From harishkumar.jayakumar at springbord.com  Wed Jul  1 22:47:46 2026
From: harishkumar.jayakumar at springbord.com (HarishKumar J, (Springbord))
Date: Thu, 2 Jul 2026 11:17:46 +0530
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS application
In-Reply-To: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
Message-ID: <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>

Hi There,

I hope you are well!

We are currently using QGIS version 4.0.3 and have identified that it comes
bundled with PostgreSQL version 17.0.3.

Our security monitoring has flagged multiple high-priority vulnerabilities
within this version of PostgreSQL (including CVE-2025-4207 and others).
According to PostgreSQL security recommendations, a secure version would be
17.10 or higher.

Could you please confirm if there is a newer release of QGIS that bundles a
secure version of PostgreSQL? Additionally, if a bundled update is not yet
available, please advise on the recommended process for upgrading the
internal PostgreSQL component to version 17.10 or above without impacting
the QGIS application's stability.

Thanks,
Harish
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260702/3b6124b9/attachment.htm>

From dror.bogin at gmail.com  Wed Jul  1 23:47:10 2026
From: dror.bogin at gmail.com (Dror Bogin)
Date: Thu, 2 Jul 2026 09:47:10 +0300
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
Message-ID: <CAAKSpBsZtAm=VVFWqOJw55Y746Y2-xk1mt6DH9Co4q0bHYH9zA@mail.gmail.com>

Hi Harish,

Neither the standalone nor the OSGeo4W installations of QGIS come with a
prebundled PostgreSQL installation.
Since it sounds like you installed QGIS in an organization, it is mostly
recommended to use the LTR (Long Term Release) version (currently 3.44) in
that setting, not the newest version.
The first LTR of QGIS 4.x is planned to release in October, with QGIS 4.2.4.

On Thu, 2 Jul 2026 at 08:48, HarishKumar J, (Springbord) via QGIS-Developer
<qgis-developer at lists.osgeo.org> wrote:

> Hi There,
>
> I hope you are well!
>
> We are currently using QGIS version 4.0.3 and have identified that it
> comes bundled with PostgreSQL version 17.0.3.
>
> Our security monitoring has flagged multiple high-priority vulnerabilities
> within this version of PostgreSQL (including CVE-2025-4207 and others).
> According to PostgreSQL security recommendations, a secure version would be
> 17.10 or higher.
>
> Could you please confirm if there is a newer release of QGIS that bundles
> a secure version of PostgreSQL? Additionally, if a bundled update is not
> yet available, please advise on the recommended process for upgrading the
> internal PostgreSQL component to version 17.10 or above without impacting
> the QGIS application's stability.
>
> Thanks,
> Harish
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260702/46c5ba38/attachment-0001.htm>

From harishkumar.jayakumar at springbord.com  Thu Jul  2 00:33:09 2026
From: harishkumar.jayakumar at springbord.com (HarishKumar J, (Springbord))
Date: Thu, 2 Jul 2026 13:03:09 +0530
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <CAAKSpBsZtAm=VVFWqOJw55Y746Y2-xk1mt6DH9Co4q0bHYH9zA@mail.gmail.com>
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
 <CAAKSpBsZtAm=VVFWqOJw55Y746Y2-xk1mt6DH9Co4q0bHYH9zA@mail.gmail.com>
Message-ID: <CAASG=T2pfrWHN8VXCrLZCVYUeAtHhaPNodfzSt60K13GZwb8rw@mail.gmail.com>

Dear Dror,

Thank you for the clarification regarding the bundled installations.

Based on your recommendation to use the Long Term Release (LTR) version for
organizational settings, we will look into the current LTR 3.44. We will
also monitor the upcoming release of QGIS 4.2.4 in October.

Since QGIS does not come with a prebundled PostgreSQL installation, we will
investigate our internal deployment process to identify how PostgreSQL
17.0.3 was included and proceed with the necessary upgrades independently.

Thanks
Harish


On Thu, Jul 2, 2026 at 12:17?PM Dror Bogin <dror.bogin at gmail.com> wrote:

> Hi Harish,
>
> Neither the standalone nor the OSGeo4W installations of QGIS come with a
> prebundled PostgreSQL installation.
> Since it sounds like you installed QGIS in an organization, it is mostly
> recommended to use the LTR (Long Term Release) version (currently 3.44) in
> that setting, not the newest version.
> The first LTR of QGIS 4.x is planned to release in October, with QGIS
> 4.2.4.
>
> On Thu, 2 Jul 2026 at 08:48, HarishKumar J, (Springbord) via
> QGIS-Developer <qgis-developer at lists.osgeo.org> wrote:
>
>> Hi There,
>>
>> I hope you are well!
>>
>> We are currently using QGIS version 4.0.3 and have identified that it
>> comes bundled with PostgreSQL version 17.0.3.
>>
>> Our security monitoring has flagged multiple high-priority
>> vulnerabilities within this version of PostgreSQL (including CVE-2025-4207
>> and others). According to PostgreSQL security recommendations, a secure
>> version would be 17.10 or higher.
>>
>> Could you please confirm if there is a newer release of QGIS that bundles
>> a secure version of PostgreSQL? Additionally, if a bundled update is not
>> yet available, please advise on the recommended process for upgrading the
>> internal PostgreSQL component to version 17.10 or above without impacting
>> the QGIS application's stability.
>>
>> Thanks,
>> Harish
>> _______________________________________________
>> QGIS-Developer mailing list
>> QGIS-Developer at lists.osgeo.org
>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260702/b850bed9/attachment.htm>

From regis.haubourg at gmail.com  Thu Jul  2 02:21:22 2026
From: regis.haubourg at gmail.com (=?UTF-8?Q?R=C3=A9gis_Haubourg?=)
Date: Thu, 2 Jul 2026 11:21:22 +0200
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <CAASG=T2pfrWHN8VXCrLZCVYUeAtHhaPNodfzSt60K13GZwb8rw@mail.gmail.com>
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
 <CAAKSpBsZtAm=VVFWqOJw55Y746Y2-xk1mt6DH9Co4q0bHYH9zA@mail.gmail.com>
 <CAASG=T2pfrWHN8VXCrLZCVYUeAtHhaPNodfzSt60K13GZwb8rw@mail.gmail.com>
Message-ID: <722c5837-0c90-4f42-b58d-ed926c04c9ea@gmail.com>

Hi ,

Your scanner finds Postgres CVE because OSGEO4W ships clients for 
postgresql, ie psql, libpq and common libs.

