Debian Package Tracker
Register | Log in
Subscribe

pdm

next generation Python package management tool

Choose email to subscribe with

general
  • source: pdm (main)
  • version: 2.23.1-2
  • maintainer: Debian Python Team (DMD)
  • uploaders: Boyuan Yang [DMD]
  • arch: all
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 2.2.1+ds1-1
  • stable: 2.20.1+ds1-2
  • testing: 2.23.1-2
  • unstable: 2.23.1-2
versioned links
  • 2.2.1+ds1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.20.1+ds1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.23.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • python3-pdm
action needed
A new upstream version is available: 2.25.9 high
A new upstream version 2.25.9 is available, you should consider packaging it.
Created: 2024-11-27 Last update: 2025-09-07 15:30
lintian reports 2 warnings normal
Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2025-08-13 Last update: 2025-08-13 12:31
1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:
  • CVE-2023-45805: (needs triaging) pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be `parseable as a version` and the filename must be a prefix of the project name, but it's not verified to match the version being installed. Version `2-2` is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what's actually installed could differ from what's listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit `6853e2642df` which is included in release version `2.9.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-10-21 Last update: 2025-08-18 07:02
debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 2.23.1-2 of the package, we noticed the following issues:

  • 1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-08-13 10:32
news
[rss feed]
  • [2025-08-18] pdm 2.23.1-2 MIGRATED to testing (Debian testing watch)
  • [2025-08-13] Accepted pdm 2.23.1-2 (source) into unstable (Alexandre Detiste)
  • [2025-08-12] Accepted pdm 2.23.1-1 (source) into unstable (Alexandre Detiste)
  • [2025-03-07] pdm 2.20.1+ds1-2 MIGRATED to testing (Debian testing watch)
  • [2025-03-02] Accepted pdm 2.20.1+ds1-2 (source) into unstable (Boyuan Yang)
  • [2024-11-29] pdm 2.20.1+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2024-11-23] Accepted pdm 2.20.1+ds1-1 (source) into unstable (Boyuan Yang)
  • [2024-11-14] pdm 2.20.0.post1+ds1-2 MIGRATED to testing (Debian testing watch)
  • [2024-11-08] Accepted pdm 2.20.0.post1+ds1-2 (source) into unstable (Boyuan Yang)
  • [2024-11-08] Accepted pdm 2.20.0.post1+ds1-1 (source) into unstable (Boyuan Yang)
  • [2024-05-05] pdm 2.2.1+ds1-2 MIGRATED to testing (Debian testing watch)
  • [2024-03-17] Accepted pdm 2.2.1+ds1-2 (source) into unstable (Pierre-Elliott Bécue)
  • [2023-09-19] pdm REMOVED from testing (Debian testing watch)
  • [2022-12-02] pdm 2.2.1+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2022-11-26] Accepted pdm 2.2.1+ds1-1 (source) into unstable (Boyuan Yang)
  • [2022-09-27] pdm 2.1.4+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-21] Accepted pdm 2.1.4+ds1-1 (source) into unstable (Boyuan Yang)
  • [2022-07-30] pdm 2.0.3+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2022-07-23] Accepted pdm 2.0.3+ds1-1 (source) into unstable (Boyuan Yang)
  • [2022-07-23] pdm 2.0.1+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2022-07-23] pdm 2.0.1+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2022-07-17] Accepted pdm 2.0.1+ds1-1 (source) into unstable (Boyuan Yang)
  • [2022-07-15] pdm 2.0.0b2+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2022-07-15] pdm 2.0.0b2+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2022-07-09] Accepted pdm 2.0.0b2+ds1-1 (source) into unstable (Boyuan Yang)
  • [2022-07-09] Accepted pdm 2.0.0b1+ds1-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Boyuan Yang)
  • [2001-12-19] Installed pdm 0.1 (arm source) (Philip Blundell)
bugs [bug history graph]
  • all: 2
  • RC: 0
  • I&N: 1
  • M&W: 0
  • F&P: 1
  • patch: 0
links
  • homepage
  • lintian (0, 2)
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 2.20.1+ds1-2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing