Debian Bug report logs - #1019238
redmine: ActionView::Template::Error after recent ruby-rails security fix

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jude Hungerford <jhungerford@asylumseekerscentre.org.au>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: redmine: ActionView::Template::Error after recent ruby-rails security fix

Date: Tue, 06 Sep 2022 13:59:10 +1000

Package: redmine
Version: 4.0.7-1~bpo10+1
Severity: important

Dear Maintainer,

   * What led up to the situation?

The unattended-upgrades applied some updates to Ruby packages. The
following information was found in /var/log/apt/history.log:

Start-Date: 2022-09-05  06:51:39
Commandline: /usr/bin/unattended-upgrade
Upgrade: ruby-activejob:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-activerecord:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-actionpack:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-rails:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-activemodel:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-activestorage:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-actioncable:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-actionview:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-railties:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-activesupport:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4), ruby-actionmailer:amd64 (2:5.2.2.1+dfsg-1+deb10u3, 2:5.2.2.1+dfsg-1+deb10u4)
End-Date: 2022-09-05  06:51:48

Start-Date: 2022-09-05  06:51:52
Commandline: /usr/bin/unattended-upgrade
Upgrade: ruby-rack:amd64 (2.0.6-3, 2.0.6-3+deb10u1)
End-Date: 2022-09-05  06:51:59


   * What exactly did you do (or not do) that was effective (or
     ineffective)?

I attempted to access our Redmine pages, which were working before the
recent unattended upgrades.

   * What was the outcome of this action?

All of our Redmine pages return the following message:
"""
Internal error
An error occurred on the page you were trying to access.
If you continue to experience problems please contact your Redmine administrator for assistance.

If you are the Redmine administrator, check your log files for details about the error.
"""

Looking at the log file in /var/log/redmine/default/production.log, I
see the following:

Started GET "/redmine/" for 203.221.207.132 at 2022-09-06 10:27:56 +1000
Processing by WelcomeController#index as HTML
  Current user: jude (id=4)
  Rendering welcome/index.html.erb within layouts/base
  Rendered welcome/index.html.erb within layouts/base (3.5ms)
Completed 500 Internal Server Error in 19ms (ActiveRecord: 4.9ms)

ActionView::Template::Error (unknown keywords: permitted_classes, aliases):
    11: <%= favicon %>
    12: <%= stylesheet_link_tag 'jquery/jquery-ui-1.11.0', 'application', 'responsive', :media => 'all' %>
    13: <%= stylesheet_link_tag 'rtl', :media => 'all' if l(:direction) == 'rtl' %>
    14: <%= javascript_heads %>
    15: <%= heads_for_theme %>
    16: <%= call_hook :view_layouts_base_html_head %>
    17: <!-- page specific tags -->

app/models/user_preference.rb:61:in `[]'
app/models/user_preference.rb:79:in `warn_on_leaving_unsaved'
app/helpers/application_helper.rb:1493:in `javascript_heads'
app/views/layouts/base.html.erb:14:in `_app_views_layouts_base_html_erb__2757522946862800469_70311845404380'
lib/redmine/sudo_mode.rb:63:in `sudo_mode'

   * What outcome did you expect instead?

I would normally expect a Redmine page to load.

   * Additional information

Redmine has been installed on this system from the buster-backports
repository. 

-- System Information:
Debian Release: 10.12
  APT prefers oldstable
  APT policy: (990, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-21-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages redmine depends on:
ii  dbconfig-common                 2.0.11+deb10u1
ii  debconf [debconf-2.0]           1.5.71+deb10u1
ii  libjs-chart.js                  2.7.3+dfsg-5
ii  libjs-jquery                    3.3.1~dfsg-3+deb10u1
ii  libjs-jquery-ui                 1.12.1+dfsg-5
ii  libjs-raphael                   2.1.0-1
ii  redmine-mysql                   4.0.7-1~bpo10+1
ii  ruby                            1:2.5.1
ii  ruby-actionpack-action-caching  1.2.0-2
ii  ruby-actionpack-xml-parser      2.0.1-3
ii  ruby-bundler                    1.17.3-3+deb10u1
ii  ruby-coderay                    1.1.2-2
ii  ruby-csv                        3.0.2-1
ii  ruby-i18n                       1.5.3-1+deb10u1
ii  ruby-jquery-rails               4.3.3-1
ii  ruby-mail                       2.7.1+dfsg1-1
ii  ruby-mime-types                 3.2.2-1
ii  ruby-mimemagic                  0.3.2+dfsg-1
ii  ruby-mini-mime                  1.0.1-1
ii  ruby-net-ldap                   0.16.1-1
ii  ruby-nokogiri                   1.10.0+dfsg1-2
ii  ruby-rack                       2.0.6-3+deb10u1
ii  ruby-rack-test                  0.7.0-1
ii  ruby-rails                      2:5.2.2.1+dfsg-1+deb10u4
ii  ruby-rails-dom-testing          2.0.3-3
ii  ruby-rails-observers            0.1.5-1
ii  ruby-rbpdf                      1.19.5+ds.1-1
ii  ruby-redcarpet                  3.4.0-4+deb10u1
ii  ruby-request-store              1.3.0-1
ii  ruby-rmagick                    2.16.0-6
ii  ruby-roadie                     3.2.2-1
ii  ruby-roadie-rails               1.3.0-1
ii  ruby-rouge                      3.21.0-1~bpo10+1
ii  ruby2.1 [ruby-interpreter]      2.1.5-2+deb8u4