The CVE catalog often mix client and server together, which can be a 
reason for false positives.
Please check if the CVE concerns the client, in which case, you can 
raise the issue on the security list security at qgis.org, which is private 
... because security is one a the few reasons were we fix things 
privately and disclose them afterward .

 From what I read "Buffer over-read in PostgreSQL GB18030 encoding 
validation allows a database input provider to achieve temporary denial 
of service on platforms where a 1-byte over-read can elicit process 
termination. This affects the database server and also libpq. Versions 
before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected." , 
libpq is affected, so yes, this version is concerned.

Please be all aware that the whole numeric ecosystems faces massive CVE 
disclosure because (or thanks to) AI helping security researchers. We do 
our best to upgrade libraries as soon as critical vulnerabilities are 
confirmed. For lower level vulnerabilities, we keep on track with our 
monthly release schedule.

To sum up :

- for production and IT deployment, please stick to LTR

- please continue to raise your scanner issues on security at qgis.org, 
after having checked the latest installers before

- please consider subscribing to a QGIS sustaining membership. We are 
trying to get enough fund so that permanent staff can handle this 
security and compliance wave. If you make value from QGIS, and consider 
security and digital strategic autonomy priorities , our membership is 
easy to find at https://www.qgis.org/#sustaining-members .

Best regards


Bien cordialement,
R?gis Haubourg

On 02/07/2026 09:33, HarishKumar J, (Springbord) via QGIS-Developer wrote:
> Dear Dror,
>
> Thank you for the clarification regarding the bundled installations.
>
> Based on your recommendation to use the Long Term Release (LTR) 
> version for organizational settings, we will look into the current LTR 
> 3.44. We will also monitor the upcoming release of QGIS 4.2.4 in October.
>
> Since QGIS does not come with a prebundled PostgreSQL installation, we 
> will investigate our internal deployment process to identify how 
> PostgreSQL 17.0.3 was included and proceed with the necessary upgrades 
> independently.
>
> Thanks
> Harish
>
>
> On Thu, Jul 2, 2026 at 12:17?PM Dror Bogin <dror.bogin at gmail.com> wrote:
>
>     Hi Harish,
>
>     Neither the standalone nor the OSGeo4W installations of QGIS come
>     with a prebundled PostgreSQL installation.
>     Since it sounds like you installed QGIS in an organization, it is
>     mostly recommended to use the LTR (Long Term Release) version
>     (currently 3.44) in that setting, not the newest version.
>     The first LTR of QGIS 4.x is planned to release in October, with
>     QGIS 4.2.4.
>
>     On Thu, 2 Jul 2026 at 08:48, HarishKumar J, (Springbord) via
>     QGIS-Developer <qgis-developer at lists.osgeo.org> wrote:
>
>         Hi There,
>
>         I hope you are well!
>
>         We are currently using QGIS version 4.0.3 and have identified
>         that it comes bundled with PostgreSQL version 17.0.3.
>
>         Our security monitoring has flagged multiple high-priority
>         vulnerabilities within this version of PostgreSQL (including
>         CVE-2025-4207 and others). According to PostgreSQL security
>         recommendations, a secure version would be 17.10 or higher.
>
>         Could you please confirm if there is a newer release of QGIS
>         that bundles a secure version of PostgreSQL? Additionally, if
>         a bundled update is not yet available, please advise on the
>         recommended process for upgrading the internal PostgreSQL
>         component to version 17.10 or above without impacting the QGIS
>         application's stability.
>
>         Thanks,
>         Harish
>         _______________________________________________
>         QGIS-Developer mailing list
>         QGIS-Developer at lists.osgeo.org
>         List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>         Unsubscribe:
>         https://lists.osgeo.org/mailman/listinfo/qgis-developer
>
>
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info:https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe:https://lists.osgeo.org/mailman/listinfo/qgis-developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260702/8ecfc77a/attachment.htm>

From rdmailings at duif.net  Thu Jul  2 02:30:15 2026
From: rdmailings at duif.net (Richard Duivenvoorde)
Date: Thu, 2 Jul 2026 11:30:15 +0200
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <CAASG=T2pfrWHN8VXCrLZCVYUeAtHhaPNodfzSt60K13GZwb8rw@mail.gmail.com>
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
 <CAAKSpBsZtAm=VVFWqOJw55Y746Y2-xk1mt6DH9Co4q0bHYH9zA@mail.gmail.com>
 <CAASG=T2pfrWHN8VXCrLZCVYUeAtHhaPNodfzSt60K13GZwb8rw@mail.gmail.com>
Message-ID: <e7ea444c-d822-441a-acef-01e2ed598f48@duif.net>

There is (for what I know) no PostgreSQL database server installation, but there IS a PostgreSQL-client(!) lib included.
Not sure if we are talking about the same thing here?

CVE-2025-4207 says it affects libpq, which I think is part of the client?

According to the osgeo4w packager we are on 18.4 since (from 17.3)... yesterday...
https://github.com/jef-n/OSGeo4W/blob/998472c3de1c3b51615033638c1910c5e5e28173/src/libpq/osgeo4w/package.sh

Not exactly sure when this will be part of new installers.

