#1143006 pagure seems to be EOL upstream

Package:
src:pagure
Source:
src:pagure
Submitter:
Adrian Bunk
Date:
2026-09-18 11:45:07 UTC
Severity:
normal
Tags:
#1143006#5
Date:
2026-07-29 13:46:44 UTC
From:
To:
pagure is the kind of software that needs an active upstream
for security support (there's even an unfixed CVE right now),
but after Fedora migrated to Forgejo upstream development
seems to have ceased.

#1143006#10
Date:
2026-07-29 21:42:21 UTC
From:
To:
pagure upstream has been mostly-dead for a long time: I forwarded my
JavaScript security and pygit 1.16 compatibility patches to them around
18 months ago, and they didn't either accept or reply to them.

pagure has also been removed from testing due to (non-security) RC bugs.

Hence, while I do not like the idea of Debian being without any git
forges (gitlab was removed recently, forgejo isn't packaged yet), I
agree that pagure is not a good choice, and do not object to this
becoming a removal bug.

#1143006#23
Date:
2026-09-18 11:42:32 UTC
From:
To:
We believe that the bug you reported is now fixed; the following
package(s) have been removed from unstable:

    pagure | 5.14.1+dfsg-8 | source, all
 pagure-ci | 5.14.1+dfsg-8 | all
pagure-doc | 5.14.1+dfsg-8 | all
pagure-ev-server | 5.14.1+dfsg-8 | all
pagure-loadjson | 5.14.1+dfsg-8 | all
pagure-logcom | 5.14.1+dfsg-8 | all
pagure-milters | 5.14.1+dfsg-8 | all
pagure-mirror | 5.14.1+dfsg-8 | all
pagure-webhook | 5.14.1+dfsg-8 | all
------------------- Reason ------------------- ROM; RC-buggy, dead upstream ---------------------------------------------- Note that the package(s) have simply been removed from the tag database and may (or may not) still be in the pool; this is not a bug. The package(s) will be physically removed automatically when no suite references them (and in the case of source, when no binary references it). Please also remember that the changes have been done on the master archive and will not propagate to any mirrors until the next dinstall run at the earliest. Packages are usually not removed from testing by hand. Testing tracks unstable and will automatically remove packages which were removed from unstable when removing them from testing causes no dependency problems. The release team can force a removal from testing if it is really needed, please contact them if this should be the case. We try to close bugs which have been reported against this package automatically. But please check all old bugs, if they were closed correctly or should have been re-assigned to another package. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1143006@bugs.debian.org. The full log for this bug can be viewed at https://bugs.debian.org/1143006 This message was generated automatically; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org. Debian distribution maintenance software pp. Thorsten Alteholz (the ftpmaster behind the curtain)