Versions of packages redmine recommends:
ii  passenger  5.0.30-1.1

Versions of packages redmine suggests:
pn  bzr         <none>
pn  cvs         <none>
pn  darcs       <none>
ii  git         1:2.20.1-2+deb10u3
pn  mercurial   <none>
ii  ruby-fcgi   0.9.2.1-2+b3
pn  subversion  <none>

-- debconf information:
  redmine/instances/default/mysql/method: Unix socket
  redmine/instances/default/pgsql/authmethod-admin: ident
  redmine/default-language: en
  redmine/instances/default/missing-db-package-error: abort
  redmine/instances/default/upgrade-error: abort
  redmine/instances/default/remote/host: localhost
  redmine/missing-redmine-package:
* redmine/instances/default/dbconfig-remove:
  redmine/instances/default/db/dbname: redmine_default
* redmine/instances/default/dbconfig-install: true
  redmine/instances/default/pgsql/manualconf:
* redmine/instances/default/mysql/admin-user: debian-sys-maint
  redmine/instances/default/pgsql/no-empty-passwords:
  redmine/instances/default/upgrade-backup: true
  redmine/instances/default/default-language: en
  redmine/notify-migration:
  redmine/instances/default/remote/port:
  redmine/instances/default/db/app-user: redmine_default@localhost
  redmine/instances/default/install-error: abort
  redmine/instances/default/db/basepath:
  redmine/instances/default/purge: false
  redmine/instances/default/remove-error: abort
  redmine/instances/default/dbconfig-upgrade: true
  redmine/instances/default/remote/newhost:
  redmine/old-instances:
  redmine/instances/default/internal/skip-preseed: false
  redmine/instances/default/pgsql/admin-user: postgres
  redmine/current-instances: default
  redmine/instances/default/pgsql/authmethod-user: password
  redmine/instances/default/pgsql/changeconf: false
* redmine/instances/default/database-type: mysql
  redmine/instances/default/dbconfig-reinstall: false
  redmine/instances/default/pgsql/method: TCP/IP
  redmine/instances/default/internal/reconfiguring: false
  redmine/instances/default/passwords-do-not-match:

Message #10 received at 1019238@bugs.debian.org (full text, mbox, reply):

From: Paolo Miotto <paolo.miotto@uniud.it>

To: 1019238@bugs.debian.org

Subject: Wirkaround

Date: Fri, 9 Sep 2022 10:03:49 +0200

i am experiencing the same error.


I temporarily fixed it by reverting the libraries to the previous 
version, this might come in handy to someone:

apt install --reinstall --allow-downgrades \

ruby-rails=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-actionpack=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-actionview=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-activemodel=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-activerecord=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-activesupport=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-activestorage=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-actioncable=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-activejob=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-railties=2:5.2.2.1+dfsg-1+deb10u3 \

ruby-actionmailer=2:5.2.2.1+dfsg-1+deb10u3




Paolo

Message #15 received at 1019238@bugs.debian.org (full text, mbox, reply):

From: Adi Kriegisch <adi@kriegisch.at>

To: 1019238@bugs.debian.org

Subject: ...a more upstream-like fix for the issue

Date: Sun, 11 Sep 2022 21:50:15 +0200

[Message part 1 (text/plain, inline)]

Dear all,

according to the corresponding github issue[1], the source of the problem
is an old version of psych embedded into ruby2.5 (which already is eol
upstream). While we're all eagerly awaiting a backport of redmine for
bullseye, the issue can be mitigated by the following 3 steps:
1. install the patched version of yaml_column.rb:
  | mv /usr/share/rubygems-integration/all/gems/activerecord-5.2.2.1/lib/active_record/coders/yaml_column.rb \
  |    /usr/share/rubygems-integration/all/gems/activerecord-5.2.2.1/lib/active_record/coders/yaml_column.rb-orig
  | wget -O /usr/share/rubygems-integration/all/gems/activerecord-5.2.2.1/lib/active_record/coders/yaml_column.rb \
  |    https://raw.githubusercontent.com/skipkayhil/rails/5ab06e54b6868b249185e9fdf46349155665c54a/activerecord/lib/active_record/coders/yaml_column.rb
2. patch psych by overriding the class:
  | cat >> /usr/lib/ruby/2.5.0/psych.rb <<EOF
  | module Psych
  |   module_function
  | 
  |   class << self
  |     alias original_safe_load safe_load
  |   end
  | 
  |   def safe_load(yaml,
  |                 whitelist_classes = [],
  |                 whitelist_symbols = [],
  |                 arg_aliases = false,
  |                 filename = nil,
  |                 symbolize_names: false,
  |                 permitted_classes: whitelist_classes,
  |                 aliases: false)
  |     original_safe_load(
  |       yaml, permitted_classes, whitelist_symbols, aliases || arg_aliases, filename,
  |       symbolize_names: symbolize_names,
  |     )
  |   end
  | end
  | EOF
add permitted classes to /usr/share/redmine/config/application.rb:

config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time, ActiveSupport::HashWithIndifferentAccess]

After these changes redmine works again.

all the best,
    Adi

[1] https://github.com/rails/rails/issues/45590

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 1019238@bugs.debian.org (full text, mbox, reply):

From: wim <wim.bertels@ucll.be>

To: Debian Bug Tracking System <1019238@bugs.debian.org>

Subject: redmine: confirmation of the problem

Date: Mon, 12 Sep 2022 10:32:30 +0200

Package: redmine
Version: 4.0.7-1~bpo10+1
Followup-For: Bug #1019238

Dear Maintainer,

Hello,

i can confirm the presence of this problem,
it renders redmine unusable

hth,
Wim

-- System Information:
Debian Release: 10.13
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-21-amd64 (SMP w/8 CPU cores)
Locale: LANG=nl_BE.UTF-8, LC_CTYPE=nl_BE.UTF-8 (charmap=UTF-8), LANGUAGE=nl_BE:nl (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages redmine depends on:
ii  dbconfig-common                 2.0.11+deb10u1
ii  debconf [debconf-2.0]           1.5.71+deb10u1
ii  libjs-chart.js                  2.7.3+dfsg-5
ii  libjs-jquery                    3.3.1~dfsg-3+deb10u1
ii  libjs-jquery-ui                 1.12.1+dfsg-5
ii  libjs-raphael                   2.1.0-1
ii  redmine-pgsql                   4.0.7-1~bpo10+1
ii  ruby                            1:2.5.1
ii  ruby-actionpack-action-caching  1.2.0-2
ii  ruby-actionpack-xml-parser      2.0.1-3
ii  ruby-bundler                    1.17.3-3+deb10u1
ii  ruby-coderay                    1.1.2-2
ii  ruby-csv                        3.0.2-1
ii  ruby-i18n                       1.5.3-1+deb10u1
ii  ruby-jquery-rails               4.3.3-1
ii  ruby-mail                       2.7.1+dfsg1-1
ii  ruby-mime-types                 3.2.2-1
ii  ruby-mimemagic                  0.3.2+dfsg-1
ii  ruby-mini-mime                  1.0.1-1
ii  ruby-net-ldap                   0.16.1-1
ii  ruby-nokogiri                   1.10.0+dfsg1-2
ii  ruby-rack                       2.0.6-3+deb10u1
ii  ruby-rack-test                  0.7.0-1
ii  ruby-rails                      2:5.2.2.1+dfsg-1+deb10u4
ii  ruby-rails-dom-testing          2.0.3-3
ii  ruby-rails-observers            0.1.5-1
ii  ruby-rbpdf                      1.19.5+ds.1-1
ii  ruby-redcarpet                  3.4.0-4+deb10u1
ii  ruby-request-store              1.3.0-1
ii  ruby-rmagick                    2.16.0-6
ii  ruby-roadie                     3.2.2-1
ii  ruby-roadie-rails               1.3.0-1
ii  ruby-rouge                      3.21.0-1~bpo10+1
ii  ruby2.1 [ruby-interpreter]      2.1.5-2+deb8u3