Regards,
Richard Duivenvoorde

On 7/2/26 09:33, HarishKumar J, (Springbord) via QGIS-Developer wrote:
> Dear Dror,
> 
> Thank you for the clarification regarding the bundled installations.
> 
> Based on your recommendation to use the Long Term Release (LTR) version for organizational settings, we will look into the current LTR 3.44. We will also monitor the upcoming release of QGIS 4.2.4 in October.
> 
> Since QGIS does not come with a prebundled PostgreSQL installation, we will investigate our internal deployment process to identify how PostgreSQL 17.0.3 was included and proceed with the necessary upgrades independently.
> 
> Thanks
> Harish
> 
> 
> On Thu, Jul 2, 2026 at 12:17?PM Dror Bogin <dror.bogin at gmail.com <mailto:dror.bogin at gmail.com>> wrote:
> 
>     Hi Harish,
> 
>     Neither the standalone nor the OSGeo4W installations of QGIS come with a prebundled PostgreSQL installation.
>     Since it sounds like you installed QGIS in an organization, it is mostly recommended to use the LTR (Long Term Release) version (currently 3.44) in that setting, not the newest version.
>     The first LTR of QGIS 4.x is planned to release in October, with QGIS 4.2.4.
> 
>     On Thu, 2 Jul 2026 at 08:48, HarishKumar J, (Springbord) via QGIS-Developer <qgis-developer at lists.osgeo.org <mailto:qgis-developer at lists.osgeo.org>> wrote:
> 
>         Hi There,
> 
>         I hope you are well!
> 
>         We are currently using QGIS version 4.0.3 and have identified that it comes bundled with PostgreSQL version 17.0.3.
> 
>         Our security monitoring has flagged multiple high-priority vulnerabilities within this version of PostgreSQL (including CVE-2025-4207 and others). According to PostgreSQL security recommendations, a secure version would be 17.10 or higher.
> 
>         Could you please confirm if there is a newer release of QGIS that bundles a secure version of PostgreSQL? Additionally, if a bundled update is not yet available, please advise on the recommended process for upgrading the internal PostgreSQL component to version 17.10 or above without impacting the QGIS application's stability.
> 
>         Thanks,
>         Harish
>         _______________________________________________
>         QGIS-Developer mailing list
>         QGIS-Developer at lists.osgeo.org <mailto:QGIS-Developer at lists.osgeo.org>
>         List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer <https://lists.osgeo.org/mailman/listinfo/qgis-developer>
>         Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer <https://lists.osgeo.org/mailman/listinfo/qgis-developer>
> 
> 
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer


From gdt at lexort.com  Thu Jul  2 05:02:22 2026
From: gdt at lexort.com (Greg Troxel)
Date: Thu, 02 Jul 2026 08:02:22 -0400
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
 (HarishKumar J.'s message of "Thu, 2 Jul 2026 11:17:46 +0530")
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
Message-ID: <rmise61bnw1.fsf@s1.lexort.com>

"HarishKumar J, (Springbord) via QGIS-Developer"
<qgis-developer at lists.osgeo.org> writes:

> We are currently using QGIS version 4.0.3 and have identified that it comes
> bundled with PostgreSQL version 17.0.3.

You should understand that qgis is fundamentally a source code release,
and that therefore it is incorrect in general to speak of it as having a
specific associated postgresql version.

It is likely that you are using some specific bundled installer that
also contains dependencies, for a specific operating system -- but you
did not give any information about that.

> Could you please confirm if there is a newer release of QGIS that bundles a
> secure version of PostgreSQL? Additionally, if a bundled update is not yet
> available, please advise on the recommended process for upgrading the
> internal PostgreSQL component to version 17.10 or above without impacting
> the QGIS application's stability.

This is open source, and you are (legally) able to modify the control
files for the bundle and produce your own updated installers -- and then
contribute changes back.  Given your organization's security concerns,
you may wish to hire an employee or consultant who can help with this.
I would expect that the cost of consulting or a managed build service
would be far below the cost of proprietary licenses for proprietary
GIS software.


Separately, if you are concerned about stability, it is a surprising and
perhaps unwise choice to be using 4.0.3.  qgis continues to recommend
3.44.x as the stable version.

From andreaerdna at libero.it  Sun Jul  5 23:34:17 2026
From: andreaerdna at libero.it (Andrea Giudiceandrea)
Date: Mon, 6 Jul 2026 08:34:17 +0200
Subject: [QGIS-Developer] equals_exact confusion
Message-ID: <a5231e3c-9ad3-49ea-b0a1-dc3296eb303e@libero.it>

Hi Stefanos and list,
I also have the feeling that the current implementation is not very clear.

I apologise I cannot elaborate more since I'm travelling for a few weeks.

Regards.

Andrea


Il 30/06/2026 20:27, Stefanos Natsis via QGIS-Developer ha scritto:
> I'm afraid that the current implementation may lead to user confusion, 
> because now one can use:

From lova at kartoza.com  Mon Jul  6 01:11:50 2026
From: lova at kartoza.com (Lova Andriarimalala)
Date: Mon, 6 Jul 2026 11:11:50 +0300
Subject: [QGIS-Developer] QGIS.org Website Maintenance tasks
Message-ID: <CAMLC-sB4NoyrkQ8gP=8WhFDAFK_wrf5Q9pHt4q-bkGEq13saAA@mail.gmail.com>

Hello everyone,

We are planning maintenance tasks on the QGIS.org website today between
11:00 and 13:00 UTC; access to the website might be slightly disturbed
during that time. We apologies for any inconvenience that this might cause.

Thank you for your understanding.

Best regards,
Lova Andriarimalala


*QGIS Full Stack Developer   *
*T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W* :
kartoza.com



*This email and any attachments are confidential and intended solely for
the use of the individual or entity to whom they are addressed. If you *
*have received this email in error, please notify the sender immediately
and delete it from your system. Unauthorised use, disclosure, or copying*
*of the contents is prohibited.*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260706/cd6e06ee/attachment.htm>

From lova at kartoza.com  Mon Jul  6 06:13:12 2026
From: lova at kartoza.com (Lova Andriarimalala)
Date: Mon, 6 Jul 2026 16:13:12 +0300
Subject: [QGIS-Developer] Coming soon: QGIS Plugins Website v4.0.0
Message-ID: <CAMLC-sBJrfBu3nPU2U-+FuKj2a9FSg_ALOBRfjgD+pUXmPTQdA@mail.gmail.com>

Hello everyone,

We are getting ready to release version v4.0.0 of the QGIS Plugins Website (
plugins.qgis.org), planned for 13 July 2026. Here is a heads up on what is
coming.

