--- /dev/null
+Title: Free software activity in February 2025
+Slug: activity-2025-02
+Date: 2025-03-02 13:49:47 +00:00
+Category: columbiform
+Tags: activity, columbiform, freexian, planet-debian, planet-ubuntu
+Summary: OpenSSH security fixes; Python team upstream reporting.
+Mastodon-ID: 114093163952364984
+
+Most of my Debian contributions this month were
+[sponsored](https://www.freexian.com/about/debian-contributions/) by
+Freexian.
+
+You can also support my work directly via
+[Liberapay](https://liberapay.com/cjwatson).
+
+## OpenSSH
+
+OpenSSH upstream released
+[9.9p2](https://www.openssh.com/releasenotes.html#9.9p2) with fixes for
+CVE-2025-26465 and CVE-2025-26466. I got a heads-up on this in advance from
+the Debian security team, and prepared updates for all of testing/unstable,
+bookworm (Debian 12), bullseye (Debian 11), buster (Debian 10, LTS), and
+stretch (Debian 9, ELTS). jessie (Debian 8) is also still in ELTS for a few
+more months, but wasn't affected by either vulnerability.
+
+Although I'm not particularly active in the Perl team, I fixed a
+[libnet-ssleay-perl build failure](https://bugs.debian.org/1096245) because
+it was blocking openssl from migrating to testing, which in turn was
+blocking the above openssh fixes.
+
+I also sent a minor [`sshd -T`
+fix](https://bugzilla.mindrot.org/show_bug.cgi?id=3788) upstream, simplified
+a number of autopkgtests using the newish [`Restrictions:
+needs-sudo`](https://bugs.debian.org/906424) facility, and prepared for
+[removing the obsolete `slogin` symlink](https://bugs.debian.org/1098760).
+
+## PuTTY
+
+I upgraded to the [new upstream version
+0.83](https://www.chiark.greenend.org.uk/~sgtatham/putty/).
+
+## GCC 15 build failures
+
+I fixed build failures with [GCC
+15](https://gcc.gnu.org/gcc-15/porting_to.html) in a few packages:
+
+* [icoutils](https://bugs.debian.org/1096829) ([contributed
+ upstream](https://savannah.nongnu.org/bugs/index.php?66812))
+* [kali](https://bugs.debian.org/1096891)
+* [parted](https://bugs.debian.org/1097550)
+* [python-setproctitle](https://bugs.debian.org/1097681)
+* [vigor](https://bugs.debian.org/1098064)
+
+## Python team
+
+A lot of my Python team work is driven by its [maintainer
+dashboard](https://udd.debian.org/dmd/?email1=team%2Bpython%40tracker.debian.org&nosponsor1=on&email2=&email3=&packages=&ignpackages=&format=html&onlytesting=on).
+Now that we've finished the transition to Python 3.13 as the default
+version, and inspired by a recent [debian-devel thread started by
+Santiago](https://lists.debian.org/debian-devel/2025/02/msg00134.html), I
+thought it might be worth spending a bit of time on the "uscan error"
+section. [`uscan`](https://wiki.debian.org/debian/watch) is typically
+scraping upstream web sites to figure out whether new versions are
+available, and so it's easy for its configuration to become outdated or
+broken. Most of this work is pretty boring, but it can often reveal
+situations where we didn't even realize that a Debian package was out of
+date. I fixed these packages:
+
+* cssutils (this in particular was very out of date due to a new and active
+ upstream maintainer since 2021)
+* django-assets
+* django-celery-email
+* django-sass
+* django-yarnpkg
+* json-tricks
+* mercurial-extension-utils
+* pydbus
+* pydispatcher
+* pylint-celery
+* pyspread
+* pytest-pretty
+* python-apptools
+* python-django-libsass ([contributed a packaging fix
+ upstream](https://github.com/torchbox/django-libsass/pull/59) in passing)
+* python-django-postgres-extra
+* python-django-waffle
+* python-ephemeral-port-reserve
+* python-ifaddr
+* python-log-symbols
+* python-msrest
+* python-msrestazure
+* python-netdisco
+* python-pathtools
+* python-user-agents
+* sinntp
+* wchartype
+
+I upgraded these packages to new upstream versions:
+
+* cssutils ([contributed a packaging tweak
+ upstream](https://github.com/jaraco/cssutils/pull/62))
+* django-iconify
+* django-sass
+* domdf-python-tools
+* extra-data (fixing a [numpy 2.0 failure](https://bugs.debian.org/1095343))
+* flufl.i18n
+* json-tricks
+* jsonpickle
+* mercurial-extension-utils
+* mod-wsgi
+* nbconvert
+* orderly-set
+* pydispatcher ([contributed a Python 3.12 fix
