[Bug 2134524] python3-django3 on epel8 requires newer python-asgiref
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2134524
Carl George 🤠 <carl(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|carl(a)redhat.com |michel(a)michel-slm.name
Component|python-asgiref |python-django3
CC| |dcavalca(a)fb.com,
| |epel-packagers-sig(a)lists.fe
| |doraproject.org,
| |michel(a)michel-slm.name,
| |ngompa13(a)gmail.com
Doc Type|--- |If docs needed, set a value
--- Comment #1 from Carl George 🤠 <carl(a)redhat.com> ---
It looks like python-django3-3.2.15-2.el8 was published [0] without checking
that it actually installs. I think there are three possible solutions.
1. Downgrade python-django3 with an epoch to a version that is compatible with
python-asgiref-3.2.10-1.el8. This would probably make python-django3
vulnerable to CVE-2022-34265 again, unless a backport fix can be sorted out.
2. Validate that django 3.2.15 actually does work with asgiref 3.2.10, and
patch python-django3 to allow them to be installed together. I checked the
commit that sets that minimum version [1], and it doesn't mention a specific
reason. The validation is key here, but if those versions work together this
would probably be the least disruptive option.
3. Update python-asgiref from 3.2.10 to at least version 3.3.2 to satisfy the
dependency. According to the upstream changelog [2], 3.3.0 introduces a change
to the default for thread-sensitive mode [3]. I believe this change may be why
they incremented to 3.3.0 instead of continuing with 3.2.11. This makes me
nervous if such an update would be in line with the EPEL updates policy [4], as
it may be a disruptive change for users.
Since python3-django3 is the package that doesn't install, I think this bug
should be moved to that component. The python-djagno3 maintainer has access to
python-asgiref via the python-packagers-sig if he decides that option 3 is the
best course of action.
[0] https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2022-0793e00396
[1]
https://github.com/django/django/commit/011b92ce9893f32bc06ca0857b426a2dc...
[2] https://github.com/django/asgiref/blob/3.3.2/CHANGELOG.txt
[3]
https://github.com/django/asgiref/commit/7becc9daca2628c46af1cb7e46b4c47c...
[4] https://docs.fedoraproject.org/en-US/epel/epel-policy-updates/
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2134524
1 year, 8 months
[Bug 2135037] New: Adding neuro-sig group as co-maintainer
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2135037
Bug ID: 2135037
Summary: Adding neuro-sig group as co-maintainer
Product: Fedora
Version: rawhide
Status: NEW
Component: python-pandas
Assignee: jonathan(a)almalinux.org
Reporter: code(a)musicinmybrain.net
QA Contact: extras-qa(a)fedoraproject.org
CC: brett.lentz(a)gmail.com,
epel-packagers-sig(a)lists.fedoraproject.org,
gui1ty(a)penguinpee.nl, jonathan(a)almalinux.org,
mail(a)kushaldas.in, orion(a)nwra.com,
python-packagers-sig(a)lists.fedoraproject.org,
sergio.pasra(a)gmail.com, tomspur(a)fedoraproject.org,
wfp5p(a)worldbroken.com
Target Milestone: ---
Classification: Fedora
In a recent email to python-pandas-maintainers(a)fedoraproject.org, Sandro (FAS
gui1ty) requested that the neuro-sig group be added as a co-maintainer of
python-pandas.
> On behalf of NeuroFedora [1], I would like you to ask to add neuro-sig as co-maintainer for python-pandas package.
>
> Quite a few of our packages depend on it. This way we can keep an eye on updates and help out if needed.
>
> [1] https://lists.fedoraproject.org/archives/list/neurofedora@lists.fedorapro... (and following)
I’ve opened this issue for better visibility. As a member of
python-packagers-sig, I have the ability to add neuro-sig as a co-maintainer,
but I want to hear from at least @jonathanspw first.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2135037
1 year, 8 months
[Bug 2131335] CVE-2022-21222 css-what: ReDoS due to insecure regular expression
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2131335
--- Comment #4 from Patrick Del Bello <pdelbell(a)redhat.com> ---
Created cockatrice tracking bugs for this issue:
Affects: fedora-all [bug 2134317]
Created couchdb tracking bugs for this issue:
Affects: fedora-all [bug 2134318]
Created golang-entgo-ent tracking bugs for this issue:
Affects: fedora-all [bug 2134319]
Created golang-github-prometheus tracking bugs for this issue:
Affects: epel-all [bug 2134316]
Created grafana tracking bugs for this issue:
Affects: fedora-all [bug 2134320]
Created nodejs-svgo tracking bugs for this issue:
Affects: fedora-all [bug 2134321]
Created npm-name-cli tracking bugs for this issue:
Affects: fedora-all [bug 2134322]
Created python-pydata-sphinx-theme tracking bugs for this issue:
Affects: fedora-all [bug 2134323]
Created yarnpkg tracking bugs for this issue:
Affects: fedora-all [bug 2134324]
Created zuul tracking bugs for this issue:
Affects: fedora-all [bug 2134326]
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2131335
1 year, 8 months