09 Mar 2026
Planet Debian
Dirk Eddelbuettel: nanotime 0.3.13 on CRAN: Maintenance

Another minor update 0.3.13 for our nanotime package is now on CRAN, and has been uploaded to Debian and compiled for r2u. nanotime relies on the RcppCCTZ package (as well as the RcppDate package for additional C++ operations) and offers efficient high(er) resolution time parsing and formatting up to nanosecond resolution, using the bit64 package for the actual integer64 arithmetic. Initially implemented using the S3 system, it has benefitted greatly from a rigorous refactoring by Leonardo who not only rejigged nanotime internals in S4 but also added new S4 types for periods, intervals and durations.
This release, the first in eleven months, rounds out a few internal corners and helps Rcpp with the transition away from Rf_error to only using Rcpp::stop which deals more gracefully with error conditions and unwinding. We also updated how the vignette is made, its references, updated the continuous integration as one does, altered how the documentation site is built, gladly took a PR from Michael polishing another small aspect, and tweaked how the compilation standard is set.
The NEWS snippet below has the fuller details.
Changes in version 0.3.13 (2026-03-08)
The
methodspackage is now a Depends as WRE recommends (Michael Chirico in #141 based on a suggestion by Dirk in #140)The mkdocs-material documentation site is now generated via altdoc
Continuous Integration scripts have been updated
Replace
Rf_errorwithRcpp::stop, turn remaining one into(Rf_error)(Dirk in #143)Vignette now uses the
Rcpp::asisbuilder for pre-made pdfs (Dirk in #146 fixing #144)The C++ compilation standard is explicitly set to C++17 if an R version older than 4.3.0 is used (Dirk in #148 fixing #147)
The vignette references have been updated
Thanks to my CRANberries, there is a diffstat report for this release. More details and examples are at the nanotime page; code, issue tickets etc at the GitHub repository - and all documentation is provided at the nanotime documentation site.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.
09 Mar 2026 4:38pm GMT
Colin Watson: Free software activity in February 2026

My Debian contributions this month were all sponsored by Freexian.
You can also support my work directly via Liberapay or GitHub Sponsors.
OpenSSH
I released bookworm and trixie fixes for CVE-2025-61984 and CVE-2025-61985, both allowing code execution via ProxyCommand in some cases. The trixie update also included a fix for openssh-server: refuses further connections after having handled PerSourceMaxStartups connections.
bugs.debian.org administration
Gioele Barabucci reported that some messages to the bug tracking system generated by the bts command were being discarded. While the regression here was on the client side, I found and fixed a typo in our SpamAssassin configuration that was failing to apply a bonus specifically to forwarded commands, mitigating the problem.
Python packaging
New upstream versions:
- aiosmtplib
- bitstruct
- diff-cover
- django-q
- isort
- multipart
- poetry (adding support for Dulwich >= 0.25)
- poetry-core
- pydantic-settings
- python-build
- python-certifi
- python-datamodel-code-generator
- python-flatdict
- python-holidays
- python-maggma
- python-pytokens
- python-scruffy
- python-urllib3 (fixing CVE-2025-66471 and a chunked decoding bug)
- responses
- yarsync
- zope.component
- zope.deferredimport
Porting away from the deprecated (and now removed from upstream setuptools) pkg_resources:
- genshi (contributed upstream)
- germinate
- mopidy
- nose2
- pokrok (contributed upstream)
- pylama
- python-flask-seeder
- python-maggma (contributed upstream)
- python-pybadges
- python-scruffy (contributed upstream)
- thumbor (contributed upstream)
- zope.deprecation (contributed upstream a while ago, but there hasn't been an upstream release yet)
Other build/test failures:
- flask-dance: FTBFS: No module named 'pkg_resources' (actually fixed by adding a missing dependency to python3-sphinxcontrib.seqdiag)
- paramiko: autopkgtest regression on i386 (contributed upstream)
- poetry: autopkgtest regression on i386
- python-argh
- python-django-celery-beat: FTBFS: FAILED t/unit/test_models.py::HumanReadableTestCase::test_long_name
- python-maturin: rust-itertools update
- python-msrest: FTBFS: FAILED tests/asynctests/test_async_client.py::TestServiceClient::test_client_send (contributed upstream, though not very successfully)
- python-typing-inspect
Other bugs:
- python-datamodel-code-generator: Depends: python3-isort (< 8) but 8.0.0-1 is to be installed (contributed upstream)
- python-typeguard: Mark python3-typeguard Multi-Arch: foreign
- wheel: Mark python3-wheel Multi-Arch: foreign
- zope.deferredimport: Please make the build reproducible (contributed upstream, with a follow-up fix)
I added a manual page symlink to make the documentation for Testsuite: autopkgtest-pkg-pybuild easier to find.
I backported python-pytest-unmagic and a more recent version of pytest-django to trixie.
Rust packaging
I also packaged rust-garde and rust-garde-derive, which are part of the pile of work needed to get the ruff packaging back in shape (which is a project I haven't decided if I'm going to take on for real, but I thought I'd at least chip away at a bit of it).
Other bits and pieces
Code reviews
- debconf: Add BMP version of debian-logo (merged and uploaded)
- openssh: Reorder pam_selinux(7) usage (merged and uploaded)
- openssh-client: use sysusers.d, drop superflous dependencies (merged and uploaded)
- openssh: Stop deleting system user on remove/purge (merged and uploaded)
- openssh: Do not link against libcrypt on GNU/Hurd (merged and uploaded)
- partman-prep: Align PReP descriptions with other partition types (merged)
- python-better-exceptions (sponsored upload for Seyed Mohamad Amin Modaresi)
09 Mar 2026 12:22pm GMT
Sven Hoexter: Latest pflogsumm from unstable on trixie
If you want the latest pflogsumm release form unstable on your Debian trixie/stable mailserver you've to rely on pining (Hint for the future: Starting with apt 3.1 there is a new Include and Exclude option for your sources.list).
For trixie you've to use e.g.:
$ cat /etc/apt/sources.list.d/unstable.sources
Types: deb
URIs: http://deb.debian.org/debian
Suites: unstable
Components: main
#This will work with apt 3.1 or later:
#Include: pflogsumm
Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp
$ cat /etc/apt/preferences.d/pflogsumm-unstable.pref
Package: pflogsumm
Pin: release a=unstable
Pin-Priority: 950
Package: *
Pin: release a=unstable
Pin-Priority: 50
Should result in:
$ apt-cache policy pflogsumm
pflogsumm:
Installed: (none)
Candidate: 1.1.14-1
Version table:
1.1.14-1 950
50 http://deb.debian.org/debian unstable/main amd64 Packages
1.1.5-8 500
500 http://deb.debian.org/debian trixie/main amd64 Packages
Why would you want to do that?
Beside of some new features and improvements in the newer releases, the pflogsumm version in stable has an issue with parsing the timestamps generated by postfix itself when you write to a file via maillog_file. Since the Debian default setup uses logging to stdout and writing out to /var/log/mail.log via rsyslog, I never invested time to fix that case. But since Jim picked up pflogsumm development in 2025 that was fixed in pflogsumm 1.1.6. Bug is #1129958, originally reported in #1068425 Since it's an arch:all package you can just pick from unstable, I don't think it's a good candidate for backports, and just fetching the fixed version from unstable is a compromise for those who run into that issue.
09 Mar 2026 9:09am GMT