+ upstream](https://github.com/mcfletch/pydispatcher/pull/9))
+* pylint
+* pytest-rerunfailures
+* python-asyncssh
+* python-box ([contributed a packaging fix
+ upstream](https://github.com/cdgriffith/Box/pull/290))
+* python-charset-normalizer
+* python-django-constance
+* python-django-guid
+* python-django-pgtrigger
+* python-django-waffle
+* python-djangorestframework-simplejwt
+* python-formencode
+* python-holidays ([contributed a test fix
+ upstream](https://github.com/vacanza/holidays/pull/2273))
+* python-legacy-cgi
+* python-marshmallow-polyfield (fixing a [test
+ failure](https://bugs.debian.org/1098600))
+* python-model-bakery
+* python-mrcz (fixing a [numpy 2.0
+ failure](https://bugs.debian.org/1095373))
+* python-netdisco
+* python-npe2
+* python-persistent
+* python-pkginfo (fixing a [test failure](https://bugs.debian.org/1098603))
+* python-proto-plus
+* python-requests-ntlm
+* python-roman
+* python-semantic-release
+* python-setproctitle
+* python-stdlib-list
+* python-trustme
+* python-typeguard (fixing a [test
+ failure](https://bugs.debian.org/1098615))
+* python-tzlocal
+* pyzmq
+* setuptools-scm
+* sqlfluff
+* stravalib
+* tomopy
+* trove-classifiers
+* xhtml2pdf (fixing [CVE-2024-25885](https://bugs.debian.org/1084986))
+* xonsh
+* zodbpickle
+* zope.deprecation
+* zope.testrunner
+
+In bookworm-backports, I updated python-django to 3:4.2.18-1 (issuing
+[BSA-121](https://backports.debian.org/news/BSA-121_Security_Update_for_python-django/))
+and added new backports of python-django-dynamic-fixture and
+python-django-pgtrigger, all of which are dependencies of
+[debusine](https://freexian-team.pages.debian.net/debusine/).
+
+I went through all the build failures related to python-click 8.2.0 (which
+was confusingly [tagged but not fully released
+upstream](https://github.com/pallets/click/pull/2844) and posted an
+[analysis](https://bugs.debian.org/1098507#17).
+
+I fixed or helped to fix various other build/test failures:
+
+* [cython](https://bugs.debian.org/1095084)
+* [dask](https://bugs.debian.org/1095019)
+* [deepdish](https://bugs.debian.org/1095339)
+* [hickle](https://bugs.debian.org/1094905) ([contributed
+ upstream](https://github.com/telegraphic/hickle/pull/186))
+* [mdp](https://bugs.debian.org/1095356) ([contributed
+ upstream](https://github.com/mdp-toolkit/mdp-toolkit/pull/105))
+* [mypy](https://bugs.debian.org/1098578)
+* [pillow](https://bugs.debian.org/1094040)
+* [pynput](https://bugs.debian.org/1098590)
+* [python-fonticon-fontawesome6](https://bugs.debian.org/1094085)
+* [python-persistent](https://bugs.debian.org/1098602) ([contributed
+ upstream](https://github.com/zopefoundation/persistent/pull/214))
+* [python-srsly](https://bugs.debian.org/1056874)
+
+I [dropped support for the old `setup.py ftest`
+command](https://github.com/zopefoundation/zope.testrunner/pull/192) from
+zope.testrunner upstream.
+
+I fixed various odds and ends of bugs:
+
+* [django-memoize: autopkgtest must be marked
+ superficial](https://bugs.debian.org/974455)
+* [extra-data: extra-data: please add autopkgtests (to add coverage for
+ python3-numpy)](https://bugs.debian.org/1035135)
+* [fpylll: missing dependency on numpy abi](https://bugs.debian.org/1094910)
+* [python-box: autopkgtest must be marked
+ superficial](https://bugs.debian.org/974492)
+* [python-hdmedians: missing dependency on numpy
+ abi](https://bugs.debian.org/1095284)
+* [python-legacy-cgi: missing requirement:
+ openstack-pkg-tools](https://bugs.debian.org/1094317)
+* [python-tzlocal: doesn't run any tests during the build or as
+ autopkgtest](https://bugs.debian.org/1063372)
+* [requests: will FTBFS during trixie support
+ period](https://bugs.debian.org/1091503) ([contributed supporting fix
+ upstream](https://github.com/psf/requests/pull/6897))
+* [setuptools-scm: project was renamed from `setuptools_scm` to
+ `setuptools-scm`](https://bugs.debian.org/1096004)
+
+## Installer team
+
+Following up on [last month]({filename}/activity-2025-01.md), I merged and
+uploaded [Helmut's `/usr`-move
+fix](https://salsa.debian.org/installer-team/debian-installer-utils/-/merge_requests/11).
~cjwatson / blog.git / commitdiff