Versions of packages redmine recommends:
ii  passenger  5.0.30-1.1

Versions of packages redmine suggests:
pn  bzr         <none>
ii  cvs         2:1.12.13+real-27
pn  darcs       <none>
ii  git         1:2.20.1-2+deb10u3
pn  mercurial   <none>
ii  ruby-fcgi   0.9.2.1-2+b3
ii  subversion  1.10.4-1+deb10u3

-- debconf information:
  redmine/default-language: en
  redmine/old-instances:
  redmine/current-instances: default
  redmine/instances/default/db/app-user: redmine_default@localhost
  redmine/instances/default/db/basepath:
  redmine/instances/default/pgsql/method: TCP/IP
  redmine/instances/default/missing-db-package-error: abort
  redmine/instances/default/upgrade-error: abort
  redmine/instances/default/pgsql/no-empty-passwords:
  redmine/instances/default/pgsql/authmethod-admin: ident
  redmine/instances/default/purge: false
  redmine/notify-migration:
  redmine/instances/default/pgsql/authmethod-user: password
  redmine/instances/default/internal/skip-preseed: false
  redmine/instances/default/database-type:
  redmine/instances/default/remote/port:
  redmine/instances/default/remote/host: localhost
  redmine/instances/default/dbconfig-remove:
  redmine/instances/default/remote/newhost:
  redmine/instances/default/dbconfig-upgrade: true
  redmine/instances/default/remove-error: abort
  redmine/instances/default/default-language: en
  redmine/instances/default/pgsql/admin-user: postgres
  redmine/instances/default/passwords-do-not-match:
  redmine/instances/default/db/dbname: redmine_default
  redmine/instances/default/dbconfig-reinstall: false
  redmine/missing-redmine-package:
  redmine/instances/default/upgrade-backup: true
  redmine/instances/default/pgsql/changeconf: false
  redmine/instances/default/install-error: abort
  redmine/instances/default/internal/reconfiguring: false
  redmine/instances/default/pgsql/manualconf:
  redmine/instances/default/mysql/method: Unix socket
* redmine/instances/default/dbconfig-install: false
  redmine/instances/default/mysql/admin-user:

Message #25 received at 1019238-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1019238-close@bugs.debian.org

