Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Julian Gilbey Newsgroups: linux.debian.bugs.dist,linux.debian.maint.python Subject: Bug#1003567: Please make a separate package for mistune 2.x Date: Sat, 05 Feb 2022 20:00:12 +0100 Message-ID: References: X-Original-To: Nilesh Patra X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Sat Feb 5 18:54:08 2022 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -6.451 Reply-To: Julian Gilbey , 1003567@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: Debian Python Team X-Debian-Pr-Message: followup 1003567 X-Debian-Pr-Package: python3-schema-salad X-Debian-Pr-Source: python-schema-salad MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-Message: from BTS X-Mailing-List: archive/latest/1703671 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 28 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: Pierre-Elliott =?UTF-8?Q?B=C3=A9cue?= , "Michael R. Crusoe" , 1003567@bugs.debian.org, debian-python@lists.debian.org X-Original-Date: Sat, 5 Feb 2022 18:50:58 +0000 X-Original-Message-ID: X-Original-References: <20220111213844.BE33D2C006E@pimeys.fr> <878rurbmr3.fsf@jaatynyt> <20220111213844.BE33D2C006E@pimeys.fr> Xref: csiph.com linux.debian.bugs.dist:1092157 linux.debian.maint.python:13923 On Fri, Feb 04, 2022 at 09:27:59PM +0530, Nilesh Patra wrote: > On 2/4/22 9:18 PM, Julian Gilbey wrote: > > [...] > > _mistune.py within the Debian package, > > and have nbconvert do "import nbconvert.filters._mistune as mistune" > > (see /usr/lib/python3/dist-packages/nbconvert/filters/markdown_mistune.py). > > That seems like an eminently sensible solution to this problem. > > But that'd lead to a number of mistune's embedded copies in a huge number of packages; since majority of > the rev-deps (when I last checked) haven't adapted to this new version. When they do, > and it becomes a overhead to fix each one later. > Even worse, if we discover a security problem sometime later, then all such packages would be > effected, and that honestly does not look like a good idea to me. I have just had another idea, which might solve all of the problems: create a new Debian package called mistune0 (or mistune1), which contains the legacy version of mistune, but with the Python module called "mistune0" instead of "mistune". Then it will be co-installable with mistune 2.x, and the packages which still depend on mistune 0.8.4 could be patched to say "import mistune0 as mistune" until they are updated upstream. This will also avoid having multiple copies of the legacy code in the archive, which addresses the security issue, and allow those packages which have migrated to mistune 2.x to still say "import mistune". Best wishes, Julian