This will be our first major release that adopts a proper announcement and
release schedule. It will include major improvements and changes related to
the security checks and plugins auto-approval; and a new feature for Qt6
compatibility check which was funded by Oslandia (oslandia.com) and
developed by @florentfougeres <https://github.com/florentfougeres>.

The full preview about the planned changes is on our blog:
https://blog.qgis.org/2026/07/06/coming-soon-qgis-plugins-website-v4-0-0/.
Please carefully review each point as there might be some actions required
from your side.

If anything here is a concern, please raise an issue at
https://github.com/qgis/QGIS-Plugins-Website/issues before 13 July 2026
while we can still adjust. Thank you for being part of the QGIS plugin
community.

Best regards,

The QGIS Plugins Website team

Lova Andriarimalala


*QGIS Full Stack Developer   *
*T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W* :
kartoza.com



*This email and any attachments are confidential and intended solely for
the use of the individual or entity to whom they are addressed. If you *
*have received this email in error, please notify the sender immediately
and delete it from your system. Unauthorised use, disclosure, or copying*
*of the contents is prohibited.*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260706/40f80c3f/attachment.htm>

From bo.victor.thomsen at gmail.com  Wed Jul  8 06:54:00 2026
From: bo.victor.thomsen at gmail.com (Bo Victor Thomsen)
Date: Wed, 8 Jul 2026 15:54:00 +0200
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
Message-ID: <caa2e6dc-cf22-41b0-91bb-8a804f90283b@gmail.com>

Harish -

As of today, You have 2 options to get the desired postgres upgrades 
(18.4.1):

  * Install the latest LTR version af QGIS, ver. 3.44.12. It comes with
    version 18.4.1 of pqlib (Postgres communication).
  * Install the newest version of QGIS, version 4.2.0 . It too, comes
    with pqlib version 18.4.1.

    Version 4.2.*0* is an "Early adopter" version -? not yet suited for
    enterprise use. However, If you can wait, version 4.2*.4*, will be
    the new LRT version around October 30, 2026.

Med venlig hilsen / Best regards

Bo Victor Thomsen

On 02-07-2026 07:47, HarishKumar J, (Springbord) via QGIS-Developer wrote:
> Hi There,
>
> I hope you are well!
>
> We are currently using QGIS version 4.0.3 and have identified that it 
> comes bundled with PostgreSQL version 17.0.3.
>
> Our security monitoring has flagged multiple high-priority 
> vulnerabilities within this version of PostgreSQL (including 
> CVE-2025-4207 and others). According to PostgreSQL security 
> recommendations, a secure version would be 17.10 or higher.
>
> Could you please confirm if there is a newer release of QGIS that 
> bundles a secure version of PostgreSQL? Additionally, if a bundled 
> update is not yet available, please advise on the recommended process 
> for upgrading the internal PostgreSQL component to version 17.10 or 
> above without impacting the QGIS application's stability.
>
> Thanks,
> Harish
>
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info:https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe:https://lists.osgeo.org/mailman/listinfo/qgis-developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260708/74fff5b4/attachment-0001.htm>

From gdt at lexort.com  Wed Jul  8 08:36:21 2026
From: gdt at lexort.com (Greg Troxel)
Date: Wed, 08 Jul 2026 11:36:21 -0400
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <caa2e6dc-cf22-41b0-91bb-8a804f90283b@gmail.com> (Bo Victor
 Thomsen via's message of "Wed, 8 Jul 2026 15:54:00 +0200")
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
 <caa2e6dc-cf22-41b0-91bb-8a804f90283b@gmail.com>
Message-ID: <rmise5tze6i.fsf@s1.lexort.com>

Bo Victor Thomsen via QGIS-Developer <qgis-developer at lists.osgeo.org>
writes:

> As of today, You have 2 options to get the desired postgres upgrades
> (18.4.1):
>
>  * Install the latest LTR version af QGIS, ver. 3.44.12. It comes with
>    version 18.4.1 of pqlib (Postgres communication).
>  * Install the newest version of QGIS, version 4.2.0 . It too, comes
>    with pqlib version 18.4.1.
>
>    Version 4.2.*0* is an "Early adopter" version -? not yet suited for
>    enterprise use. However, If you can wait, version 4.2*.4*, will be
>    the new LRT version around October 30, 2026.

But qgis *source code* does not come with postgresql at all.  You are
talking about a particular binary package, and I think it would be
helpful if messages describing binary packages identify the binary
package, every time.

From bo.victor.thomsen at gmail.com  Wed Jul  8 09:54:09 2026
From: bo.victor.thomsen at gmail.com (Bo Victor Thomsen)
Date: Wed, 8 Jul 2026 18:54:09 +0200
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <rmise5tze6i.fsf@s1.lexort.com>
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
 <caa2e6dc-cf22-41b0-91bb-8a804f90283b@gmail.com>
 <rmise5tze6i.fsf@s1.lexort.com>
Message-ID: <9c48647b-31bd-461a-bc5e-3925b1408c2b@gmail.com>

Hi Greg -

You're right about the source code distribution.

What I was talking about - and didn't specifically explain - was the 
different? binary installation packages available through the QGIS.org 
homepage. Which is used by the large majority of QGIS-using 
organizations? to install QGIS.

So here is information about the specific?QGIS installation 
packages?containing the latest PostgreSQL client version *18.4*:

  * QGIS LTR, version *3.44.12*. Long term release, suitable for
    enterprise use.
  * QGIS lastest version *4.2.0*. Early adapter version, not (yet)
    suitable for enterprise use.

