Nov 11 2026 Free software activity in October 2026

My Debian contributions this month were all sponsored by Freexian.

You can also support my work directly via Liberapay or GitHub Sponsors.

OpenSSH

I upgraded both openssh and openssh-gssapi from 10.5p1 to 10.6p1, started generating MLDSA44-ED25519 host keys by default now that upstream no longer considers them experimental, and fixed a problem where switching between the normal and GSS-API variants followed by purging the old packages caused some configuration files to disappear.

Python packaging

New upstream versions:

afew (fixing a build failure with Python 3.15)
django-render-block (fixing a build failure)
djangorestframework (fixing a build failure)
frescobaldi
fsspec (fixing CVE-2026-104851)
khal (fixing an ikhal crash at startup)
pydantic (twice)
pydantic-core (twice)
pydantic-settings
pygml
pyinstaller-hooks-contrib (fixing a build failure)
python-ast-serialize
python-asyncvarlink
python-blockbuster
python-bytecode (fixing a build failure with Python 3.15)
python-certifi (twice)
python-cytoolz
python-django-postgres-extra
python-evalidate
python-mitogen
python-moto
python-persistent
python-typeguard (fixing a build failure with Python 3.15)
toolz (fixing a build failure with Python 3.15)
twisted (fixing CVE-2026-115774, CVE-2026-115775, CVE-2026-115776, CVE-2026-115778, CVE-2026-115877, and CVE-2026-83813)
zope.hookable
zope.i18nmessageid
zope.interface
zope.security

Other build/test failures:

Since lots of Python modules use Rust extensions nowadays, we often have to help with upgrades of Rust packages. I did some of this:

PyO3 0.29 (which needs more help!): blake3-py, cbor2, pendulum, pysequoia, python-ahocorasick-rs, python-cotengrust, python-jellyfish, python-ormar-utils, python-watchfiles, rpds-py, and unicode-segmentation-rs
Upgraded python-maturin from 1.9.4 to 1.16.0 to help with several other upgrades; this was a major upgrade involving more or less completely reworking our patch set.

Other bugs:

twisted: CVE-2026-106454

One of my hobbies is typesetting (“engraving”) music, sometimes for my own use, sometimes for teaching, and sometimes for my choir. I’ve used LilyPond for a long time and have got pretty used to it. My workflow was a bit cumbersome, though, usually involving side-by-side editor and PDF viewer windows with some ad-hoc Makefiles and editor macros. I recently discovered the Frescobaldi frontend to LilyPond, and decided I liked it enough to switch over to it. It was already packaged in Debian, but it had a missing desktop entry and icon and missing translations; I fixed those based on a patch set by Joachim Wiedorn. My upload introduced a testing migration problem, which I also fixed.

Rust packaging

I upgraded rust-jiter and rust-smallvec to new upstream versions for a new version of pydantic-core. The rust-smallvec upgrade caused an FTBFS in rust-saphyr-parser-bw, which I fixed.

I packaged rust-cargo-cyclonedx for a new version of python-maturin. This needed some porting to work with a new version of rust-cargo-metadata, which I contributed upstream.

I improved the dev/list-rdeps.sh tool used by the Rust team to check build-depends too, which should make it easier for that team to remember Python packages in transitions.

Code reviews

debbugs: Fix autopkgtests (merged)
openssh-gssapi: d/t/purge-keeps-config-with-counterpart: test for purge (merged)
openssh: d/t/purge-keeps-config-with-counterpart: test for purge (merged)
python-datamodel-code-generator: Upgrade to 0.85.0 (sponsored upload for Nico Della Torre)
python-pyramid-tm: FTBFS: ModuleNotFoundError: No module named ‘pkg_resources’ (sponsored upload for Maximilian Engelhardt)

Comments

With an account on the Fediverse or Mastodon, you can respond to this post. Since Mastodon is decentralized, you can use your existing account hosted by another Mastodon server or compatible platform if you don't have an account on this one. Known non-private replies are displayed below.

Learn how this is implemented here.