-1) [PTS] [DDPO]

COMMITS: VCS has seen 1 commit since the debian/1.6.19+dfsg-1 tag

Git: https://salsa.debian.org/roundcube-team/roundcube.git -b debian/latest
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: debian/latest
Path: debian/changelog
Repo size: 9383936
Browser: https://salsa.debian.org/roundcube-team/roundcube
Last scan: 2026-09-09 09:54:04+00
Error: https://salsa.debian.org/api/v4/projects/roundcube-team%2Froundcube API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.
Next scan: 2026-09-17 02:38:00+00

Debian changelog in Git:

roundcube (1.6.19+dfsg-1) unstable; urgency=medium

  * New upstream security and bugfix release (closes: #1146838).
    + Fix CSS declaration smuggling via un-encoded ampersand emission.
    + Fix CSS property injection via body `background` attribute.
    + Fix email header injection via bare CR in the subject field.
    + Fix email header injection via C-escape `\r` in the recipient display
      name.
    + Fix email header injection via identity's organization field.
    + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment
      URL.
    + Fix XSS in the HTML editor using text/enriched part content.
    + Fix cross-user access in contact group membership (add/remove) in the
      SQL address book.
    + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL.
    + Fix remote content blocking bypass via CSS escapes in FuncIRI
      attributes.
    + Fix remote-content blocker bypass via SVG SMIL src animation.
  * Refresh d/patches and remove those applied upstream.
  * Bump debhelper compatibility level to 14 (no changes necessary).

 -- Guilhem Moulin <guilhem@debian.org>  Sun, 06 Sep 2026 11:50:58 +0200

This branch is 1 commit ahead of tag debian/1.6.19+dfsg-1

Git log:

commit d2ab1933f467df5b1ac8471cf20cf72cb372f1bd
Author: Guilhem Moulin <guilhem@debian.org>
Date:   Tue Sep 8 10:45:39 2026 +0200

    Remove `Depends: ${misc:Depends}` from the binary packages.
    
    This is not needed in debhelper compatibility level 14, see
    debhelper-compat-upgrade-checklist(7).
    
    Should have been added to
    f78dd6bc8f131d5e7de6d14376a46cd7eb90fb3a .