Who do have to speak to to get this fixed ?

If you install Samba, you get 4.1.17, this Samba branch is EOL and it is
a security risk, this is why 4.2.0 is in debian security.

If you go here:

http://amprolla.devuan.org/merged/dists/jessie-security/main/binary-amd64/Packages

amongst everything else you will find:

Package: samba
Version: 2:4.2.10+dfsg-0+deb8u3
...........

Package: samba-common
Source: samba
Version: 2:4.1.17+dfsg-2+deb8u2
..............

Package: samba-common-bin
Source: samba
Version: 2:4.2.10+dfsg-0+deb8u3
...........


Why is samba-common still at 4.1.17 ? as far as I can see, this was
first pointed out in May and debian has 4.2.0 in security.

Just how do I get this fixed ?
How do I get someone to replace the 4.1.17 samba-common package with the
4.2.0 samba-common package. Once this is replaced, you should then be
able to install the samba 4.2.0 packages.

Rowland