A soundness issue was reported in rust-prost 0.13,
https://rustsec.org/advisories/RUSTSEC-2024-0408.html
which is reported as causing real-world failures in
downstream applications.

I looked at updating to the new upstream version,
(wip packaging for new upstream version is in the
debcargo-conf git) but that introduces a dependency
on a crate that is not in Debian.

rust-pprof does not appear to have any reverse
dependencies, and I don't think it should be included
in trixie in it's current state.

pprof was at some point needed for the gix stack, if they have moved
away from using it then I agree that it's not needed in trixie.

Will this bug be enought to block it, or do we need to do anything more?

Den tis 15 apr. 2025 kl 17:57 skrev Peter Green <plugwash@debian.org>:

pprof was at some point needed for the gix stack, if they have moved
away from using it then I agree that it's not needed in trixie.

Will this bug be enought to block it, or do we need to do anything more?

Den tis 15 apr. 2025 kl 17:57 skrev Peter Green <plugwash@debian.org>:

Am Tue, Apr 15, 2025 at 07:52:49PM +0200 schrieb Alexander Kjäll:

If it's entirely unused, then rather file an RM bug against ftp.debian.org?

Cheers,
        Moritz

Jonas asked for a new upstream version not so long ago, so presumablly
he has, or had future plans for stuff that depends on pprof. Adding him
to cc.

Quoting Peter Michael Green (2025-04-21 14:12:22)

Thanks for including me, Peter.

I have no longer a need for pprof, so will not be sad to see it go.

 - Jonas

Dear submitter,

as the package rust-pprof has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1116610

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Thorsten Alteholz (the ftpmaster behind the curtain)