The attached patch updates diffoscope to 256, which contains a security fix for directory traversals when using gpg. Both diffoscope and it's dependent, reprotest, still build fine! I am not sure what the expedited process for security updates are, but if there is anything I can do, please let me know! live well, vagrant