Both binary packages can be downloaded at QGIS.org homepage: 
https://qgis.org/download/

Med venlig hilsen / Best regards

Bo Victor Thomsen

On 08-07-2026 17:36, Greg Troxel via QGIS-Developer wrote:
> Bo Victor Thomsen via QGIS-Developer<qgis-developer at lists.osgeo.org>
> writes:
>
>> As of today, You have 2 options to get the desired postgres upgrades
>> (18.4.1):
>>
>>   * Install the latest LTR version af QGIS, ver. 3.44.12. It comes with
>>     version 18.4.1 of pqlib (Postgres communication).
>>   * Install the newest version of QGIS, version 4.2.0 . It too, comes
>>     with pqlib version 18.4.1.
>>
>>     Version 4.2.*0* is an "Early adopter" version -? not yet suited for
>>     enterprise use. However, If you can wait, version 4.2*.4*, will be
>>     the new LRT version around October 30, 2026.
> But qgis *source code* does not come with postgresql at all.  You are
> talking about a particular binary package, and I think it would be
> helpful if messages describing binary packages identify the binary
> package, every time.
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info:https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe:https://lists.osgeo.org/mailman/listinfo/qgis-developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260708/491956b2/attachment.htm>

From gdt at lexort.com  Wed Jul  8 11:41:18 2026
From: gdt at lexort.com (Greg Troxel)
Date: Wed, 08 Jul 2026 14:41:18 -0400
Subject: [QGIS-Developer] PostgreSQL vulnerability in the QGIS
 application
In-Reply-To: <9c48647b-31bd-461a-bc5e-3925b1408c2b@gmail.com> (Bo Victor
 Thomsen via's message of "Wed, 8 Jul 2026 18:54:09 +0200")
References: <CAASG=T14DOVN0mq0jy5fCE29o4GahE6o78_x3YH1DLHSHJvoHw@mail.gmail.com>
 <CAASG=T0RnCDFdj3bBo_CrQhFoovYs-PFdsTSM8u++mKTyXgf0A@mail.gmail.com>
 <caa2e6dc-cf22-41b0-91bb-8a804f90283b@gmail.com>
 <rmise5tze6i.fsf@s1.lexort.com>
 <9c48647b-31bd-461a-bc5e-3925b1408c2b@gmail.com>
Message-ID: <rmih5m9z5m9.fsf@s1.lexort.com>

Bo Victor Thomsen via QGIS-Developer <qgis-developer at lists.osgeo.org>
writes:

> Hi Greg -
>
> You're right about the source code distribution.
>
> What I was talking about - and didn't specifically explain - was the
> different? binary installation packages available through the QGIS.org
> homepage. Which is used by the large majority of QGIS-using
> organizations? to install QGIS.
>
> So here is information about the specific?QGIS installation
> packages?containing the latest PostgreSQL client version *18.4*:
>
>  * QGIS LTR, version *3.44.12*. Long term release, suitable for
>    enterprise use.
>  * QGIS lastest version *4.2.0*. Early adapter version, not (yet)
>    suitable for enterprise use.
>
> Both binary packages can be downloaded at QGIS.org homepage:
> https://qgis.org/download/

Sorry to seem difficult, but I can't reconcile the implied "there exist
only two specific packages" with finding on the order of a dozen at that
link.

At that link, there are multiple operating systems, and multiple
options.  It's not clear to me if all of them are full bundles, vs
normal packages with dependencies from the base system.  There is

  Windows
    osgeo4w
    LTR and stable
  macOS
    LTR and stable
  Linux
    7 distributions plus flatpack/spack
  BSD
    FreeBSD
      LTR and stable
    OpenBSD
      stable
  Container
    (hard to figure out)


Are you saying that every single one of those options will use pgsql
18.4.1?  I would think that the GNU/Linux (actual distributions not
flat-ish) would be using what the distribution was on, and it's not up
to qgis to fix that, vs installers that bundle everything (to remediate
the problem of the base OS not having a high-functioning packaging
system).

For the BSD packaging systems pointed to, surely those are maintained by
FreeBSD and OpenBSD people, just as I maintain the entries in pkgsrc
(NetBSD, illumos, and many others).  Thus qgis.org is not choosing pgsql
versions.

Or do you mean only the two Windows installers?

What I'm asking is that if you are talking about two specific windows
installers, to say that, to avoid people interpreting statements as
applying to the N other ways one can get binary distributions, many of
which have their own processes and change control.  The assumption that
"installing qgis" equals "installing qgis on windows" is not sound, even
if it is often true.

Thanks,
Greg

From gdt at lexort.com  Fri Jul 10 09:17:56 2026
From: gdt at lexort.com (Greg Troxel)
Date: Fri, 10 Jul 2026 12:17:56 -0400
Subject: [QGIS-Developer] anyone else get a vague github shakedown notice?
 is this about qgis?
Message-ID: <rmi4ii624zv.fsf@s1.lexort.com>

tl;dr:

  I got an email from github threatening to start billing me, and have
  eliminated most reasons why it would have arrived, and my qgis
  association is next.



For background, I've had a github account for a long time, but never
signed up for a paid plan or given them billing information.   I have
been a listed member of a few organizations, that I "left" a few months
ago as the tone of paid services and AI increased, since they were
defunct anyway.

A few days ago I got email, purporting to be from github, delivered via
sendgrid, and DKIM signed from github.  So I suspect it's really from
them.  Trimming parts that aren't useful enough for anyone to read:

  You're receiving this because your organization is using the GitHub
  Code Quality public preview. As we shared on June 16, Code Quality
  moves to general availability on *July 20, 2026*. This email covers
  the details: what you'll pay, what's included, and how to prepare.

  *Pricing*

  Code Quality is priced as a *base subscription plus metered usage* :

  Component How it's billed What it covers *Per-committer license* $10
  per active committer per month Enterprise access to Code Quality:
  findings, scoring, Rulesets integration, Security Overview, and
  org-level governance *AI-powered usage* Usage-based (AI Credits)
  Copilot code review on Code Quality-enabled repos, AI-assisted
  detection, Copilot Autofix generation *Deterministic analysis* GitHub
  Actions minutes CodeQL-powered maintainability and reliability scans ?
  fast, predictable, and token-free

  Active committers are counted on repositories where Code Quality is
  enabled, using the same active-committer methodology as GitHub
  Advanced Security. For more information, you can review our
  documentation here (
  https://docs.github.com/billing/concepts/product-billing/github-code-quality
  ).

  *How to prepare*

  * If you have a GitHub or Microsoft account team, reach out to them with any questions. They have a pricing calculator and can model costs based on your actual usage.
  * Evaluate your repository coverage. Decide which repositories should continue with Code Quality enabled after July 20. Disabling Code Quality on a repository before July 20 means no charges for that repository.

  More details are available in our documentation ( https://docs.github.com/code-security/concepts/about-code-quality ).

  You are receiving this because you?re a part of GitHub Sponsors.

As for sponsors, I am not enrolled, and I have not sponsored anyone.  So
their email is wrong.


I wonder:

  - is qgis using "Code Quality" and somehow because I have a clone,
    have filed issues/etc. I got it?
  - did others get this?
  - any thoughts on whether this is confused, vs underhanded, and is
    anyone worried about surprise bills?

From nyall.dawson at gmail.com  Mon Jul 13 17:44:42 2026
From: nyall.dawson at gmail.com (Nyall Dawson)
Date: Tue, 14 Jul 2026 10:44:42 +1000
Subject: [QGIS-Developer] QEP: Removal of deprecated Processing GUI API
Message-ID: <CAB28Asj7B23UOhKfw1hPK734rBRBOGBFw_kkjzvd+9mmQF=_1w@mail.gmail.com>

Hi lists,

Following up the recent formalisation of a process for removal of
deprecated API mid-release cycle (see
https://github.com/qgis/QGIS-Enhancement-Proposals/pull/384), I've just
submitted a proposal to remove the deprecated Python Processing
"WidgetWrapper" API.

As per clause 1.4.4 of the Stable API policy, this API should be removed on
the grounds that maintaining backward compatibility both introduces an
insurmountable maintenance burden and fundamentally blocks critical bug
fixes (condition 1.4.4.1).

This pure Python API is an ongoing source of unsolvable issues in the
Processing framework, such as https://github.com/qgis/QGIS/issues/66282. It
relies on a fragile memory management model, where the lifetime of objects
created in C++ vs Python results in unpredictable object deletion or memory
leakage. Over time the conclusion from QGIS developers familiar with this
code is that this approach just cannot be fixed, and we need to move solely
to the approach used elsewhere in QGIS, where Python is used solely to
subclass C++ base classes, with all memory management living at the C++
level (either through direct C++ memory management or via C++ Qt
parent/child associations).

In addition, the old API predated major overhauls of Processing GUI
components such as the model designer, and the assumptions used in that API
no longer apply (such as existence of Python dialog classes). Working
around these old assumptions is a considerable drain on QGIS developers,
and is blocking further desirable revamps and modernisation of the QGIS
model designer interface.

This API has been marked as deprecated since QGIS 3.4, with
developer-facing warnings being shown for over 7 years.

See https://github.com/qgis/QGIS-Enhancement-Proposals/pull/386
<https://github.com/qgis/QGIS-Enhancement-Proposals/pull/384> for the
proposed changes and a detailed write up on the plan for removal.

Please give all feedback on this proposed change as comments on the PR
itself (not direct email replies) to keep the discussion centralized.

Kind regards,
Nyall
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260714/c718c6d6/attachment.htm>

From julien.cabieces at oslandia.com  Wed Jul 15 03:10:23 2026
From: julien.cabieces at oslandia.com (Julien Cabieces)
Date: Wed, 15 Jul 2026 12:10:23 +0200
Subject: [QGIS-Developer] Call for vote for coding style "Precise member
 prefix scope"
Message-ID: <87qzl4r2b4.fsf@julienlaptop.home>


Hi list, 

Please cast your vote regarding this coding standard modification Pull
Request [0]?which explicit already existing naming convention for member variables.

Kind regards,
Julien

[0] https://github.com/qgis/QGIS-Enhancement-Proposals/pull/383

-- 

Julien Cabieces
Senior Developer at Oslandia
julien.cabieces at oslandia.com

From strk at kbt.io  Wed Jul 15 20:49:19 2026
From: strk at kbt.io (Sandro Santilli)
Date: Thu, 16 Jul 2026 05:49:19 +0200
Subject: [QGIS-Developer] anyone else get a vague github shakedown
 notice? is this about qgis?
In-Reply-To: <rmi4ii624zv.fsf@s1.lexort.com>
References: <rmi4ii624zv.fsf@s1.lexort.com>
Message-ID: <74CE3374-C622-4305-9419-4DC022739DE4@kbt.io>



Il 10 luglio 2026 18:17:56 CEST, Greg Troxel via QGIS-Developer <qgis-developer at lists.osgeo.org> ha scritto:
>tl;dr:
>
>  I got an email from github threatening to start billing me

[..]

>  - did others get this?

I just did, with a reference to the "OSGeo" GitHub organization.

>  - any thoughts on whether this is confused, vs underhanded, and is
>    anyone worried about surprise bills?

I believe OSGeo as an organization have been paying Microsoft's GitHub for services like CI time - as per some project's request - so chances are the billing would really kick in.

This is an OSGeo-wide issue so I guess should be brought up to the projects [1] or discuss [2] mailing lists, and maybe ticketed on https://trac.osgeo.org/osgeo

[1] https://lists.osgeo.org/mailman/listinfo/projects
[2] https://lists.osgeo.org/mailman/listinfo/discuss


-- 
Sent from hand-held device with K-9 Mail. Please excuse my brevity.

From jef at norbit.de  Thu Jul 16 00:29:36 2026
From: jef at norbit.de (=?utf-8?Q?J=C3=BCrgen_E=2E?= Fischer)
Date: Thu, 16 Jul 2026 09:29:36 +0200
Subject: [QGIS-Developer] anyone else get a vague github shakedown
 notice? is this about qgis?
In-Reply-To: <rmi4ii624zv.fsf@s1.lexort.com>
References: <rmi4ii624zv.fsf@s1.lexort.com>
Message-ID: <20260716072936.qovg7b3rgtpdvyom@norbit.de>

Hi Greg,

On Fri, 10. Jul 2026 at 12:17:56 -0400, Greg Troxel via QGIS-Developer wrote:
> For background, I've had a github account for a long time, but never
> signed up for a paid plan or given them billing information.   I have
> been a listed member of a few organizations, that I "left" a few months
> ago as the tone of paid services and AI increased, since they were
> defunct anyway.

Same here.  I got that mail yesterday and also have no clue, where that should
be used.

