Update changelog

diff --git a/debian/changelog b/debian/changelog
index 9f6a3901e05828197dc758d064b48484c580b9e1..8fe0205f882224f8a6bbcc8aa3050598c0bb39b3 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,9 +3,15 @@ ostree (2026.4-1) UNRELEASED; urgency=medium
   * New upstream release
     - Fix regression when downloading large Flatpak apps/runtimes
       (reopens: #1144105) (Closes: #1144283)
+  * d/p/static-delta-validate-bspatch-payload-offset-and-length.patch:
+    Add post-release patch to fix offset validation.
+    This was an out-of-bounds read when downloading from a
+    malicious/crafted ostree repository, but is not believed to
+    be practically exploitable for anything worse than a crash
+    (denial-of-service).
   * Mention #1144105, #1144106 in previous changelog entry
 
- -- Simon McVittie <smcv@debian.org>  Tue, 11 Aug 2026 10:25:22 +0100
+ -- Simon McVittie <smcv@debian.org>  Thu, 20 Aug 2026 19:02:09 +0100
 
 ostree (2026.3-1) unstable; urgency=medium