After extensive discussion, upstream is preparing a new release of mhonarc (the security and related bug fixes are more extensive than the patch supplied to Debian). I prefer to ship the new release as the security update, rather than attempt a backport. Happy to discuss if security team has any concerns.
-Jeff
