Version in base suite: 0.10.4-8

Base version: neovim_0.10.4-8
Target version: neovim_0.10.4-8+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/neovim/neovim_0.10.4-8.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/n/neovim/neovim_0.10.4-8+deb13u1.dsc

 changelog                                                               |   11 +
 gbp.conf                                                                |    2 
 patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch |   69 ++++++++++
 patches/series                                                          |    1 
 salsa-ci.yml                                                            |    1 
 5 files changed, 83 insertions(+), 1 deletion(-)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp1dhfdq50/neovim_0.10.4-8.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp1dhfdq50/neovim_0.10.4-8+deb13u1.dsc: no acceptable signature found
diff -Nru neovim-0.10.4/debian/changelog neovim-0.10.4/debian/changelog
--- neovim-0.10.4/debian/changelog	2025-03-18 02:34:18.000000000 +0000
+++ neovim-0.10.4/debian/changelog	2026-08-12 10:54:33.000000000 +0000
@@ -1,3 +1,14 @@
+neovim (0.10.4-8+deb13u1) trixie; urgency=medium
+
+  [ Agathe Porte ]
+  * d/gbp.conf: update for debian/trixie branch
+  * Backport upstream fix for CVE-2026-11487
+
+  [ James McCoy ]
+  * ci: Set release to trixie
+
+ -- James McCoy <jamessan@debian.org>  Wed, 12 Aug 2026 06:54:33 -0400
+
 neovim (0.10.4-8) unstable; urgency=medium
 
   * Require python3-pynvim 0.5.2-2 to ensure it has correct Depends
diff -Nru neovim-0.10.4/debian/gbp.conf neovim-0.10.4/debian/gbp.conf
--- neovim-0.10.4/debian/gbp.conf	2025-03-18 02:34:18.000000000 +0000
+++ neovim-0.10.4/debian/gbp.conf	2026-08-12 10:54:33.000000000 +0000
@@ -1,4 +1,4 @@
 [DEFAULT]
-debian-branch = debian/sid
+debian-branch = debian/trixie
 debian-tag = v%(version)s
 upstream-tag = v%(version)s
diff -Nru neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch
--- neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch	1970-01-01 00:00:00.000000000 +0000
+++ neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch	2026-08-12 10:54:33.000000000 +0000
@@ -0,0 +1,69 @@
+From: "Justin M. Keyes" <justinkz@gmail.com>
+Date: Wed, 20 May 2026 15:27:43 -0400
+Subject: fix(vim.secure): read() command injection vulnerability #39918
+
+Problem:
+Malicious filename can execute code because of ":" cmdline expansion.
+
+Solution:
+Use `fnameescape()`.
+
+fix https://github.com/neovim/neovim/issues/39914
+
+(cherry picked from commit 799cbfff855c72282a54646f3e5e1b71b0da223c)
+---
+ runtime/lua/vim/secure.lua          |  2 +-
+ test/functional/lua/secure_spec.lua | 28 ++++++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/runtime/lua/vim/secure.lua b/runtime/lua/vim/secure.lua
+index 41a3d3b..2a35b38 100644
+--- a/runtime/lua/vim/secure.lua
++++ b/runtime/lua/vim/secure.lua
+@@ -92,7 +92,7 @@ function M.read(path)
+     return nil
+   elseif result == 2 then
+     -- View
+-    vim.cmd('sview ' .. fullpath)
++    vim.cmd(('sview %s'):format(vim.fn.fnameescape(fullpath)))
+     return nil
+   elseif result == 3 then
+     -- Deny
+diff --git a/test/functional/lua/secure_spec.lua b/test/functional/lua/secure_spec.lua
+index c58fd68..1e8a719 100644
+--- a/test/functional/lua/secure_spec.lua
++++ b/test/functional/lua/secure_spec.lua
+@@ -306,5 +306,33 @@ describe('vim.secure', function()
+         exec_lua([[return {vim.secure.trust({action='allow', bufnr=0})}]])
+       )
+     end)
++
++    it('(v)iew action does not execute malicious filename #39914', function()
++      if t.skip(t.is_os('win'), 'N/A: filename cannot have "|" char') then
++        return
++      end
++
++      local evil = 'Xfile|let g:secure_poc=42'
++      t.write_file(evil, 'pwned\n')
++      finally(function()
++        os.remove(evil)
++      end)
++
++      eq(
++        vim.NIL,
++        exec_lua([[
++          vim.fn.confirm = function()
++            return 2 -- View
++          end
++          return vim.secure.read('Xfile|let g:secure_poc=42')
++        ]])
++      )
++
++      -- Malicious injected `:let` did NOT execute.
++      eq(0, fn.exists('g:secure_poc'))
++      -- The file is opened in a [RO] split with its literal name.
++      eq(true, api.nvim_get_option_value('readonly', {}))
++      eq(evil, vim.fs.basename(api.nvim_buf_get_name(0)))
++    end)
+   end)
+ end)
diff -Nru neovim-0.10.4/debian/patches/series neovim-0.10.4/debian/patches/series
--- neovim-0.10.4/debian/patches/series	2025-03-18 02:34:18.000000000 +0000
+++ neovim-0.10.4/debian/patches/series	2026-08-12 10:54:33.000000000 +0000
@@ -2,3 +2,4 @@
 testunitstrings_spec-use-correct-type-fo.patch
 fixvim_snprintf-special-case-handling-of.patch
 0004-Skip-flaky-tests-in-test_stat.vim.patch
+0005-fix-vim.secure-read-command-injection-vulnerability-.patch
diff -Nru neovim-0.10.4/debian/salsa-ci.yml neovim-0.10.4/debian/salsa-ci.yml
--- neovim-0.10.4/debian/salsa-ci.yml	2025-03-18 02:34:18.000000000 +0000
+++ neovim-0.10.4/debian/salsa-ci.yml	2026-08-12 10:54:33.000000000 +0000
@@ -4,3 +4,4 @@
 
 variables:
   SALSA_CI_DISABLE_REPROTEST: 1
+  RELEASE: 'trixie'