#1137043 python-markdown: FTBFS in bookworm and trixie

#1137043#5
Date:
2026-05-18 21:47:40 UTC
From:
To:
Dear maintainer:

During a rebuild of all packages in trixie, this package failed to build.

[ Note: The bug is marked as fixed with the version in forky/sid, but
  packages in bookworm and trixie must still build in bookworm and trixie ].

Below you will find the last part of the build log (probably the most
relevant part, but not necessarily). If required, the full build log
is available here:

https://people.debian.org/~sanvila/build-logs/trixie/

About the archive rebuild: The build was made on virtual machines from AWS,
using sbuild and a reduced chroot with only build-essential packages.

If you cannot reproduce the bug please contact me privately, as I
am willing to provide ssh access to a virtual machine where the bug is
fully reproducible.

If this is really a bug in one of the build-depends, please use
reassign and add an affects on src:python-markdown, so that this is still
visible in the BTS web page for this package.

Thanks.
--------------------------------------------------------------------------------
[...]
======================================================================
FAIL: test_raw_missing_close_bracket (tests.test_syntax.blocks.test_html_blocks.TestHTMLBlocks.test_raw_missing_close_bracket)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/tests/test_syntax/blocks/test_html_blocks.py", line 662, in test_raw_missing_close_bracket
    self.assertMarkdownRenders(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        '<foo',
        ^^^^^^^
        '<p><foo</p>'
        ^^^^^^^^^^^^^^^^
    )
    ^
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/markdown/test_tools.py", line 77, in assertMarkdownRenders
    self.assertMultiLineEqual(output, expected)
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
AssertionError: '' != '<p><foo</p>'
+ <p><foo</p>


======================================================================
FAIL: test_unclosed_comment_ (tests.test_syntax.blocks.test_html_blocks.TestHTMLBlocks.test_unclosed_comment_)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/tests/test_syntax/blocks/test_html_blocks.py", line 1022, in test_unclosed_comment_
    self.assertMarkdownRenders(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self.dedent(
        ^^^^^^^^^^^^
    ...<11 lines>...
        )
        ^
    )
    ^
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/markdown/test_tools.py", line 77, in assertMarkdownRenders
    self.assertMultiLineEqual(output, expected)
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
AssertionError: '<!-- unclosed comment\n\n*not* a comment\n\n-->' != '<p><!-- unclosed comment</p>\n<p><em>not</em> a comment</p>'
- <!-- unclosed comment
+ <p><!-- unclosed comment</p>
?  ++++++                    ++++
+ <p><em>not</em> a comment</p>
-
- *not* a comment
-
- -->


======================================================================
FAIL: test_raw_missing_close_bracket (tests.test_syntax.extensions.test_md_in_html.TestDefaultwMdInHTML.test_raw_missing_close_bracket)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/tests/test_syntax/blocks/test_html_blocks.py", line 662, in test_raw_missing_close_bracket
    self.assertMarkdownRenders(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        '<foo',
        ^^^^^^^
        '<p><foo</p>'
        ^^^^^^^^^^^^^^^^
    )
    ^
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/markdown/test_tools.py", line 77, in assertMarkdownRenders
    self.assertMultiLineEqual(output, expected)
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
AssertionError: '' != '<p><foo</p>'
+ <p><foo</p>


======================================================================
FAIL: test_unclosed_comment_ (tests.test_syntax.extensions.test_md_in_html.TestDefaultwMdInHTML.test_unclosed_comment_)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/tests/test_syntax/blocks/test_html_blocks.py", line 1022, in test_unclosed_comment_
    self.assertMarkdownRenders(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self.dedent(
        ^^^^^^^^^^^^
    ...<11 lines>...
        )
        ^
    )
    ^
  File "/<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build/markdown/test_tools.py", line 77, in assertMarkdownRenders
    self.assertMultiLineEqual(output, expected)
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
AssertionError: '<!-- unclosed comment\n\n*not* a comment\n\n-->' != '<p><!-- unclosed comment</p>\n<p><em>not</em> a comment</p>'
- <!-- unclosed comment
+ <p><!-- unclosed comment</p>
?  ++++++                    ++++
+ <p><em>not</em> a comment</p>
-
- *not* a comment
-
- -->
---------------------------------------------------------------------- Ran 970 tests in 0.442s FAILED (failures=4, skipped=64) E: pybuild pybuild:389: test: plugin pyproject failed with: exit code=1: cd /<<PKGBUILDDIR>>/.pybuild/cpython3_3.13_markdown/build; python3.13 -m unittest discover -v dh_auto_test: error: pybuild --test -i python{version} -p 3.13 returned exit code 13 make: *** [debian/rules:8: binary] Error 25 dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2 --------------------------------------------------------------------------------
#1137043#10
Date:
2026-05-20 08:21:52 UTC
From:
To:
Hello,

Bug #1137043 in python-markdown reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/python-team/packages/python-markdown/-/commit/d35d03cbc5122b1348239919b456270dba1663f8
------------------------------------------------------------------------
Adapt to changes in html.parser module in the new Python.

