Path: csiph.com!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Nilesh Patra Newsgroups: linux.debian.bugs.dist,linux.debian.maint.python Subject: Bug#1003567: Please make a separate package for mistune 2.x Date: Fri, 04 Feb 2022 17:30:02 +0100 Message-ID: References: X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Fri Feb 4 16:27:08 2022 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -5.651 Reply-To: Nilesh Patra , 1003567@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: Debian Python Team X-Debian-Pr-Message: followup 1003567 X-Debian-Pr-Package: python3-schema-salad X-Debian-Pr-Source: python-schema-salad MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="bGPil1o3mDDZ6h0y0rj9IdMpU4u9NuoBg" X-Debian-Message: from BTS X-Mailing-List: archive/latest/1703542 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 142 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: Pierre-Elliott =?UTF-8?Q?B=C3=A9cue?= , "Michael R. Crusoe" , 1003567@bugs.debian.org, debian-python@lists.debian.org X-Original-Date: Fri, 4 Feb 2022 21:54:09 +0530 X-Original-Message-ID: <89a82b8a-ea47-fedf-d9f9-7a4c6edaf79e@tchncs.de> X-Original-References: <20220111213844.BE33D2C006E@pimeys.fr> <878rurbmr3.fsf@jaatynyt> <20220111213844.BE33D2C006E@pimeys.fr> Xref: csiph.com linux.debian.bugs.dist:1092048 linux.debian.maint.python:13920 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --bGPil1o3mDDZ6h0y0rj9IdMpU4u9NuoBg Content-Type: multipart/mixed; boundary="xukRiNGs0PzivZFDR1fyjCmyZY6PfEjuE"; protected-headers="v1" From: Nilesh Patra To: Julian Gilbey Cc: =?UTF-8?Q?Pierre-Elliott_B=c3=a9cue?= , "Michael R. Crusoe" , 1003567@bugs.debian.org, debian-python@lists.debian.org Message-ID: <89a82b8a-ea47-fedf-d9f9-7a4c6edaf79e@tchncs.de> Subject: Re: Please make a separate package for mistune 2.x References: <20220111213844.BE33D2C006E@pimeys.fr> <878rurbmr3.fsf@jaatynyt> In-Reply-To: --xukRiNGs0PzivZFDR1fyjCmyZY6PfEjuE Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 2/4/22 9:33 PM, Julian Gilbey wrote: >>> _mistune.py within the Debian package, >>> and have nbconvert do "import nbconvert.filters._mistune as mistune" >>> (see /usr/lib/python3/dist-packages/nbconvert/filters/markdown_mistun= e.py). >>> That seems like an eminently sensible solution to this problem. >> >> But that'd lead to a number of mistune's embedded copies in a huge num= ber of packages; since majority of >> the rev-deps (when I last checked) haven't adapted to this new version= =2E When they do, >> and it becomes a overhead to fix each one later. >> Even worse, if we discover a security problem sometime later, then all= such packages would be >> effected, and that honestly does not look like a good idea to me. >=20 > This is true, though there are only 7 reverse dependencies currently > in testing. Yeah, in total the reverse-deps are 8 and there is one different reverse-= build-dep (pasted at end of this mail) But the problem is if these fall through the cracks, and close to the rel= ease we notice some package is not looking nice. Also, if you suppose that the upstreams are very slow, and we get to the = new debian release with these things still embedded, it'd be a real mess to upload fixes to stable, right... =20 >> I somehow do not understand the urgency of uploading this newer versio= n, as the maintainer said: >> >> | I intend to upload src:mistune 2.0.0 to unstable between March the >> | 15th and April the 15th (depending on the progress of its >> | reverse-dependencies). >> >> We could simply wait a little more for the dust to settle, IMHO. >=20 > That would be a reasonable approach, but how long will it take for the > dust to settle? With this major change, and no guidance from upstream > on how to migrate, and at least a number of upstream authors happy to > rely on setup.py having "mistune <1.0.0" in the install_requires > field, it might be several months or longer before things are fixed > upstream. I think we could do this transition even a month or two before the soft f= reeze starts, which is roughly an year from now (considering general trend timings of s= tarting in feb in release year). Situation might improve by then, I suppose. If it does not, we could still go ahead with the older python3-mistune in= the archive, I do not see a huge problem there, except for maybe a few mistune uploads to stable if= desired. > And what do we do when some packages have converted and > some haven't? In such a case, we atleast will have a few examples to see how to go abou= t doing the API changes the right way. We could patch out at our end and send the changes upstream for review pr= ovided we are stuck in an unfortunate situation. Let me know what you'd think about this? Regards, Nilesh Reverse-Depends * giara [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el s390x] * iredis * lektor * lookatme * matrix-mirage [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el s39= 0x] * python3-flasgger * python3-m2r * python3-schema-salad Reverse-Testsuite-Triggers * markdown-it-py Reverse-Build-Depends * lektor * lookatme * markdown-it-py * python-flasgger * python-m2r * python-schema-salad --xukRiNGs0PzivZFDR1fyjCmyZY6PfEjuE-- --bGPil1o3mDDZ6h0y0rj9IdMpU4u9NuoBg Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEEPpmlJvXcwMu/HO6mALrnSzQzafEFAmH9UykFAwAAAAAACgkQALrnSzQzafEk QA//X/ZytcvvbgKusCoMVOFOrSJBMi7d62kE9wuTaMwAQkJCZnxpeZpU8OxhcPdUKDNNhMJ5Gs0v 30yM3iaHvgjoB9iDfWhPDynAM6BrcpeHyvT4m/DAoze9xxBXE/g/3CB4uQxHJYaDzZkkCr8/7kCD I6y+72cJwvYu/Uh9j7h3oZZ9b2F1isil1QQC7UJQxs17Muti5TwdT4Bd21elrHuIDDL73WCmZ6O6 /bZA3VZab96CtktVRO9IIPSHjdTdLHCjT593My+JaawSUlksPoKAXzFH4OicduOiJDr8Le/PVekX jO03aRXR8dYa5AAAcy78De1oEiQ0VKAsEUShSeYU75uNbJXNW5JzByBofC6app0EgWJEGdc08HaD OzB9zF3dkjQCeRTpuykYrdISkPXOagacKFa992bYTcnJRtXpMJr81iGMC6sepLKXcBr/+ihp+WYu 1d6HcpwM69nsLC0l5QuMmIThWZ6TlGxQSw33DrIaDLTv+z1fa3b80DaUSiTF9z835/K1oIvb9fJ1 SOENbcPGoaZ9E88XasNDf8W35zpgWlgDWSp/LnJSvTKQqBYBowWR6OnHV89eBwg6cO6fzF4F/97J Rvhw572nCvXvTM782gzSPv9UIDM6xi3yD5SdjesEiKXhtOFbXlH2OLD4t8I4kjEQjlySkf6XQO8p KyA= =W8R/ -----END PGP SIGNATURE----- --bGPil1o3mDDZ6h0y0rj9IdMpU4u9NuoBg--