I see that I've allegedly used $0.16 of "metered usage"
(https://github.com/settings/billing), which apparently is all "Free usage"
and was used for (my fork of) pcraster ($0.15: actions linux: $0.02; actions
macos: $0.12; action windows:0.01) and PDAL (<$0.01; actions storage: <$0.01),
but "code quality" and actions is off in both.


J?rgen

-- 
J?rgen E. Fischer           norBIT GmbH             Tel. +49-4931-918175-31
Dipl.-Inf. (FH)             Rheinstra?e 13          Fax. +49-4931-918175-50
Software Engineer           D-26506 Norden            https://www.norbit.de
QGIS release manager (PSC)  Germany                  Matrix: @jef:osgeo.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260716/43be64f1/attachment.sig>

From regis.haubourg at gmail.com  Thu Jul 16 02:56:47 2026
From: regis.haubourg at gmail.com (=?ISO-8859-1?Q?R=E9gis_Haubourg?=)
Date: Thu, 16 Jul 2026 11:56:47 +0200
Subject: [QGIS-Developer] anyone else get a vague github shakedown
 notice? is this about qgis?
In-Reply-To: <20260716072936.qovg7b3rgtpdvyom@norbit.de>
References: <rmi4ii624zv.fsf@s1.lexort.com>
 <20260716072936.qovg7b3rgtpdvyom@norbit.de>
Message-ID: <C8F7B49C-99EF-4AC8-B486-409A08A11FF2@gmail.com>

In fact this seams to be a bit sloppy from GitHub. The organization mentioned in their mail has only one archived  repo and no code quality option enabled. 
I bet they vibe coded their campaign



Le 16 juillet 2026 09:29:36 GMT+02:00, "J?rgen E. Fischer via QGIS-Developer" <qgis-developer at lists.osgeo.org> a ?crit :
>Hi Greg,
>
>On Fri, 10. Jul 2026 at 12:17:56 -0400, Greg Troxel via QGIS-Developer wrote:
>> For background, I've had a github account for a long time, but never
>> signed up for a paid plan or given them billing information.   I have
>> been a listed member of a few organizations, that I "left" a few months
>> ago as the tone of paid services and AI increased, since they were
>> defunct anyway.
>
>Same here.  I got that mail yesterday and also have no clue, where that should
>be used.
>
>I see that I've allegedly used $0.16 of "metered usage"
>(https://github.com/settings/billing), which apparently is all "Free usage"
>and was used for (my fork of) pcraster ($0.15: actions linux: $0.02; actions
>macos: $0.12; action windows:0.01) and PDAL (<$0.01; actions storage: <$0.01),
>but "code quality" and actions is off in both.
>
>
>J?rgen
>
>-- 
>J?rgen E. Fischer           norBIT GmbH             Tel. +49-4931-918175-31
>Dipl.-Inf. (FH)             Rheinstra?e 13          Fax. +49-4931-918175-50
>Software Engineer           D-26506 Norden            https://www.norbit.de
>QGIS release manager (PSC)  Germany                  Matrix: @jef:osgeo.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260716/c6a90676/attachment.htm>

From administration at qgis.org  Tue Jul 21 08:03:12 2026
From: administration at qgis.org (Marco Serusi)
Date: Tue, 21 Jul 2026 17:03:12 +0200
Subject: [QGIS-Developer] QGIS Contributor Survey
Message-ID: <CAEZiKtwpyayfcwWdXJEc0VOgj1ZKfwCbyZed8BwhcQP8isgK-g@mail.gmail.com>

Hello everyone,

Without contributors like you, QGIS would not exist. That is why the PSC is
always looking for ways improve our community and make it easy for everyone
to contribute.

To help them, you can fill out this year?s QGIS Contributor Survey
<https://docs.google.com/forms/d/e/1FAIpQLSc__qKm7DqFCOmZlE3jQiCxf8jJgLbuzHcHiER_ZFgAIcplDw/viewform?usp=header>.
It has been designed to provide feedback to the PSC about the community and
help guide future initiatives. It will remain open for answers until the
30th of September.

A few things you should know :

   - All answers are anonymous and will remain confidential
   - If you wish to be contacted, you can leave your email on the last page
   - The survey can seem quite long, but *only a few questions are
   mandatory*. If you are short of time, feel free to skip the rest or just
   pick the most relevant

If you have doubts, you can reach out to administration at qgis.org.

Thank you for your help,

*Marco S*
*Administrative Assistant - QGIS*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260721/21a7bd57/attachment.htm>

From gdt at lexort.com  Tue Jul 21 08:55:41 2026
From: gdt at lexort.com (Greg Troxel)
Date: Tue, 21 Jul 2026 11:55:41 -0400
Subject: [QGIS-Developer] QGIS Contributor Survey
In-Reply-To: <CAEZiKtwpyayfcwWdXJEc0VOgj1ZKfwCbyZed8BwhcQP8isgK-g@mail.gmail.com>
 (Marco Serusi via's message of "Tue, 21 Jul 2026 17:03:12 +0200")
References: <CAEZiKtwpyayfcwWdXJEc0VOgj1ZKfwCbyZed8BwhcQP8isgK-g@mail.gmail.com>
Message-ID: <rmiecgwwd4y.fsf@s1.lexort.com>

Marco Serusi via QGIS-Developer <qgis-developer at lists.osgeo.org> writes:

> <https://docs.google.com/forms/d/e/1FAIpQLSc__qKm7DqFCOmZlE3jQiCxf8jJgLbuzHcHiER_ZFgAIcplDw/viewform?usp=header>.
>    - All answers are anonymous and will remain confidential

Can you explain how "anonymous/confidential" and google forms go
together?

