Colin Watson: Free software activity in August 2025

About 95% of my Debian contributions this month were
sponsored by Freexian.
You can also support my work directly via
Liberapay or GitHub
Sponsors.
Python team
forky is
open!
As a result I’m starting to think about the upcoming Python
3.14. At some point we’ll doubtless do
a full test rebuild, but in advance of that I concluded that one of the most
useful things I could do would be to work on our very long list of packages
with new upstream
versions.
Of course there’s no real chance of this ever becoming empty since upstream
maintainers aren’t going to stop work for that long, but there are a lot of
packages there where we’re quite a long way out of date, and many of those
include fixes that we’ll need for 3.14, either directly or by fixing
interactions with new versions of other packages that in turn will need to
be fixed. We can backport changes when we need to, but more often than not
the most efficient way to do things is just to keep up to date.
So, I upgraded these packages to new upstream versions (deep breath):

aioftp
aiosignal (building on work by
IanLucca)
audioop-lts
celery
djangorestframework
djoser
fpylll
frozenlist
git-repo-updater
ipykernel
klepto
kombu
multipart
netmiko (sponsoring work by Eduardo
Silva;
contributed supporting fix
upstream)
pathos
ppft
pydantic
pydantic-core
pydantic-settings
pylsqpack
pymssql
pytest-mock
pytest-pretty
pytest-repeat
pytest-rerunfailures
python-a2wsgi
python-apptools (sponsoring work by Kathlyn Lara
Murussi)
python-asgiref
python-asyncssh
python-bitarray
python-bitstring
python-bytecode
python-channels-redis
python-charset-normalizer
python-daphne
python-django-analytical
python-django-guid
python-django-health-check
python-django-pgbulk
python-django-pgtrigger
python-django-postgres-extra
python-django-storages
python-holidays
python-httpx-sse
python-icalendar
python-lazy-model
python-line-profiler
python-lz4
python-marshmallow-dataclass
python-mastodon
python-model-bakery
python-oauthlib
python-parse-type
python-pathvalidate
python-pgspecial
python-processview
python-pytest-subtests
python-roman
python-semantic-release
python-testfixtures
python-time-machine
python-tokenize-rt
python-typeguard
python-typing-extensions
python-urllib3
pyupgrade
requests (fixing CVE-2024-47081)
responses
zope.deferredimport
zope.schema
zope.testrunner

That’s only about 10% of the backlog, but of course others are working on
this too. If we can keep this up for a while then it should help.
I packaged pytest-run-parallel,
pytest-unmagic (still in NEW), and
python-forbiddenfruit (still in NEW),
all needed as new dependencies of various other packages.
setuptools upstream will be removing the setup.py install
command on 31
October. While this may not trickle down immediately into Debian, it does
mean that in the near future nearly all Python packages will have to use
pybuild-plugin-pyproject (note that this does not mean that they
necessarily have to use pyproject.toml; this is just a question of how the
packaging runs the build system). We talked about this a bit at DebConf,
and I said that I’d noticed a number of packages where this isn’t
straightforward and promised to write up some notes. I wrote the
Python/PybuildPluginPyproject
wiki page for this; I expect to add more bits and pieces to it as I find them.
On that note, I converted several packages to pybuild-plugin-pyproject:

billiard
lazr.config
python-timeline
zope.sqlalchemy
zope.testing

I fixed several build/test failures:

aiosmtplib
blinker
ipykernel
ipyparallel
quart

I fixed some other bugs:

austin: binutils now has a libsframe-dev package, please add an explicit
build dependency
python-django-pgbulk: Missing dependency on
python3-typing-extensions
(contributed
upstream)
python-maturin: Upcoming rust-which update

I reviewed Debian defaults: nftables as banaction and systemd as
backend,
but it looked as though nothing actually needed to be changed so we closed
this with no action.
Rust team
Upgrading Pydantic was complicated, and required a rust-pyo3 transition
(which Jelmer Vernooij started and Peter Michael Green has mostly been
driving, thankfully), packaging rust-malloc-size-of (including an upstream
portability fix), and
upgrading several packages to new upstream versions:

rust-serde
rust-serde-derive
rust-serde-json
rust-smallvec
rust-speedate
rust-time
rust-time-core
rust-time-macros

bugs.debian.org
I fixed bugs.debian.org: misspelled checkbox id
“uselessmesages”, as well as a bug that
caused incoming emails with certain header contents to go
missing.
OpenSSH
I fixed openssh-server: refuses further connections after having handled
PerSourceMaxStartups connections with a
cherry-pick from upstream.
Other bits and pieces
I upgraded libfido2 to a new upstream version.
I fixed mimalloc: FTBFS on armhf: cc1: error: ‘-mfloat-abi=hard’: selected
architecture lacks an FPU, which was
blocking changes to pendulum in the Python team. I also spent some time
helping to investigate libmimalloc3: Illegal instruction Running mtxrun
—generate, though that bug is still open.
I fixed various autopkgtest bugs in
gssproxy,
prompted by
#1007 in Debusine.
Since my old team is decommissioning Bazaar/Breezy code hosting in
Launchpad
(the end of an era, which I have distinctly mixed feelings about), I
converted Storm to git.