Skip to content

builtin: use the deprecated() directive for a few packages - #6635

Draft
alalazo wants to merge 1 commit into
spack:developfrom
alalazo:packages/use-deprecated-directive
Draft

alalazo wants to merge 1 commit into
spack:developfrom
alalazo:packages/use-deprecated-directive

Conversation

@alalazo

@alalazo alalazo commented Sep 23, 2026

Copy link
Copy Markdown
Member

⚠️ Can't be merged before we cut Spack v1.3 ⚠️

Move builtin to Package API v2.6, and replace version(..., deprecated=True) with deprecated() in btop, cmake, gcc, gnupg, libksba, libsodium, minisign and zig. Versions with a known CVE are marked reason="vuln", with the advisory ids as labels; the others are marked reason="retired".

Vulnerability ranges follow the upstream fixes, so some versions that were not deprecated before now are: gnupg 2.2.40 and 2.3.8, libsodium 1.0.20, gcc 7.5.0 to 11.5.0, binutils up to 2.45.1 (up to 2.46.1 on ppc64le) and libgcrypt up to 1.12.0. gcc 13 and older are also retired, since those series are closed upstream.

@spackbot-triage spackbot-triage Bot added new-version Modifications to packages' `depends_on()` directives dependencies Modifications with a `depends_on()` directive update-package Modifications to packages in the repository labels Sep 23, 2026
@alalazo

alalazo commented Sep 23, 2026

Copy link
Copy Markdown
Member Author

😞 The audit job doesn't fail when the package API is updated

Move builtin to Package API v2.6, and replace version(..., deprecated=True)
with deprecated() in btop, cmake, gcc, gnupg, libksba, libsodium, minisign
and zig. Versions with a known CVE are marked reason="vuln", with the
advisory ids as labels; the others are marked reason="retired".

Vulnerability ranges follow the upstream fixes, so some versions that
were not deprecated before now are: gnupg 2.2.40 and 2.3.8, libsodium
1.0.20, gcc 7.5.0 to 11.5.0, binutils up to 2.45.1 (up to 2.46.1 on
ppc64le) and libgcrypt up to 1.12.0. gcc 13 and older are also retired,
since those series are closed upstream.

Signed-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>
@alalazo
alalazo force-pushed the packages/use-deprecated-directive branch from d547efb to 2f2cd5a Compare October 23, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Modifications with a `depends_on()` directive new-version Modifications to packages' `depends_on()` directives update-package Modifications to packages in the repository

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant