Skip to content

fix: update dde-daemon dependency version constraint#517

Merged
xionglinlin merged 1 commit into
linuxdeepin:masterfrom
xionglinlin:master
Jul 6, 2026
Merged

fix: update dde-daemon dependency version constraint#517
xionglinlin merged 1 commit into
linuxdeepin:masterfrom
xionglinlin:master

Conversation

@xionglinlin

@xionglinlin xionglinlin commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Changed the dependency version requirement for dde-daemon from ">=6.1.26" to ">>6.1.99" to ensure a strict minimum version of the package is enforced, preventing compatibility issues with older versions that may lack critical security features or API changes.

Influence:

  1. Verify that installation succeeds with updated dde-daemon version
  2. Test system behavior with version 6.1.99 or higher
  3. Confirm that older versions are no longer accepted by the package manager
  4. Check dependency resolution in offline installation scenarios

fix: 更新 dde-daemon 依赖版本约束

将 dde-daemon 的依赖版本要求从 ">=6.1.26" 改为 ">>6.1.99",以确保强制 执行最低版本要求,防止因缺少关键安全特性或 API 变更的旧版本导致兼容性
问题。

Influence:

  1. 验证在更新的 dde-daemon 版本下安装成功
  2. 测试版本 6.1.99 及更高版本的系统行为
  3. 确认包管理器不再接受旧版本
  4. 检查离线安装场景中的依赖解析

PMS: BUG-367143
Change-Id: I249a7219a30f97dd529e9e08e1deae189312ffae

Summary by Sourcery

Build:

  • Update the dde-daemon version constraint in debian/control to enforce a stricter minimum supported version.

Changed the dependency version requirement for dde-daemon from
">=6.1.26" to ">>6.1.99" to ensure a strict minimum version of the
package is enforced, preventing compatibility issues with older versions
that may lack critical security features or API changes.

Influence:
1. Verify that installation succeeds with updated dde-daemon version
2. Test system behavior with version 6.1.99 or higher
3. Confirm that older versions are no longer accepted by the package
manager
4. Check dependency resolution in offline installation scenarios

fix: 更新 dde-daemon 依赖版本约束

将 dde-daemon 的依赖版本要求从 ">=6.1.26" 改为 ">>6.1.99",以确保强制
执行最低版本要求,防止因缺少关键安全特性或 API 变更的旧版本导致兼容性
问题。

Influence:
1. 验证在更新的 dde-daemon 版本下安装成功
2. 测试版本 6.1.99 及更高版本的系统行为
3. 确认包管理器不再接受旧版本
4. 检查离线安装场景中的依赖解析

PMS: BUG-367143
Change-Id: I249a7219a30f97dd529e9e08e1deae189312ffae
@sourcery-ai

sourcery-ai Bot commented Jul 6, 2026

Copy link
Copy Markdown
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR tightens the dde-daemon dependency constraint in the Debian packaging metadata to require a strictly newer minimum version, ensuring systems run with versions that include needed security and API updates.

File-Level Changes

Change Details Files
Strengthen dde-daemon dependency version requirement in Debian packaging to enforce a higher minimum version.
  • Update dde-daemon dependency constraint from a loosely bounded minimum to a strictly higher minimum version threshold
  • Align dependency metadata with expected runtime/security requirements for dde-daemon >= 6.1.99
debian/control

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@deepin-ci-robot

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: xionglinlin, yixinshark

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@deepin-ci-robot

Copy link
Copy Markdown
Contributor

deepin pr auto review

★ 总体评分:85分(0-100之间的整数)

■ 【总体评价】

☀代码实现了dde-daemon依赖版本的破坏性升级约束,但存在版本号表达不清晰的规范问题
逻辑正确但因版本号表达隐晦且不符合最佳实践扣15分

■ 【详细分析】

  • 1.语法逻辑(完全正确)✓
    在debian/control文件第33行,>>是Debian包管理系统中合法的版本关系运算符,dpkg能够正确解析>>6.1.99的语义(即严格大于6.1.99版本),语法层面完全无误。

  • 2.代码质量(一般)✕
    在debian/control文件第33行,使用>>6.1.99来表示需要6.2.0及以上版本属于隐晦的写法,不符合Debian打包规范的最佳实践。标准的做法应直接使用明确的版本号>= 6.2.0,以提升代码可读性和维护性。此外,关系运算符>>与版本号之间缺少空格,不符合常见的格式化规范。
    潜在问题:维护者阅读时需要心算转换版本号边界,容易引起误解;不符合DEP-6等规范中关于明确版本要求的建议。
    建议:将>>6.1.99修改为>= 6.2.0,并在运算符两侧添加空格以符合标准格式。

  • 3.代码性能(无性能问题)✓
    该变更为纯文本的包元数据修改,不涉及任何运行时代码、算法复杂度或系统调用,对系统运行性能无任何影响。

  • 4.代码安全(存在0个安全漏洞)✓
    漏洞对比统计:新增漏洞 0 个,减少漏洞 0 个,持平 0 个
    该diff仅涉及包依赖版本的声明调整,不包含可执行逻辑、命令解析、权限配置或敏感信息,不存在被利用进行命令注入、权限提升或信息泄露的攻击面。

  • 建议:无需针对此diff进行安全修复。

■ 【改进建议代码示例】

diff --git a/debian/control b/debian/control
index eb8f8447..5c35d7a5 100644
--- a/debian/control
+++ b/debian/control
@@ -30,7 +30,7 @@ Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}, ${dist:Depends},
  deepin-desktop-schemas (>=5.9.14),
  deepin-security-loader,
- dde-daemon (>=6.1.26),
+ dde-daemon (>= 6.2.0),
  x11-xserver-utils,
  deepin-authenticate(>=1.2.27),
  libssl3,

@xionglinlin
xionglinlin merged commit 36a8491 into linuxdeepin:master Jul 6, 2026
16 of 18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants