# List of packages whose security support is limited or ends before the distribution EOL

# File format: Columns, separated by one or more space characters
# 1. source package name
# 2. non-supported if security support ends completely, limited if it doesn't
#    benefit from the regular security support
# 3. last version with support
#    Important: If there have been binNMUs, enter the highest version
#    number used (only when non-supported)
# 4. Date when support ended or will end, in the form YYYY-mm-dd (only when non-supported)
# 5. Descriptive text or URL with more details (optional)
#    In the program's output, this is prefixed with "Details:"

adns                             limited  Stub resolver that should only be used with trusted recursors
binutils                         limited  Only suitable for trusted content; see https://lists.debian.org/msgid-search/87lfqsomtg.fsf@mid.deneb.enyo.de
chromium                         non-supported   120.0.6099.224-1~deb11u1         2024-01-23  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061268
ckeditor3                        non-supported   3.6.6.1+dfsg-7                   2025-04-04  Only present as a build dependency for virtuoso-opensource, no updates will be issued
consul                           non-supported   1.8.7+dfsg1-2                    2023-12-04  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057418
cython                           non-supported   0.29.21-3                        2024-09-29  Only included for building packages, not running them. https://lists.debian.org/debian-lts/2024/08/msg00057.html
dnsdist                          non-supported   1.5.1-3	2025-10-01	No security support upstream and backports not feasible, only for use on private and trusted network
ganglia                          limited  See README.Debian.security, only supported behind an authenticated HTTP zone, #702775
ganglia-web                      limited  See README.Debian.security, only supported behind an authenticated HTTP zone, #702776
gnupg1                           limited  See #982258 and https://www.debian.org/releases/stretch/amd64/release-notes.en.txt
gobgp                            limited  See https://www.debian.org/releases/bullseye/amd64/release-notes.en.txt (Section 5.2.1.3)
golang.*                         limited  See https://www.debian.org/releases/bullseye/amd64/release-notes.en.txt (Section 5.2.1.3)
gpac                             non-supported   1.0.1+dfsg1-4+deb11u3            2024-08-08  https://lists.debian.org/debian-lts/2024/08/msg00007.html
guix                             non-supported   1.2.0-4+deb11u3    		  2025-09-26  see #1112246 and #1108318 and it's CVEs
hdf5                             limited  Not covered by security support, only suitable for trusted content, see #1117722
keras                            non-supported   2.3.1+dfsg-3                     2025-12-08  Only suitable for trusted content https://salsa.debian.org/lts-team/lts-updates-tasks/-/issues/281
intel-mediasdk                   non-supported   21.1.0-1                         2024-11-07  abandoned upstream, upstream does not publish enough information to fix issues.
iotjs                            non-supported   1.0+715-1                        2024-08-15  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1078334
jython                           non-supported   2.7.2+repack1-3                  2024-09-29  Includes python2.7 stdlib https://lists.debian.org/debian-lts/2024/08/msg00057.html
kde4libs                         limited  khtml has no security support upstream, only for use on trusted content
khtml                            limited  khtml has no security support upstream, only for use on trusted content, see #1004293
libreswan                        non-supported   4.3-1+deb11u3                    2024-06-03  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072527
libsoup2.4                  limited  Only supported as a client, not as a server: see https://gitlab.gnome.org/GNOME/libsoup/-/commit/2a9d8ecc45bb814f6a81b1241e6c0c55d632aa28
libspring-java                   limited  should be only used for building other Debian packages or in a secured local environment with trusted devices.
mozjs68                          limited  Not covered by security support, only suitable for trusted content, see #959804
mozjs78                          limited  Not covered by security support, only suitable for trusted content, see #959804
musescore2                       limited  Only supported with trusted files, see README.Debian shipped in package and #1070860
musescore3                       limited  Only supported with trusted files, see README.Debian shipped in package and #1070860
node-matrix-js-sdk               non-supported   9.3.0+~cs9.9.16-2                2025-01-30  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094651
node-node-forge                  non-supported   0.10.0~dfsg-3+deb11u1            2025-12-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1124248
ocsinventory-server              limited  Only supported behind an authenticated HTTP zone
odoo                             non-supported   14.0.0+dfsg.2-7+deb11u2          2025-04-12  Lack of clear information upstream about the commits fixing CVEs makes it difficult to backport patches. See #1100929
openjdk-17                       limited  See https://www.debian.org/releases/bullseye/amd64/release-notes.en.txt (Section 5.2.1.2)
pdns                             non-supported   4.4.1-1                          2025-10-01  No security support upstream and backports not feasible, only for use on private and trusted network
pdns-recursor                    non-supported   4.4.2-3                          2024-05-14  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070176  
phppgadmin                       non-supported   7.13.0+dfsg-2                    2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072589
pypy                             non-supported   7.3.3+dfsg-2                     2024-09-29  Includes python2.7 stdlib. https://lists.debian.org/debian-lts/2024/08/msg00057.html
pytest-salt-factories            non-supported   0.93.0-1                         2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070175
pytest-testinfra                 non-supported   6.1.0-1                          2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070175
python-setuptools                non-supported   40.8.0-1                         2024-09-29  Only included for building packages, not running them. https://lists.debian.org/debian-lts/2024/08/msg00057.html
python-stdlib-extensions         non-supported   2.7.18-1                         2024-09-29  Only included for building packages, not running them. https://lists.debian.org/debian-lts/2024/08/msg00057.html
python2.7                        non-supported   2.7.18-8+deb11u1                 2024-09-29  Only included for building packages, not running them. https://lists.debian.org/debian-lts/2024/08/msg00057.html
qtwebengine-opensource-src       limited  No security support upstream and backports not feasible, only for use on trusted content
qtwebkit                         limited  No security support upstream and backports not feasible, only for use on trusted content
qtwebkit-opensource-src          limited  No security support upstream and backports not feasible, only for use on trusted content
salt                             non-supported   3002.6+dfsg1-4+deb11u1           2024-06-29  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070175
samba                            limited  Only non-AD Domain Controller use cases are supported. See https://lists.debian.org/debian-security-announce/2023/msg00169.html
slurm-wlm                        non-supported   20.11.7+really20.11.4-2+deb11u1  2024-05-14  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071127
snort                            non-supported   2.9.20-0+deb11u1                 2024-02-11  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063756
sql-ledger                       limited  Only supported behind an authenticated HTTP zone
tiles                            limited  Only supported for building packages, #1057343
tor                              non-supported   0.4.5.16-1                       2023-11-22  https://lists.debian.org/debian-security-announce/2023/msg00258.html
wpewebkit                        non-supported   2.38.6-1~deb11u1                 2024-08-16  https://bugs.debian.org/1035997
xen                              non-supported   4.14.5+94-ge49571868d-1          2023-09-30  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053246
zabbix                           limited  The WEB UI is only supported for access by trusted users, no security updates issued for it
zoneminder                       limited  See README.Debian.security, only supported behind an authenticated HTTP zone, #922724
freeimage                        non-supported   Inactive project upstream, with no feedback about the longstanding security issues reported on different places
