| 13 Nov 2025 |
 Grimmauld (any/all) | I don't have the time to look into hdf5 for another ~6h, i am also not sure i really want to | 11:14:21 |
| Grimmauld (any/all) | i am relying on hdf5 for my bachelors thesis (though not from nixpkgs), i have some idea about the pain with it | 11:15:02 |
| Grimmauld (any/all) | (probably not helped by the fact i need to build hdf5 for msvc tooling, but oh well) | 11:15:16 |
| Grimmauld (any/all) | the problem is: Not doing this upgrade means we'll have the CVEs on stable. Doing this upgrade is potentially breaking and will completely break the release schedule when we need to revert. | 11:17:03 |
| Grimmauld (any/all) | Either way is not great | 11:17:11 |
 leona | it's probably very awful to backport these patches? | 11:18:17 |
| Grimmauld (any/all) | I didn't explicitly look, but its quite a few CVEs and over half a year of development in an active repo makes me dread the merge conflicts | 11:19:02 |
| leona | fun | 11:19:26 |
| Grimmauld (any/all) | but fair, we could try backporting CVE fixes, then do 2.0.0 on unstable after branch-off (and backport that later if it doesn't break too much stuff on the then-unstable) | 11:19:45 |
| leona | that would be wonderful if that works IMO | 11:20:07 |
| Grimmauld (any/all) | but that needs someone with spoons fixing merge conflicts | 11:20:20 |
| Grimmauld (any/all) | ehmry is the listed maintainer, that won't fly | 11:20:34 |
| Grimmauld (any/all) | I mean i can look in ~6h, but if you want to start the staging cycle before then, then good luck | 11:20:59 |
 K900 | I can look, like, now | 11:22:00 |
| K900 | But if it doesn't trivially work I have no idea what to do | 11:22:11 |
| Grimmauld (any/all) | My bet is you'll at least have to pull out the mergiraf and stuff won't just cleanly apply | 11:22:39 |
| Grimmauld (any/all) | but do try! | 11:22:50 |
| K900 | No I mean like | 11:23:21 |
| K900 | Try updating it | 11:23:27 |
| Grimmauld (any/all) | oh | 11:23:31 |
| K900 | I am not backporting things in a codebase I don't understand and if I break it then science explodes | 11:23:45 |
| Grimmauld (any/all) | actually hold on, hdf5 is only 1200 rebuilds | 11:24:56 |
| Grimmauld (any/all) | reverting that in a staging cycle wouldn't be that bad | 11:25:05 |
| Grimmauld (any/all) | i guess we gamble | 11:25:16 |
| Grimmauld (any/all) | Science is one thing. CAD and computer vision also uses hdf5 | 11:26:04 |
| leona | ok, then I would also try to update | 11:26:21 |
| Grimmauld (any/all) | if vtk keeps building, i call the update worth | 11:27:09 |
| Grimmauld (any/all) | thats all i care about, though i guess the opencv people want opencv to work too | 11:27:23 |
 Vladimír Čunát | Are you sure that the CVEs are serious? | 11:30:28 |
| Vladimír Čunát | I mean, they seem to have been publicly open for months. | 11:30:39 |
