Free software activity in May 2025
My Debian contributions this month were all sponsored by Freexian. Things were a bit quieter than usual, as for the most part I was sticking to things that seemed urgent for the upcoming trixie release.
You can also support my work directly via Liberapay or GitHub Sponsors.
OpenSSH
After my appeal for help last month to
debug intermittent sshd crashes, Michel
Casabona helped me put together an environment where I could reproduce it,
which allowed me to track it down to a root
cause and fix it. (I
also found a misuse of
strlcpy affecting at
least glibc-based systems in passing, though I think that was unrelated.)
I worked with Daniel Kahn Gillmor to fix a regression in ssh-agent socket
handling.
I fixed a reproducibility bug depending on whether passwd is installed on
the build system, which would have
affected security updates during the lifetime of trixie.
I backported openssh 1:10.0p1-5 to bookworm-backports.
I issued bookworm and bullseye updates for CVE-2025-32728.
groff
I backported a fix for incorrect output when formatting multiple documents as PDF/PostScript at once.
debmirror
I added a simple autopkgtest.
Python team
I upgraded these packages to new upstream versions:
- automat
- celery
- flufl.i18n
- flufl.lock
- frozenlist
- python-charset-normalizer
- python-evalidate (including pointing out an upstream release handling issue)
- python-pythonjsonlogger
- python-setproctitle
- python-telethon
- python-typing-inspection
- python-webargs
- pyzmq
- trove-classifiers (including a small upstream cleanup)
- uncertainties
- zope.testrunner
In bookworm-backports, I updated these packages:
- python-django to 3:4.2.21-1 (issuing BSA-124)
- python-django-pgtrigger to 4.14.0-1
I fixed problems building these packages reproducibly:
- celery (contributed upstream)
- python-setproctitle
- uncertainties (contributed upstream, after some discussion)
I backported fixes for some security vulnerabilities to unstable (since we’re in freeze now so it’s not always appropriate to upgrade to new upstream versions):
- django-select2: CVE-2025-48383
- python-tornado: CVE-2025-47287
I fixed various other build/test failures:
- fail2ban (also reviewing and merging fix sshd 10.0 log identifier and remove runtime calls to distutils)
- karabo-bridge (contributed upstream)
- kegtron-ble
- python-click-option-group (NMU)
- python-holidays
- python-mastodon
- python-mechanize (contributed upstream)
- thermobeacon-ble
I added non-superficial autopkgtests to these packages:
I packaged python-django-hashids and python-django-pgbulk, needed for new upstream versions of python-django-pgtrigger.
I ported storm to Python 3.14.
Science team
I fixed a build failure in apertium-oci-fra.