On Sat, May 24, 2025 at 07:44:51PM +0200, Santiago Vila wrote: > El 24/5/25 a las 19:17, Mathias Gibbens escribió: > > control: retitle -1 nlohmann-json3 3.12.0-1 causing FTBFS in openrct2 > > control: reassign -1 nlohmann-json3 3.12.0-1 > > control: affects -1 src:openrct2 > > > > Version 3.12.0-1 of nlohmann-json3 was recently uploaded to unstable, > > which is now causing openrct2 to fail to build. > > > > Looking at the changelog for nlohmann-json3, I don't see anything > > "important" in the upload, and seeing as the hard-freeze for trixie has > > started, I personally would have waited until forky development opens > > up. nlohmann-json3 is also a key package (via ceph Build-Depend), and > > as of this message I don't see any unblock request for it. > > > > It appears that upstream has fixed this regression: > > https://github.com/nlohmann/json/pull/4736. (Untested, but slated to be > > part of the 3.12.1 release.) > > Thanks for the quick reply (and the bug tidy up). > > In addition to the breakage in the above github PR, there are also > at least three packages which FTBFS in unstable because of the upload of > nlohmann-json3: > > xeus-gp FTBFS: Could not find a configuration file for package > "nlohmann_json" that exactly matches requested version "3.11.3". > xeus-python FTBFS: Could not find a configuration file for package > "nlohmann_json" that exactly matches requested version "3.11.3". > xeus-zmq FTBFS: Could not find a configuration file for package > "nlohmann_json" that exactly matches requested version "3.11.3". > > I assume those packages should eventually be adapted to work with the new > nlohmann > (i.e. it might sense not to reassign those three bugs), but now if any of them > would like to fix a bug in trixie, they can't do it via unstable anymmore, > they would have to use testing-proposed-updates.
It is worse than that. The reason the packages require an exact match for 3.11.3 is that nlohmann-json is a header file that hard-code its version number in the C++ ABI, so the ABI of any shared library that use nlohmann-json depends on the exact nlohmann-json version used. See <https://github.com/jupyter-xeus/xeus/issues/381> That means that moving from 3.11.3 to 3.12.0 require to bump the soname of libxeus11, and rebuild all other xeus package against the new soname. This is especially problematic since 3.12.0 fixes 9 CVEs. This package would only be updated after coordinating with all packages that build-depend on it. For example by waiting until there is upstream soname bump for libxeus. The only solution is to rename nlohmann-json3-dev to nlohmann-json3.12.0-dev so that uploading a nex upstream version does not remove the old one from the archive. Cheers, -- Bill. <ballo...@debian.org> Imagine a large red swirl here.
