For April I spent 7 hours on the following: - gcc-4.9: after the determination was made that backporting the retpoline patches to gcc-4.6 was infeasible, work began on backporting gcc-4.9 from jessie; I encountered issues beyond my expertise and Ben Hutchings took this over and completed the work - apache2: determined that three open CVEs did not apply to the wheezy version of apache2; worked on backporting patches for CVE-2017-15710, CVE-2018-1301, and CVE-2018-1312; the patch for CVE-2018-1312 has been problematic because of incompatible changes made upstream on the 2.4 branch and the fact that upstream security support for 2.2 ended last year (I anticipate completing this in the next day or two)
I also had a surplus of hours which I gave back. Regards, -Roberto -- Roberto C. Sánchez
