Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 931580 - dev-python/sphinx: unconditional import of defusedxml in sphinx.testing.util
Summary: dev-python/sphinx: unconditional import of defusedxml in sphinx.testing.util
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Python Gentoo Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 930998 931291 931533 931564 931565 931567 931568 931569 931570 931571 931572 931573 931575 931576 931577
  Show dependency tree
 
Reported: 2024-05-08 12:22 UTC by Michał Górny
Modified: 2024-05-11 19:11 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2024-05-08 12:22:56 UTC
New versions of Sphinx started using defusedxml in sphinx.testing.util.  This is not part of the "public" API, and so it's not declared as a runtime dependency upstream.  However, the lack of dep breaks random revdeps that use sphinx.testing, i.e. most of dev-python/sphinx*.

That said, the relevant function is not universally used, so probably the cleanest solution would be to move the import into the function.  This affects upstreams too, so let's take it there.
Comment 1 Larry the Git Cow gentoo-dev 2024-05-08 12:24:21 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1bbc3003717c55edd91b2b8cccaa8355d6e51d5b

commit 1bbc3003717c55edd91b2b8cccaa8355d6e51d5b
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2024-05-08 12:19:53 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2024-05-08 12:23:00 +0000

    dev-python/sphinx: Add a temporary RDEP on dev-python/defusedxml
    
    Add an explicit RDEPEND on dev-python/defusedxml since it is used
    by sphinx.testing.util, and this breaks a number of reverse
    dependencies.  This is a temporary hack, until we figure out a better
    solution.
    
    Bug: https://bugs.gentoo.org/931580
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 dev-python/sphinx/{sphinx-7.3.7.ebuild => sphinx-7.3.7-r1.ebuild} | 5 +++++
 1 file changed, 5 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2024-05-11 19:11:50 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=01f1140e16b69956b2d6171e0a503c043296fb14

commit 01f1140e16b69956b2d6171e0a503c043296fb14
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2024-05-11 19:05:25 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2024-05-11 19:11:01 +0000

    dev-python/sphinx: Make dev-python/defusedxml import optional
    
    Closes: https://bugs.gentoo.org/931580
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 .../sphinx/files/sphinx-7.3.7-opt-defusedxml.patch | 34 ++++++++++++++++++++++
 ...hinx-7.3.7-r1.ebuild => sphinx-7.3.7-r2.ebuild} |  7 ++---
 2 files changed, 36 insertions(+), 5 deletions(-)