Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: stefanor@debian.org Newsgroups: linux.debian.security,linux.debian.maint.python Subject: Re: Considering letting python-pip use vendored dependencies Date: Sun, 16 Jan 2022 16:10:03 +0100 Message-ID: References: X-Original-To: debian-security , team@security.debian.org, debian-python , Carl Chenet , Scott Kitterman X-Mailbox-Line: From debian-security-request@lists.debian.org Sun Jan 16 15:06:57 2022 Old-Return-Path: X-Amavis-Spam-Status: No, score=-6.88 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DIGITS_LETTERS=1, DKIMWL_WL_HIGH=-0.049, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, LDO_WHITELIST=-5, MD5_SHA1_SUM=-1, MURPHY_DRUGS_REL8=0.02] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -4.6 Mail-Followup-To: debian-security , team@security.debian.org, debian-python , Carl Chenet , Scott Kitterman X-Gpg-Public-Key: http://www.rivera.za.net/stefano.gpg MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline User-Agent: NeoMutt/20201127 X-Mailing-List: archive/latest/29140 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/20220116150639.2dhuybxl77tewhhf@satie.tumbleweed.org.za Approved: robomod@news.nic.it Lines: 17 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sun, 16 Jan 2022 15:06:39 +0000 X-Original-Message-ID: <20220116150639.2dhuybxl77tewhhf@satie.tumbleweed.org.za> X-Original-References: <20210915233214.6ys6kpsksh7dkipj@satie.tumbleweed.org.za> Xref: csiph.com linux.debian.security:5996 linux.debian.maint.python:13880 Hi debian-security (2021.09.15_23:32:14_+0000) > As mentioned in debian-devel recently [1], at the DebConf 21 Debian > Python BoF [2] we discussed the idea of reverting our unbundling patches > to python-pip. The group consensus was that it wasn't worth the effort > to maintain these patches. FYI, this is now done, as of pip 21.3.1+dfsg-1. Updated embedded-code-copies: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/64edb42f3ba4e9c79aefea7338b195f7975bfe70 SR -- Stefano Rivera http://tumbleweed.org.za/ +1 415 683 3272