Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Julian Gilbey Newsgroups: linux.debian.bugs.dist,linux.debian.maint.python Subject: Bug#1003567: Please make a separate package for mistune 2.x Date: Fri, 04 Feb 2022 17:10:02 +0100 Message-ID: References: X-Original-To: Nilesh Patra X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Fri Feb 4 16:06:08 2022 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -6.451 Reply-To: Julian Gilbey , 1003567@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: Debian Python Team X-Debian-Pr-Message: followup 1003567 X-Debian-Pr-Package: python3-schema-salad X-Debian-Pr-Source: python-schema-salad MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Greylist: delayed 898 seconds by postgrey-1.36 at buxtehude; Fri, 04 Feb 2022 16:03:53 UTC X-Debian-Message: from BTS X-Mailing-List: archive/latest/1703539 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 41 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: Pierre-Elliott =?UTF-8?Q?B=C3=A9cue?= , "Michael R. Crusoe" , 1003567@bugs.debian.org, debian-python@lists.debian.org X-Original-Date: Fri, 4 Feb 2022 16:03:49 +0000 X-Original-Message-ID: X-Original-References: <20220111213844.BE33D2C006E@pimeys.fr> <878rurbmr3.fsf@jaatynyt> <20220111213844.BE33D2C006E@pimeys.fr> Xref: csiph.com linux.debian.bugs.dist:1092043 linux.debian.maint.python:13917 On Fri, Feb 04, 2022 at 09:27:59PM +0530, Nilesh Patra wrote: > On 2/4/22 9:18 PM, Julian Gilbey wrote: > > Basically, the mistune upstream author has completely messed up on > > this by making what is essentially a completely different package with > > superficially similar functionality but the same name. > > True. > > [...] > > _mistune.py within the Debian package, > > and have nbconvert do "import nbconvert.filters._mistune as mistune" > > (see /usr/lib/python3/dist-packages/nbconvert/filters/markdown_mistune.py). > > That seems like an eminently sensible solution to this problem. > > But that'd lead to a number of mistune's embedded copies in a huge number of packages; since majority of > the rev-deps (when I last checked) haven't adapted to this new version. When they do, > and it becomes a overhead to fix each one later. > Even worse, if we discover a security problem sometime later, then all such packages would be > effected, and that honestly does not look like a good idea to me. This is true, though there are only 7 reverse dependencies currently in testing. > I somehow do not understand the urgency of uploading this newer version, as the maintainer said: > > | I intend to upload src:mistune 2.0.0 to unstable between March the > | 15th and April the 15th (depending on the progress of its > | reverse-dependencies). > > We could simply wait a little more for the dust to settle, IMHO. That would be a reasonable approach, but how long will it take for the dust to settle? With this major change, and no guidance from upstream on how to migrate, and at least a number of upstream authors happy to rely on setup.py having "mistune <1.0.0" in the install_requires field, it might be several months or longer before things are fixed upstream. And what do we do when some packages have converted and some haven't? Best wishes, Julian