Free software activity in March 2026

diff --git a/content/activity-2026-03.md b/content/activity-2026-03.md
new file mode 100644 (file)
index 0000000..d7cdcf4
--- /dev/null
+++ b/content/activity-2026-03.md
@@ -0,0 +1,76 @@
+Title: Free software activity in March 2026
+Slug: activity-2026-03
+Date: 2026-04-12 11:13:15 +01:00
+Category: columbiform
+Tags: activity, columbiform, freexian, planet-debian
+Summary: A few security updates, but otherwise mostly routine Python work.
+Mastodon-ID: 116391202938290416
+
+My Debian contributions this month were all [sponsored](https://www.freexian.com/about/debian-contributions/) by Freexian.
+
+You can also support my work directly via [Liberapay](https://liberapay.com/cjwatson) or [GitHub Sponsors](https://github.com/sponsors/cjwatson).
+
+## OpenSSH
+
+I fixed [CVE-2026-3497](https://security-tracker.debian.org/tracker/CVE-2026-3497) in unstable, thanks to a fix in Ubuntu by Marc Deslauriers.  Relatedly, I applied an Ubuntu patch by Athos Ribeiro to [not default to weak GSS-API exchange algorithms](https://bugs.debian.org/1131206).
+
+I'm looking forward to being able to split out GSS-API key exchange support in OpenSSH once Ubuntu 26.04 LTS has been released!  This stuff will still be my problem, but at least it won't be in packages that [nearly everyone has installed](https://qa.debian.org/popcon.php?package=openssh).
+
+## Python packaging
+
+New upstream versions:
+
+* dill
+* django-modeltranslation
+* isort
+* langtable
+* pathos
+* pendulum
+* pox
+* ppft
+* pydantic-extra-types
+* pytango
+* python-asyncssh
+* python-datamodel-code-generator
+* python-evalidate
+* python-packaging (including fixes for python-hatch-requirements-txt and python-pyproject-examples)
+* python-zxcvbn-rs-py
+* rpds-py
+* smart-open
+* trove-classifiers
+
+I packaged [pybind11-stubgen](https://bugs.debian.org/1130121), needed for new upstream versions of pytango.  Tests of reproducible builds revealed that it didn't generate imports in a stable order; I [contributed a fix for that upstream](https://github.com/pybind/pybind11-stubgen/pull/293).
+
+I worked with the security team to release [DSA-6161-1](https://lists.debian.org/debian-security-announce/2026/msg00070.html) in multipart, fixing [CVE-2026-28356](https://security-tracker.debian.org/tracker/CVE-2026-28356) ([upstream discussion](https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3)).  (Most of the work for this was in February, but the vulnerability was still embargoed when I published my last monthly update.)
+
+In trixie-backports, I updated pytest-django to 4.12.0.
+
+I fixed a number of packages to support building with pyo3 0.28:
+
+* pendulum
+* pydantic-core
+* [python-jellyfish](https://bugs.debian.org/1131586)
+* python-zxcvbn-rs-py
+* [rpds-py](https://bugs.debian.org/1131590)
+
+Other build/test failures:
+
+* [python-bcrypt: Upcoming rust-getrandom update](https://bugs.debian.org/1130519)
+* [python-cotengrust: FTBFS: error[E0432]: unresolved import `rand::rngs::OsRng`](https://bugs.debian.org/1131677)
+* [austin: FTBFS: E ModuleNotFoundError: No module named 'pycparser.plyparser'](https://bugs.debian.org/1127499) ([contributed upstream](https://github.com/P403n1x87/austin/pull/349))
+* [taurus: FTBFS: dh\_auto\_build: error: pybuild --build -i python{version} -p "3.14 3.13" returned exit code 13](https://bugs.debian.org/1122488)
+* [python-datamodel-code-generator: Depends: python3-isort (< 8) but 8.0.0-1 is to be installed](https://bugs.debian.org/1129211) ([contributed upstream](https://github.com/koxudaxi/datamodel-code-generator/pull/3011))
+
+## Rust packaging
+
+New upstream versions:
+
+* rust-rpds
+
+## Other bits and pieces
+
+I upgraded tango to 10.1.2, and yubihsm-shell to 2.7.2.
+
+## Code reviews
+
+* [python-backports.zstd: Obsolete with Python 3.14](https://bugs.debian.org/1130913) (sponsored partial fix from YOKOTA Hiroshi)

diff --git a/posted_on_Mastodon.txt b/posted_on_Mastodon.txt
index 2782a14ea55ff266ebc3a84596d4ef37784eb310..9af554579cde0a07542a14ce175bb9c268b05868 100644 (file)
--- a/posted_on_Mastodon.txt
+++ b/posted_on_Mastodon.txt
@@ -23,6 +23,7 @@ activity-2025-11.html
 activity-2025-12.html
 activity-2026-01.html
 activity-2026-02.html
+activity-2026-03.html
 apt-resolver-bugs.html
 automatic-installability-checking.html
 binfmt-support-2.2.0.html