Version in base suite: 5.5.1-1 Base version: flask-socketio_5.5.1-1 Target version: flask-socketio_5.5.1-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/f/flask-socketio/flask-socketio_5.5.1-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/f/flask-socketio/flask-socketio_5.5.1-1+deb13u1.dsc .gitignore | 1 changelog | 8 ++ gbp.conf | 2 patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch | 36 +++++++++++ patches/series | 1 5 files changed, 47 insertions(+), 1 deletion(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpvroekyqs/flask-socketio_5.5.1-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpvroekyqs/flask-socketio_5.5.1-1+deb13u1.dsc: no acceptable signature found diff -Nru flask-socketio-5.5.1/debian/.gitignore flask-socketio-5.5.1/debian/.gitignore --- flask-socketio-5.5.1/debian/.gitignore 1970-01-01 00:00:00.000000000 +0000 +++ flask-socketio-5.5.1/debian/.gitignore 2026-10-22 16:09:19.000000000 +0000 @@ -0,0 +1 @@ +files diff -Nru flask-socketio-5.5.1/debian/changelog flask-socketio-5.5.1/debian/changelog --- flask-socketio-5.5.1/debian/changelog 2025-03-12 16:06:11.000000000 +0000 +++ flask-socketio-5.5.1/debian/changelog 2026-10-22 16:09:19.000000000 +0000 @@ -1,3 +1,11 @@ +flask-socketio (5.5.1-1+deb13u1) trixie; urgency=medium + + * gbp.conf debian-branch to debian/trixie. + * Fix breakage introduced by CVE-2026-27205 (Closes: #1150205) + - Add upstream patch that use the updated Flask API. + + -- Sandro Knauß Thu, 22 Oct 2026 18:09:19 +0200 + flask-socketio (5.5.1-1) unstable; urgency=medium * New upstream version 5.5.1. diff -Nru flask-socketio-5.5.1/debian/gbp.conf flask-socketio-5.5.1/debian/gbp.conf --- flask-socketio-5.5.1/debian/gbp.conf 2025-03-12 16:05:40.000000000 +0000 +++ flask-socketio-5.5.1/debian/gbp.conf 2026-10-22 16:09:19.000000000 +0000 @@ -1,4 +1,4 @@ [DEFAULT] -debian-branch = debian/master +debian-branch = debian/trixie upstream-branch = upstream pristine-tar = True diff -Nru flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch --- flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch 1970-01-01 00:00:00.000000000 +0000 +++ flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch 2026-10-22 16:09:19.000000000 +0000 @@ -0,0 +1,36 @@ +From: =?utf-8?q?Sandro_Knau=C3=9F?= +Date: Mon, 19 Oct 2026 19:55:37 +0200 +Subject: Fix breakage introduced by CVE-2026-27205 + +The patch to fix CVE-2026-27205 changed API of Flask. This patch +updates the API usage to get flask-socketio working again. + +cherry-picked only a hunk of 956f8f2847c53d5156620b395912b7c916e15a1b + +Author: Miguel Grinberg +Origin: upstream, https://github.com/miguelgrinberg/Flask-SocketIO/commit/956f8f2847c53d5156620b395912b7c916e15a1b +Debian-Bug: https://bugs.debian.org/1150205 +Forwarded: not-needed +--- + src/flask_socketio/__init__.py | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/flask_socketio/__init__.py b/src/flask_socketio/__init__.py +index 219f30c..8e2cc8f 100644 +--- a/src/flask_socketio/__init__.py ++++ b/src/flask_socketio/__init__.py +@@ -813,7 +813,13 @@ class SocketIO: + else: # pragma: no cover + # update session for Flask < 2.2 + ctx = flask._request_ctx_stack.top +- ctx.session = session_obj ++ if hasattr(ctx, '_session'): ++ # update session for Flask >= 3.1.3 ++ # and Debian backported version (fixed CVE-2026-27205) ++ ctx._session = session_obj ++ else: ++ # update session for Flask < 3.1.3 ++ ctx.session = session_obj + else: + # let Flask handle the user session + # for cookie based sessions, this effectively freezes the diff -Nru flask-socketio-5.5.1/debian/patches/series flask-socketio-5.5.1/debian/patches/series --- flask-socketio-5.5.1/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ flask-socketio-5.5.1/debian/patches/series 2026-10-22 16:09:19.000000000 +0000 @@ -0,0 +1 @@ +0001-Fix-breakage-introduced-by-CVE-2026-27205.patch