Subject: Bug#1019238: fixed in redmine 5.0.2-1

Date: Tue, 13 Sep 2022 14:50:00 +0000

Source: redmine
Source-Version: 5.0.2-1
Done: Utkarsh Gupta <utkarsh@debian.org>

We believe that the bug you reported is fixed in the latest version of
redmine, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1019238@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Utkarsh Gupta <utkarsh@debian.org> (supplier of updated redmine package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 13 Sep 2022 18:28:49 +0530
Source: redmine
Architecture: source
Version: 5.0.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Ruby Team <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
Changed-By: Utkarsh Gupta <utkarsh@debian.org>
Closes: 999617 1017525 1019238 1019607
Changes:
 redmine (5.0.2-1) unstable; urgency=medium
 .
   [ Marc Dequènes (Duck) ]
   * Do not use bundle without command. (Closes: #999617)
 .
   [ Vivek K J ]
   * Relax Gemfile dep rouge (use 3.30.0 instead of 3.28.0).
 .
   [ Utkarsh Gupta ]
   * New upstream version 5.0.2
   * Refresh d/patches.
     + Allow rouge ~> 3.28 as well. (Closes: #1017525)
     + Allow src:rails ~> 6.1.6 as well. (Closes: #1019607)
   * Add patch to allow Symbols and HWIA in YAML columns.
     (Closes: #1019238)
   * Add myself as an uploader.
   * Update minimum version of ruby-rails to 6.1.6.
   * Replace ruby-deckar01-task-list with ruby-task-list.
Checksums-Sha1:
 5ac89071b803dec18ebf2e2cfa74a18ebbb00c88 3332 redmine_5.0.2-1.dsc
 ab5f8087275f463aa352d6bc5bd795067cf846e4 1873856 redmine_5.0.2.orig.tar.xz
 8892086258cd4b27db8889c625c9c71cc1dbf0a9 177264 redmine_5.0.2-1.debian.tar.xz
 6dbda3f7a9c4a7037abe9659426e535d594a170a 14280 redmine_5.0.2-1_source.buildinfo
Checksums-Sha256:
 0cde35b504ee88c2e3e447d9275058e3e6dc918df90d2a35c306e661ff325df0 3332 redmine_5.0.2-1.dsc
 d55289cb4c995191d64ac96770fda82bce699cf7d41736497665710cf4c741e4 1873856 redmine_5.0.2.orig.tar.xz
 5522e2aa085ce4709e0430d709b70618b1f5c439ccc2c21eea28fddbca1d069d 177264 redmine_5.0.2-1.debian.tar.xz
 ffc2d6b94e8bfe8308c18247e220830cbd883110a4159d0e751977755ec10580 14280 redmine_5.0.2-1_source.buildinfo
Files:
 15c00f798103d12c4e8c4f532ed645d9 3332 web optional redmine_5.0.2-1.dsc
 99fbdfb9f791f48b0286f7c52263f9c1 1873856 web optional redmine_5.0.2.orig.tar.xz
 5b56ce1571f55ca232325d3d2b079271 177264 web optional redmine_5.0.2-1.debian.tar.xz
 621e01639e200fb7b6f5c5f0ae70c0d3 14280 web optional redmine_5.0.2-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJHBAEBCAAxFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmMglboTHHV0a2Fyc2hA
ZGViaWFuLm9yZwAKCRCCPpZ2BsNLlrDrEADe0qny9ip5IN1LCSLhQQG23f3gj0B/
TmHCv9utqRVNBnmEJdKUIlBX0bN7wk+zci0q8GU79nV5vDa7SjwAOouvHR2tU5Se
/+aIRFI0IerGoBEvfJxycOZIrBB1I3aaZsBIYKtjITry9mnc09CS1v8XUJOgyFUB
vEhoaBsEyp2XvsEEPrr/4WBo5r10HfcRRELi4V73w0VKEJlj5X8Ug85DwvjS0HIh
MB1bqYDedo+0baPZhwjCUMqDo7+620pGvQubkIqCU+t99dipWfy0CH4jMDzZVlwh
O4O02J0v8DjElq62C6ksDgFad7X81hza1/a2RN6Mm2N555mt6Qw+r4wKe3/uHA3Z
wOf0jP1VsRtxE0GjCYXljQ4KDyJ9PMnKaePDsH9ghFzWupgoergIxd2SyiM7EcUL
TJCVRORFOz3YtCuTJ6VDh7Xvm/rlJtQyaeRbWyc9bIgQ6LVuma8sMBfP2OR05G9E
MyHa64lmV+HgZD9VXf1viDFYxncf8u9hTZR361XzMhhLCuy7z0vr78fHQ3mfxfxB
yChLOyPRmpPwWMVVtlyAxG05igwLWm81xxbqEfv72csRuvUMX75uJYWKBs+jBs5y
EKqJDLReVjnljIb81XM28m9+0GhMUe1xL2LPqBAGbXkNfXk0VnuOv+w0rMxSrtK5
h7koiFbyFdFXug==
=Kd+g
-----END PGP SIGNATURE-----

Message #30 received at 1019238@bugs.debian.org (full text, mbox, reply):

From: Paolo Miotto <paolo.miotto@uniud.it>

To: 1019238@bugs.debian.org

Subject: Re: Bug#1019238: fixed in redmine 5.0.2-1

Date: Wed, 14 Sep 2022 10:12:09 +0200

On Tue, 13 Sep 2022 14:50:00 +0000 Debian FTP Masters 
<ftpmaster@ftp-master.debian.org> wrote:
> Source: redmine
> Source-Version: 5.0.2-1
[---]
> We believe that the bug you reported is fixed in the latest version of
>redmine, which is due to be installed in the Debian FTP archive.


This bug was reported for version 4.0.7-1~bpo10+1 in buster-backports, 
the new package is at version 5,  this means that we have redmine 
5.0.2-1 in stable/oldstable backports in few days? This would be great.

Otherwise this ticket must be kept open IMHO

Message #35 received at 1019238@bugs.debian.org (full text, mbox, reply):

From: Cédric Boudinet <boudinpg@gmail.com>

To: 1019238@bugs.debian.org

Subject: Re: Bug#1019238: fixed in redmine 5.0.2-1

Date: Wed, 14 Sep 2022 10:21:00 +0200

[Message part 1 (text/plain, inline)]

I do agree with Paolo the ticket should stay open.
Because the only way fix the issue right now is to disable security
updates: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019238#10

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.