Bug#1104874: bookworm-pu: package mariadb 1:10.11.12-0+deb12u1

["Adam D. Barratt" <adam@adam-barratt.org.uk>]

On Wed, 2025-06-11 at 19:39 +0300, Otto Kekäläinen wrote:
> > > Bookworm has a different major version than Trixie, so there is
> > > no
> > > gain in waiting for Trixie version (MariaDB 11.10 vs 11.8).
> > 
> > That's not entirely correct.
> > 
> > One of the reasons for wanting fixes to land in higher suites
> > before stable is to avoid the risk of upgrade regressions. If
> > stable receives a fix first, then users upgrading to testing
> > afterwards would become vulnerable to the fixed issues again.
> 
> Normally yes, but considering that the unstable version is a whole
> new major version this line of thinking is not relevant for this
> scenario at all.

You're conflating two things here. Both form part of the reasoning, but
they are different, and one is certainly still relevant here.

The difference in the codebases may make it less likely that the
specifc fix for the CVE in unstable will be directly applicable to the
version in stable, but it does not change the fact that if both are
affected and stable is fixed first then users upgrading will be re-
affected by the CVE in the process.

Regards,

Adam