The changes were backported to Trixie as part of CVE fixes.

Closes: #1137043.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1137043

#1137043#15
Date:
2026-05-20 11:48:55 UTC
From:
To:
Hello,

Bug #1137043 in python-markdown reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/python-team/packages/python-markdown/-/commit/ee9f651d85a061d8d9847dbb7222b31e0e6a77c6
------------------------------------------------------------------------
Adapt to changes in html.parser module in the new Python.

The changes were backported to Bookworm as part of CVE fixes.

Closes: #1137043.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1137043

#1137043#20
Date:
2026-05-24 08:35:24 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
python-markdown, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1137043@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dmitry Shachnev <mitya57@debian.org> (supplier of updated python-markdown package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 20 May 2026 14:32:50 +0300
Source: python-markdown
Architecture: source
Version: 3.4.1-2+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Dmitry Shachnev <mitya57@debian.org>
Closes: 1137043
Changes:
 python-markdown (3.4.1-2+deb12u1) bookworm; urgency=medium
 .
   * Backport upstream fixes for parsing bogus HTML markup (CVE-2025-69534).
   * Adapt to changes in html.parser module in the new Python, backported
     to Bookworm as part of CVE fixes (closes: #1137043).
Checksums-Sha1:
 c8b4c6544368775fa809f4e22651523a5e94b7e8 2466 python-markdown_3.4.1-2+deb12u1.dsc
 965899c4f7531631f1592046ccd94655c1e4aa53 12276 python-markdown_3.4.1-2+deb12u1.debian.tar.xz
 5e6bc312292e5f4d6b83c358e3c42a17f08fbcc0 9009 python-markdown_3.4.1-2+deb12u1_source.buildinfo
Checksums-Sha256:
 63ed9b54485cfb14d7bdeefb05e65003299988c935cf154cc9038e9448c2355d 2466 python-markdown_3.4.1-2+deb12u1.dsc
 564c1606ee84bafe635393f8298456576629a2373f7342877d743edb4517e17d 12276 python-markdown_3.4.1-2+deb12u1.debian.tar.xz
 585d71731085f3b45441be10150c9edf278106a099e7cb547fda0af8c2020432 9009 python-markdown_3.4.1-2+deb12u1_source.buildinfo
Files:
 c2461a3a859152b1b2c45783a9e9a45a 2466 python optional python-markdown_3.4.1-2+deb12u1.dsc
 214b4a169180eeac07435888454f97e5 12276 python optional python-markdown_3.4.1-2+deb12u1.debian.tar.xz
 183d21f94dac5f97871b09a11ec173e1 9009 python optional python-markdown_3.4.1-2+deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEE8kKZ/xu8kBi5BqTLYCaTbS8ciuAFAmoSByQTHG1pdHlhNTdA
ZGViaWFuLm9yZwAKCRBgJpNtLxyK4MPtEACCfEn/hKkXdTmYNz18ykjjbWAbp+k9
koChITMWTUSiGnsTY/FiRGa3ycUG+xljppqbWPeGpURxNfA4BmVvv3YmIGRUOztd
0gn/M9dDkGivuw9HHq+so9ay1HNU+acF+5i/ZUe2y7auFGMn10Po6CAfACmulCMD
l1BbRK4+5WL+69PMsqQZsPl4mxNSsaUwnBjv1teZKey276gqEcxUrBJntE4pBtRh
0SM+y1FFHvrSVlyhjz7am9T7dUjjNAzDQ3c9ZgRmeG63HLgjiUCio2fQQ+ol80om
bhHgjPDFcJkJI3N9CxKS0XO9EymYCPisdbC8wBsOrhKGpicIEK8XOkNgdX9hcMWa
91/YYmPvlwEMjExCcR5a1J+sk1aQs5DCoTuV0LfmAXfqeJ5RDDAz26mCUNbO+Cgl
mJotO9o4fK0AKInYdTNNWT23o68z+x5nmAmyq6oqLsfLwEcfSGvgwkSLE7BmSL57
J0GL1+wlw4Qi+zAWQGznL0zIRIQkCJm7c6aXl4T1u6PrZ9yV3/aDraensc5al9CS
qWlVltoGfi8jeBAbWldA57oz+/BLyAMEhwCHpYqycJW3VeuqhHHfZs5o/Q/Zk7oB
Z0MiYqS+LNqk2IPARjgx3GIeRuv9eaNxdw9nLUXy96HaQG29vMpO8Ijuc3rbbtVH
Tr1McfUnR6HQCg==
=zUok
-----END PGP SIGNATURE-----