Bug#1102752: bookworm-pu: expat/2.5.0-1+deb12u2

[Adrian Bunk <bunk@debian.org>]

On Sat, Aug 30, 2025 at 10:11:47AM +0100, Adam D. Barratt wrote:
> Hi,
> 
> On Sun, 2025-07-13 at 11:18 +0200, László Böszörményi (GCS) wrote:
> > On Sat, Jul 5, 2025 at 4:39 PM Paul Gevers <elbrus@debian.org> wrote:
> > > On Thu, 5 Jun 2025 19:57:24 +0200 Paul Gevers <elbrus@debian.org>
> > > wrote:
> > > > The autopkgtests of node-expat and python3.11 fail with the expat
> > > > from
> > > > proposed-updates. Can you have a look (you may want to involve
> > > > the
> > > > maintainers of those packages)?
> > [...]
> > > Any news?
> >  I've been busy with several things. Tried to reproduce the problems
> > in the background but I was not able to. I'm still working on it, as
> > now I have more time.
> 
> The point release is next wekeend, and we need to be making a decision
> as to whether to be including this update shortly. What's the status on
> the test failures?

Regarding python3.11, this needs:
https://github.com/python/cpython/commit/3501eca89e27873f6037abcb39e5031dfbce7077

Without the fails_with_expat_2_6_0 due to the CVE-2023-52425
backport this becomes:
https://salsa.debian.org/lts-team/packages/python3.7/-/commit/abf7997346d1cc2f7b96a5f643efff742a26d91d#77e295c43281825c62439f85ee54902e04eae026

This won't cause build failures since Python3 is one of the toolchain 
packages that runs a huge number of buildtime tests but ignores all
test failures:
https://sources.debian.org/src/python3.11/3.11.2-6%2Bdeb12u6/debian/rules#L677
https://sources.debian.org/src/python3.11/3.11.2-6%2Bdeb12u6/debian/rules#L693
https://sources.debian.org/src/python3.11/3.11.2-6%2Bdeb12u6/debian/rules#L708

So this is harmless with a test-only fix, and the autopkgtest can be 
fixed in the next python3.11 update.

Regarding node-expat, #1064047 was fixed by RM and I have no idea 
whether this is more than a test failure.

> Regards,
> 
> Adam

cu
Adrian