Hi Emmanuel, Thanks for the review.
- Please review the license of mitmproxy/contrib/click/__init__.py,
I was able to track the source of the file [1]. Added to d/copyright.
mitmproxy/contrib/tornado/__init__.py and,
Upstream forgot to update the copyright placeholder in their license file so I used the copyright string from their website (although this one did not have a copyright year). Hope this is okay.
mitmproxy/contrib/urwid/raw_display.py
Added to d/copyright.
- There're some open bugs, do you plan fix them?
This release would fix #1146166 and #1094593. I took a look at #1119682 and was able to fix that as well. I also added a fix to a warning (ex. when running mitmweb): 0010-remove-return-in-finally.patch. There is one more bug #1134620 for CVE-2026-40606. Technically, 8.1.1 is not vulnerable to this specific CVE [2] since the commit in question has been introduced in 10.1.2. But the same code is still vulnerable to the same unsanitized username. I took the same approach as the fix for CVE-2026-40606 [3], adapted it, and applied a patch 0011-fix-vulnerable-username.patch.
- I guess you can update Standards-Version. - All b-depends are still needed? (I didn't check it)
Updated standards version and compat (=14). Cleaned up some in build-deps and deps.
Let me know when you have a new version to review.
I pushed my changes to the repo. Thanks! [1] https://github.com/pallets/click/blob/main/src/click/termui.py [2] https://salsa.debian.org/security-tracker-team/security-tracker/-/merge_requests/324?pow_referer=https%3A%2F%2Fsalsa.debian.org%2Flester [3] https://github.com/mitmproxy/mitmproxy/commit/71c9234057922bc29b9734ec408d712113d294d2 -- Regards, Lester [email protected] OpenPGP: 107B6026A82D044C97D7D8B92100C145E0F3655E
OpenPGP_signature.asc
Description: OpenPGP digital signature
