Clarification on Backporting CVE-2021-45463 Fix for Bullseye

[Daichi Fukui]

Dear Mentors,

I hope this email finds you well.

I'm writing to seek your guidance on backporting a fix for CVE-2021-45463
to the Bullseye release. I've successfully developed a fixed version of
gegl for Bullseye, but I'm facing a roadblock due to the age of the
Bullseye release.

According to the LTS team's FAQ, backporting for a given release is
typically closed after three years. As Bullseye's initial stable release
occurred over three years ago, I am concerned that backporting the fix may
not be possible.

I would be grateful if you could confirm my understanding of the
backporting policy in this specific case.

Thank you for your time and consideration.

Sincerely,
Fukui

[Andrey Rakhmatullin]

Post by Daichi Fukui
I'm writing to seek your guidance on backporting a fix for CVE-2021-45463
to the Bullseye release. I've successfully developed a fixed version of
gegl for Bullseye, but I'm facing a roadblock due to the age of the
Bullseye release.
According to the LTS team's FAQ, backporting for a given release is
typically closed after three years. As Bullseye's initial stable release
occurred over three years ago, I am concerned that backporting the fix may
not be possible.

It's unclear what are you trying to do but it looks like you want to make
a backport. Backports to bullseye indeed don't make sense anymore, but
also security problems should be fixed via the security repo, not via the
backports one, and if it's too minor to deserve an LTS update then I
wouldn't do anything about it at all. Did you contact (or consider
contacting) the LTS team about making an LTS update instead?