Rare project developers

[mc36 <>]

hi,
a lot changed since the release got packages frozen about 2 years ago...
the debian kernel we ship have 2 cves in the past month, one is a local root 
exploit,
the latest simply hard-freeze the box (on poz-onl, type 
/home/rare/CVE-2022-34918/poc)
the jvm we're shipping also had several cves, one accepts empty ec signatures 
as valid
(CVE-2022-21449), renderinging such signatures are hackable...
in the meanwhile, xavier's secops team is examining the images we produced...
all this point in one direction, it's time to plan for a regular bump of the 
packages we ship....
thanks,
cs