Opened 3 years ago

Closed 3 years ago

#18054 closed Cleanup/optimization (fixed)

deprecate contrib.markup

Reported by: ptone Owned by: nobody
Component: contrib.markup Version: master
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: yes
Easy pickings: no UI/UX: no

Description

A recent security issue (#17837) and then bug (#17994) in the markdown library has been a reminder that Django is not a markup framework, but a web framework and should continue shedding contrib modules that are:

  • not core to the usage of the framework
  • poorly tested
  • poorly documented

(list not comprehensive)

following the logic and pattern for the deprecation of databrowse #16907 - I'm suggesting that contrib.markup be deprecated for 1.5

Change History (8)

comment:1 Changed 3 years ago by carljm

  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Triage Stage changed from Unreviewed to Accepted

In particular, contrib modules where Django adds little value (writing a project-specific version of any one of its filters is a three or four line exercise) but gets a lot of exposure to "responsibility" for bugs and security issues in third-party packages. contrib.markup fits that bill exactly.

Accepting.

comment:2 Changed 3 years ago by aaugustin

FWIW I agree.

comment:3 Changed 3 years ago by PaulM

I agree as well. Accelerated deprecation for contrib.markup is a solid move.

comment:4 follow-up: Changed 3 years ago by timo

  • Has patch set
  • Version changed from 1.4 to master

comment:5 in reply to: ↑ 4 Changed 3 years ago by ptone

  • Patch needs improvement set

Replying to timo:

https://github.com/django/django/pull/170

Thanks for the patch.

A couple minor notes:

Paul is suggesting an accelerated deprecation timeline which I think does make sense - this would mean that the warning is a DeprecationWarning - not a PendingDeprecationWarning

Also, in each case where you are communicating the deprecation - it is often useful to provide a very brief suggestion such as "use the 3rd party Python markup libraries directly"

A note needs to be added to:

docs/internals/deprecation.txt

Note that if the deprecation is accelerated - it should be noted explicitly as accelerated under the 1.6 section (and release notes)

Finally - and this is subjective perhaps, I wouldn't inject the points about general philosophy as to why something is deprecated for this particular example, as we wouldn't repeat that for each deprecation.

However there is some good communication about deprecation philosophy in this ticket, and it might be worth adding to somewhere else in the docs - perhaps the release process doc

comment:6 Changed 3 years ago by ptone

ref #6526

comment:8 Changed 3 years ago by Julien Phalip <jphalip@…>

  • Resolution set to fixed
  • Status changed from new to closed

In [3da43c11113e0ef109ffbecae528aef853879281]:

Fixed #18054 -- Deprecated contrib.markup. Thanks to simukis for the initial patch.

Note: See TracTickets for help on using tickets.
Back to Top