--- /dev/null
+Title: Free software activity in September 2026
+Slug: activity-2026-09
+Date: Fri, 09 Oct 2026 13:46:28 +0100
+Category: columbiform
+Tags: activity, columbiform, freexian, openssh, planet-debian
+Summary: Linkage cleanup in OpenSSH, pkg_resources wrangling, and the usual Python packaging work.
+Mastodon-ID: 117411023044266862
+
+My Debian contributions this month were all [sponsored](https://www.freexian.com/about/debian-contributions/) by Freexian.
+
+You can also support my work directly via [Liberapay](https://liberapay.com/cjwatson) or [GitHub Sponsors](https://github.com/sponsors/cjwatson).
+
+## OpenSSH
+
+I worked with upstream to [remove libselinux linkage from `/usr/sbin/sshd`](https://bugzilla.mindrot.org/show_bug.cgi?id=3996).
+
+I applied a fix from Mark Robillard Jr to [fix `reload` logic when using sysvinit](https://bugs.debian.org/1148188).
+
+## groff
+
+I upgraded from 1.24.1 to 1.24.2, which fixed a few command injection security vulnerabilities.
+
+## parted
+
+I upgraded from 3.7 to 3.8, which fixed [CVE-2026-89085 and CVE-2026-89088](https://bugs.debian.org/1148169).
+
+## Python packaging
+
+New upstream versions:
+
+* beaker ([contributed supporting fix upstream](https://github.com/bbangert/beaker/pull/260))
+* bitstruct
+* cachelib
+* dep-logic
+* django-guardian
+* django-oauth-toolkit (fixing [use of an old Bootstrap version](https://bugs.debian.org/1088489))
+* django-polymorphic ([contributed supporting fix upstream](https://github.com/django-commons/django-polymorphic/pull/917))
+* djangorestframework (fixing [CVE-2026-73228 and CVE-2026-73229](https://bugs.debian.org/1144350))
+* flask-security
+* isort
+* langtable
+* magic-wormhole-mailbox-server (fixing [use of `pkg_resources`](https://bugs.debian.org/1147779))
+* multipart
+* nagiosplugin
+* poetry-plugin-export
+* proglog (fixing [use of `pkg_resources`](https://bugs.debian.org/1147781))
+* prospector (fixing [use of `pkg_resources`](https://bugs.debian.org/1147884))
+* pybind11_stubgen
+* pydantic
+* pydantic-core
+* pytest-rerunfailures
+* python-anyio (fixing [CVE-2026-63349, CVE-2026-63374, and CVE-2026-64847](https://bugs.debian.org/1148561) and a [build failure on Python 3.15](https://bugs.debian.org/1145839))
+* python-asttokens
+* python-asyncvarlink
+* python-blockbuster (fixing a [build failure on Python 3.15](https://bugs.debian.org/1145094))
+* python-btrees
+* python-django-health-check
+* python-django-otp
+* python-django-simple-history
+* python-email-validator
+* python-forbiddenfruit
+* python-ldap
+* python-linuxnamespaces
+* python-plaster-pastedeploy
+* python-pydash
+* python-pyzipper (fixing [CVE-2026-44722](https://bugs.debian.org/1142473))
+* python-quart-trio
+* python-rich-click (fixing [harlequin](https://bugs.debian.org/1146708))
+* python-repoze.lru
+* python-repoze.tm2 (fixing [use of `pkg_resources`](https://bugs.debian.org/1147804))
+* python-time-machine
+* python-urllib3 ([filed upstream issue with recent Python 3.14 versions](https://github.com/urllib3/urllib3/issues/5268))
+* python-vblf
+* quart
+* responses
+* sphinx-autodoc-typehints
+* storm (fixing a [build failure with Python 3.15](https://bugs.debian.org/1147456), which I [helped to land upstream](https://code.launchpad.net/~beenje/storm/+git/storm/+merge/510985))
+* trove-classifiers
+* twine
+* vdirsyncer
+
