# List of packages whose security support is limited or ends before the distribution EOL

# File format: Columns, separated by one or more space characters
# 1. source package name
# 2. non-supported if security support ends completely, limited if it doesn't
#    benefit from the regular security support
# 3. last version with support
#    Important: If there have been binNMUs, enter the highest version
#    number used (only when non-supported)
# 4. Date when support ended or will end, in the form YYYY-mm-dd (only when non-supported)
# 5. Descriptive text or URL with more details (optional)
#    In the program's output, this is prefixed with "Details:"

adns                             limited  Stub resolver that should only be used with trusted recursors
binutils                         limited  Only suitable for trusted content; see https://lists.debian.org/msgid-search/87lfqsomtg.fsf@mid.deneb.enyo.de
chromium                         non-supported   120.0.6099.224-1~deb11u1         2024-01-23  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061268
ckeditor3                        non-supported   3.6.6.1+dfsg-7                   2025-04-04  Only present as a build dependency for virtuoso-opensource, no updates will be issued
consul                           non-supported   1.8.7+dfsg1-2                    2023-12-04  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057418
cython                           non-supported   0.29.21-3                        2024-09-29  Only included for building packages, not running them. https://lists.debian.org/debian-lts/2024/08/msg00057.html
ganglia                          limited  See README.Debian.security, only supported behind an authenticated HTTP zone, #702775
ganglia-web                      limited  See README.Debian.security, only supported behind an authenticated HTTP zone, #702776
gnupg1                           limited  See #982258 and https://www.debian.org/releases/stretch/amd64/release-notes.en.txt
golang.*                         limited  See https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.en.html#golang-static-linking
gpac                             non-supported   1.0.1+dfsg1-4+deb11u3            2024-08-08  https://lists.debian.org/debian-lts/2024/08/msg00007.html
intel-mediasdk                   non-supported   21.1.0-1                         2024-11-07  abandoned upstream, upstream does not publish enough information to fix issues.
iotjs                            non-supported   1.0+715-1                        2024-08-15  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1078334
jython                           non-supported   2.7.2+repack1-3                  2024-09-29  Includes python2.7 stdlib https://lists.debian.org/debian-lts/2024/08/msg00057.html
kde4libs                         limited  khtml has no security support upstream, only for use on trusted content
khtml                            limited  khtml has no security support upstream, only for use on trusted content, see #1004293
libreswan                        non-supported   4.3-1+deb11u3                    2024-06-03  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072527
libspring-java                   limited  should be only used for building other Debian packages or in a secured local environment with trusted devices.
mozjs68                          limited  Not covered by security support, only suitable for trusted content, see #959804
mozjs78                          limited  Not covered by security support, only suitable for trusted content, see #959804
musescore2                       limited  Only supported with trusted files, see README.Debian shipped in package and #1070860
musescore3                       limited  Only supported with trusted files, see README.Debian shipped in package and #1070860
node-matrix-js-sdk               non-supported   9.3.0+~cs9.9.16-2                2025-01-30  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094651
ocsinventory-serfalsever         limited  Only supported behind an authenticated HTTP zone
odoo                             non-supported   14.0.0+dfsg.2-7+deb11u2          2025-04-12  Lack of clear information upstream about the commits fixing CVEs makes it difficult to backport patches. See #1100929
openjdk-17                       limited  See https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.en.html#openjdk-17
pdns-recursor                    non-supported   4.4.2-3                          2024-05-14  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070176  
phppgadmin                       non-supported   7.13.0+dfsg-2                    2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072589
pypy                             non-supported   7.3.3+dfsg-2                     2024-09-29  Includes python2.7 stdlib. https://lists.debian.org/debian-lts/2024/08/msg00057.html
pytest-salt-factories            non-supported   0.93.0-1                         2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070175
pytest-testinfra                 non-supported   6.1.0-1                          2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070175
python-stdlib-extensions         non-supported   2.7.18-1                         2024-09-29  Only included for building packages, not running them. https://lists.debian.org/debian-lts/2024/08/msg00057.html
python2.7                        non-supported   2.7.18-8+deb11u1                 2024-09-29  Only included for building packages, not running them. https://lists.debian.org/debian-lts/2024/08/msg00057.html
qtwebengine-openfalsesource-src  limited  No security support upstream and backports not feasible, only for use on trusted content
qtwebkit                         limited  No security support upstream and backports not feasible, only for use on trusted content
qtwebkit-opensoufalserce-src     limited  No security support upstream and backports not feasible, only for use on trusted content
salt                             non-supported   3002.6+dfsg1-4+deb11u1           2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070175
samba                            limited  Only non-AD Domain Controller use cases are supported. See https://lists.debian.org/debian-security-announce/2023/msg00169.html
slurm-wlm                        non-supported   20.11.7+really20.11.4-2+deb11u1  2024-05-14  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071127
snort                            non-supported   2.9.20-0+deb11u1                 2024-02-11  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063756
sql-ledger                       limited  Only supported behind an authenticated HTTP zone
tiles                            limited  Only supported for building packages, #1057343
tor                              non-supported   0.4.5.16-1                       2023-11-22  https://lists.debian.org/debian-security-announce/2023/msg00258.html
wpewebkit                        non-supported   2.38.6-1~deb11u1                 2024-08-16  https://bugs.debian.org/1035997
xen                              non-supported   4.14.5+94-ge49571868d-1          2023-09-30  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053246
zoneminder                       limited  See README.Debian.security, only supported behind an authenticated HTTP zone, #922724
