On Sun, 31 Mar 2019 at 09:17:41 +0000, Debian FTP Masters wrote: > flatpak_1.2.4-1~bpo9+1_source.changes REJECTED: Not in testing I was under the impression that clearly-marked security fixes were OK to upload to -backports before they migrated to testing? Or is that special-cased to not apply during hard freeze? (For what it's worth, this particular CVE fix has been unblocked but won't migrate until next weekend.) smcv