+setuptools 84 is now in Debian and no longer contains `pkg_resources`. Removing uses of that module has been an ongoing project for a while now, but I did another batch of fixes this month:
+
+* [flufl.password](https://bugs.debian.org/1147770)
+* [junos-eznc](https://bugs.debian.org/1147774)
+* [python-decopatch](https://bugs.debian.org/1147793)
+* [python-launchpadlib](https://bugs.debian.org/1147419)
+* [python-plaster-pastedeploy](https://bugs.debian.org/1147381)
+* [python-pyramid-retry](https://bugs.debian.org/1147909)
+* [sphinxcontrib-log-cabinet](https://bugs.debian.org/1147863)
+* [sphinxcontrib-restbuilder](https://bugs.debian.org/1147921)
+* [straight.plugin](https://bugs.debian.org/1147868)
+
+A new python-coverage version triggered several build regressions due to a [known problem in pytest-cov](https://github.com/pytest-dev/pytest-cov/issues/755). I worked around these by setting `COVERAGE_CORE=ctrace`:
+
+* [aiosignal](https://bugs.debian.org/1149403)
+* [frozenlist](https://bugs.debian.org/1149419)
+* [python-cheroot](https://bugs.debian.org/1149462)
+* [python-propcache](https://bugs.debian.org/1149466)
+
+Other build/test failures:
+
+* [afew](https://bugs.debian.org/1148088)
+* [django-downloadview](https://bugs.debian.org/1148091)
+* [django-filter](https://bugs.debian.org/1149171)
+* [django-polymorphic](https://bugs.debian.org/1149414)
+* [drf-haystack](https://bugs.debian.org/1149172)
+* [drf-yasg-nonfree](https://bugs.debian.org/1149549)
+* [pydantic-core](https://bugs.debian.org/1148201)
+* [pylint](https://bugs.debian.org/1147551)
+* [pytest-openfiles](https://bugs.debian.org/1148098)
+* [pytest-remotedata](https://bugs.debian.org/1148097)
+* [python-aiohttp-oauthlib](https://bugs.debian.org/1148099)
+* [python-cron-descriptor](https://bugs.debian.org/1147893)
+* [python-django-nh3](https://bugs.debian.org/1147794)
+* [python-graphene](https://bugs.debian.org/1147903)
+* [python-pydash](https://bugs.debian.org/1147905)
+* [python-pysolr](https://bugs.debian.org/1148102)
+* [python-time-machine](https://bugs.debian.org/1146407)
+* [python-vblf](https://bugs.debian.org/1147912)
+* [social-auth-core](https://bugs.debian.org/1147917)
+* [sphinx-book-theme](https://bugs.debian.org/1149489)
+* [tagpy: FTBFS against python 3.15rc2](https://bugs.debian.org/1147458)
+* [tagpy: TypeError: 'include_dirs' (if supplied) must be a list of strings](https://bugs.debian.org/1149491)
+* [typer](https://bugs.debian.org/1147923)
+
+I investigated a [build failure in python-proton-vpn-local-agent](https://bugs.debian.org/1148202) and [proposed a fix upstream](https://github.com/ProtonVPN/local-agent-rs/pull/19), but I'm not comfortable applying this in Debian without review. If you're familiar with this code, please take a look.
+
+I fixed some other bugs:
+
+* [python-pycudwt: Requires manual rebuild for python3.14-only transition](https://bugs.debian.org/1147346)
+* [python-testing.postgresql: Fails to build source after successful build](https://bugs.debian.org/1048656)
+* [tomopy: Requires manual rebuild for python3.14-only transition](https://bugs.debian.org/1147341)
+* [typer: Fails to build source after successful build](https://bugs.debian.org/1045487)
+* [vdirsyncer: Fails to build source after successful build](https://bugs.debian.org/1046537)
+
+## Rust packaging
+
+rust-derivre had an [invalid `Section` field](https://bugs.debian.org/1149034), which I cleaned up.
~cjwatson / blog.git / commitdiff