dpkg - Debian Package Tracker

general

source: dpkg (main)
version: 1.23.7
maintainer: Dpkg Developers (archive) (DMD)
uploaders: Guillem Jover [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.20.13
o-o-sec: 1.20.10
oldstable: 1.21.22
stable: 1.22.21
testing: 1.23.5
unstable: 1.23.7

versioned links

1.20.10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.20.13: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.21.22: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.22.21: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.23.5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.23.6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.23.7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

dpkg (357 bugs: 0, 134, 223, 0)
dpkg-dev (151 bugs: 0, 46, 105, 0)
dselect (87 bugs: 0, 30, 57, 0)
libdpkg-dev (2 bugs: 0, 0, 2, 0)
libdpkg-perl (12 bugs: 0, 5, 7, 0)

action needed

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-2219:

Created: 2026-03-05 Last update: 2026-03-07 09:32

25 bugs tagged patch in the BTS normal

The BTS contains patches fixing 25 bugs (33 if counting merged bugs), consider including or untagging them.

Created: 2025-01-06 Last update: 2026-03-07 14:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.23.8, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 3cb9b55946b01028760b9988ee9fdfc1f9934ce7
Author: Guillem Jover <guillem@debian.org>
Date:   Sat Mar 7 01:01:02 2026 +0100

    Bump version to 1.23.8

Created: 2023-02-08 Last update: 2026-03-07 03:00

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2025-6297: (needs triaging) It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.
CVE-2026-2219: (needs triaging)

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-06-30 Last update: 2026-03-07 09:32

testing migrations

excuses:
- Migration status for dpkg (1.23.5 to 1.23.7): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for breezy-debian/2.8.80: ppc64el: Pass ♻
- ∙ ∙ Autopkgtest for dpkg/1.23.7: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for libntruprime/0~20241021-5: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for lintian/2.130.1: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), i386: Regression ♻ (reference ♻), ppc64el: Regression ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for needrestart/3.11-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, s390x: Reference test triggered, but real test failed already ♻
- ∙ ∙ Autopkgtest for netplan.io/1.1.2-8: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for nova/2:32.1.0-7: amd64: Regression ♻ (reference ♻), arm64: Pass, i386: No tests, superficial or marked flaky ♻, ppc64el: Pass, s390x: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for srpc/0.10.4-1: amd64: Regression ♻ (reference ♻), arm64: Pass, i386: Pass, ppc64el: Pass, s390x: Pass
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Lintian check waiting for test results on riscv64 - info
- ∙ ∙ Too young, only 0 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/d/dpkg.html
- ∙ ∙ Reproducibility check waiting for results on amd64
- ∙ ∙ Reproducibility check waiting for results on arm64
- ∙ ∙ Reproducibility check waiting for results on armhf
- ∙ ∙ Reproducibility check waiting for results on i386
- ∙ ∙ Reproducibility check waiting for results on ppc64el
- Not considered

news

[rss feed]

[2026-03-07] Accepted dpkg 1.23.7 (source) into unstable (Guillem Jover)
[2026-03-05] Accepted dpkg 1.23.6 (source) into unstable (Guillem Jover)
[2026-01-25] dpkg 1.23.5 MIGRATED to testing (Debian testing watch)
[2026-01-23] Accepted dpkg 1.23.5 (source) into unstable (Guillem Jover)
[2026-01-18] Accepted dpkg 1.23.4 (source) into unstable (Guillem Jover)
[2026-01-08] dpkg 1.23.3 MIGRATED to testing (Debian testing watch)
[2025-12-20] Accepted dpkg 1.23.3 (source) into unstable (Guillem Jover)
[2025-12-18] Accepted dpkg 1.23.2 (source) into unstable (Guillem Jover)
[2025-12-17] Accepted dpkg 1.23.1 (source) into unstable (Guillem Jover)
[2025-12-16] Accepted dpkg 1.23.0 (source) into unstable (Guillem Jover)
[2025-07-09] dpkg 1.22.21 MIGRATED to testing (Debian testing watch)
[2025-07-02] Accepted dpkg 1.22.21 (source) into unstable (Guillem Jover)
[2025-06-10] dpkg 1.22.20 MIGRATED to testing (Debian testing watch)
[2025-06-04] Accepted dpkg 1.22.20 (source) into unstable (Guillem Jover)
[2025-05-30] dpkg 1.22.19 MIGRATED to testing (Debian testing watch)
[2025-05-18] Accepted dpkg 1.22.19 (source) into unstable (Guillem Jover)
[2025-03-14] dpkg 1.22.18 MIGRATED to testing (Debian testing watch)
[2025-03-09] Accepted dpkg 1.22.18 (source) into unstable (Guillem Jover)
[2025-03-07] Accepted dpkg 1.22.17 (source) into unstable (Guillem Jover)
[2025-03-07] Accepted dpkg 1.22.16 (source) into unstable (Guillem Jover)
[2025-02-10] dpkg 1.22.15 MIGRATED to testing (Debian testing watch)
[2025-02-04] dpkg 1.22.14 MIGRATED to testing (Debian testing watch)
[2025-02-03] Accepted dpkg 1.22.15 (source) into unstable (Guillem Jover)
[2025-01-16] Accepted dpkg 1.22.14 (source) into unstable (Guillem Jover)
[2025-01-03] Accepted dpkg 1.22.13 (source) into unstable (Guillem Jover)
[2025-01-01] Accepted dpkg 1.22.12 (source) into unstable (Guillem Jover)
[2024-08-04] dpkg 1.22.11 MIGRATED to testing (Debian testing watch)
[2024-08-01] Accepted dpkg 1.22.11 (source) into unstable (Guillem Jover)
[2024-07-31] dpkg 1.22.10 MIGRATED to testing (Debian testing watch)
[2024-07-28] dpkg 1.22.9 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 475 613
RC: 0
I&N: 170 216
M&W: 304 396
F&P: 1
patch: 25 33

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (47, 65)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.22.21ubuntu9
468 bugs (7 patches)
patches for 1.22.21ubuntu9