Path: csiph.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!news.dns-netz.com!news.freedyn.net!aioe.org!bofh.it!news.nic.it!robomod From: Jeremy Stanley Newsgroups: linux.debian.maint.python Subject: Re: python3.5 + oldstable dilemma Date: Mon, 01 Mar 2021 14:20:02 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Mon Mar 1 13:15:35 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-11.9 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FOURLA=0.1, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_FROM_MX=-3.1; rate: -4.6 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="xn3kyiikjvbo2ery" Content-Disposition: inline User-Agent: NeoMutt/20170113 (1.7.2) X-Sa-Exim-Connect-IP: 2001:4802:7801:102:be76:4eff:fe20:63e0 X-Sa-Exim-Rcpt-To: debian-python@lists.debian.org X-Sa-Exim-Mail-From: fungi@yuggoth.org X-Sa-Exim-Scanned: No (on azathoth.yuggoth.org); SAEximRunCond expanded to false X-Mailing-List: archive/latest/19025 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/20210301131514.onxvsd4loyy2upkj@yuggoth.org Approved: robomod@news.nic.it Lines: 50 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Mon, 1 Mar 2021 13:15:15 +0000 X-Original-Message-ID: <20210301131514.onxvsd4loyy2upkj@yuggoth.org> X-Original-References: Xref: csiph.com linux.debian.maint.python:13241 --xn3kyiikjvbo2ery Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2021-03-01 16:15:38 +1300 (+1300), Bailey, Josh wrote: > I'm a maintainer for a python based SDN network controller, FAUCET. One of > the platforms we've been supporting to-date is python3.5/oldstable. >=20 > Of course, now, python3.5 is EOL. To some degree we can keep building our > package under python3.5, but now not all of our dependencies (like pyyaml) > build or are even released for 3.5 anymore. That's an issue as there are > security vulnerabilities that are now difficult to address. >=20 > Given that oldstable will be around until 2022, does that mean python3 as > python3.5 will live on in oldstable until then? I can understand the case > for not adding a newer python3 version, but also OTOH addressing security > vulnerabilities over the LTS window will probably only get harder. >=20 > Any advice appreciated, If you're going to use the python3 packaged in oldstable, then can't you use the libraries (e.g. python3-yaml) packaged in oldstable as well and take advantage of whatever security fixes are backported by the package maintainers/security team? --=20 Jeremy Stanley --xn3kyiikjvbo2ery Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEl65Jb8At7J/DU7LnSPmWEUNJWCkFAmA86NgACgkQSPmWEUNJ WClFnA//cMJdQv0d8cD/tXJUof0933cbgnFsizQ+HMomRR37wjYBxsQ80dsKXop6 wbmpa3y+jiWVyJcvVxjFFU9k8uMyg0y5py42nE34vO3lIvofglBG76kp6iYlPxH0 mjUgAPuTTDZ9JVsw8jOQk8P0HJQslCgEfVi+fl98AVWbP0ux8VuWOcXs4PrMaqpF krgddt5qTchzpL+NB71v8JAAZRVS9nbLk7h1tsDfM6x8cwHTkP2dAF3S55L2hXPg sgpsiD9UzsUjiBoou6hdas3opGYbTqLXSk0L/PpwzvNQniZ5WSinsOCwf04DJbJA g/fexz0iKewvWuOJxKoOJkoo+flsUWo/ITMJX7q9Ua1ltV2jFXcfSNP/GpKTFeAF 9Mi/KLhhzx8VAd1otmj19EN2EEidU1tXXxQSy5Gn4xa0TpC/bg1NIbxSzCc6vsXC R1OW+4Ip7qexikpiE4qOMAfKCIjBZzaXtjNVPR0zkvQ+PqugP5vX0Y8xv+30pL1H RB2HrbjMJx9hWqd1yr5xhITf0PsAaVP/1McLfuMzsL4dOma+A/60Y9cRpOfBCxD3 bW1X3Xkm2WmlT7EcQmGQ3/kglydvKSXkRPkoeMZvra/Zdqq4mcUhWQMZ3MJwIaaM pUYt95RDeuQ4akG184QA5c4f02SQo7/gl37WAL95hcoiIB2nFRo= =mUtQ -----END PGP SIGNATURE----- --xn3kyiikjvbo2ery--