From bas at rdgland.com  Wed Jul 22 06:25:36 2026
From: bas at rdgland.com (Sebastian Gutwein)
Date: Wed, 22 Jul 2026 09:25:36 -0400
Subject: [QGIS-Developer] SAGA GIS plugin maintenance
In-Reply-To: <CAHw6TZdC0ceW14eAAKk3ZTTS2=pJW8-DKeL=mpGV25O1vv4JUw@mail.gmail.com>
References: <mailman.16474.1779357198.622.qgis-developer@lists.osgeo.org>
 <CAHw6TZfhe+wLRbtWCTXD2uLf2zOXBS0bJFc5bvxwaPFXMf4uxw@mail.gmail.com>
 <CAHw6TZdC0ceW14eAAKk3ZTTS2=pJW8-DKeL=mpGV25O1vv4JUw@mail.gmail.com>
Message-ID: <CAED_52qvB9a0=08JEksTwMkmFpA7+buo2DXKszB5drHyHAMTyg@mail.gmail.com>

Hi all,
I'm not a trained programmer but I use SAGA in QGIS frequently and teach
with it so am interested in having the plugin in the repository.
To that end I have forked the SAGA Next Gen repository and made a few
changes to make it compatible with QGIS 4.x. and am planning on uploading
to the official QGIS repository.
I talked to Nyall and he was supportive of this. I don't know that I will
be able to fully maintain the functionality if SAGA continues to change
things as is described in these threads.
However, it currently functions for my needs and I assume for others as
well. If anyone else has other plans for the plugin I am happy to pass it
off to them.
The repository is here -
https://github.com/baswein/qgis-processing-saga-nextgen .
Thank everyone at QGIS and SAGA for all of their contributions over the
years to open source GIS.
-Bas


On Thu, May 21, 2026 at 8:16?AM Stefano Campus via QGIS-Developer <
qgis-developer at lists.osgeo.org> wrote:

> First of all, thank you all for your feedback.
>
> It is clear that the problem is not (solely) the SAGA plugin, but rather a
> perspective on the sustainability of open-source projects, which, I
> imagine, Nyall has rightly raised.
>
> To avoid any misunderstanding and in response to Greg?s comments, in this
> context I am simply a user who used to use SAGA very frequently some time
> ago; as the features of QGIS/ Processing have improved and expanded, I
> hardly use it anymore, except for rasterisation, which allows complete
> control over the rasterisation values when, for example, I have overlapping
> points, and SAGA allows you to choose whether to assign the minimum,
> average, maximum, sum, etc., to the raster cell ? a function that GDAL does
> not have.
>
> However, I reiterate that I consider Nyall?s decision to be a
> ?provocation? (in a positive sense, let?s be clear) to draw attention to
> sustainability.
>
> Jurgen has stated the difficulty in keeping up with SAGA?s developments,
> which are often unannounced, and attempts at structured collaboration ?
> correct me if I?m wrong ? with SAGA?s maintainers have not yielded good
> results.
>
> So, returning to the specific case, I believe the solutions could be:
>
> 1) SAGA is no longer a third-party module provider, as it no longer
> develops or maintains any plugins;
>
> 2) specific voluntary contributions are found, either short-term or
> long-term
>
> tertium non datur!
>
>
> Regards
>
> s.
>
>
>
>
> Il giorno gio 21 mag 2026 alle ore 13:41 Stefano Campus <skampus at gmail.com>
> ha scritto:
>
>> If I?m not mistaken, over the years, the SAGA maintainers haven?t paid
>> much attention to integration with QGIS; proof of this is that they?ve
>> changed the structure of the modules, renamed them, and so on, without
>> making any announcement or contacting the QGIS maintainers in any way
>>
>> Il giorno gio 21 mag 2026 alle ore 11:53 <
>> qgis-developer-request at lists.osgeo.org> ha scritto:
>>
>>>
>>> *Bas Couwenberg* sebastic at xs4all.nl
>>> <qgis-developer%40lists.osgeo.org?Subject=Re%3A%20%5BQGIS-Developer%5D%20SAGA%20GIS%20plugin%20maintenance&In-Reply-To=%3Ce4d5973f-3ab3-4993-8e73-8e3a8a6ec88f%40xs4all.nl%3E>
>>> *Thu May 21 03:40:36 PDT 2026*
>>>
>>>
>>>    - Previous message (by thread): [QGIS-Developer] SAGA GIS plugin
>>>    maintenance
>>>    <https://lists.osgeo.org/pipermail/qgis-developer/2026-May/068253.html>
>>>    - *Messages sorted by:* [ date ]
>>>    <https://lists.osgeo.org/pipermail/qgis-developer/2026-May/date.html#68254>
>>>     [ thread ]
>>>    <https://lists.osgeo.org/pipermail/qgis-developer/2026-May/thread.html#68254>
>>>     [ subject ]
>>>    <https://lists.osgeo.org/pipermail/qgis-developer/2026-May/subject.html#68254>
>>>     [ author ]
>>>    <https://lists.osgeo.org/pipermail/qgis-developer/2026-May/author.html#68254>
>>>
>>> ------------------------------
>>>
>>> On 5/21/26 11:53 AM, Stefano Campus via QGIS-Developer wrote:
>>> >* Do you think it would be a good idea to propose to the Steering Group that
>>> *>* its maintenance be taken on directly by the QGIS.org Foundation and that a
>>> *>* certain sum (1000?2000 euros?) be set aside in the annual budget for its
>>> *>* maintenance?
>>> *
>>> No, I think it makes more sense for the SAGA developers to commit to maintaining the QGIS plugin which will likely motivate them to stabilize their interface.
>>>
>>> Kind Regards,
>>>
>>> Bas
>>>
>>>
>>> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>


-- 
___________________________
Sebastian "Bas* " Gutwein
*rhymes with Josh

Regenerative Design Group
1 Chevalier Ave
Greenfield, Ma 01301
Web: regenerativedesigngroup.com
(631) 241-1018

*Look close, think big, make change. *
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260722/a125571a/attachment-0001.htm>

From bas at rdgland.com  Wed Jul 22 06:37:13 2026
From: bas at rdgland.com (Sebastian Gutwein)
Date: Wed, 22 Jul 2026 09:37:13 -0400
Subject: [QGIS-Developer] SAGA GIS plugin maintenance
In-Reply-To: <a61d2cdd-8d6f-447f-a858-92c4a6c2f867@gwdg.de>
References: <CAHw6TZe0aFRhiGmtxs6ACG+EHM1TobrnhqvD8=OOo5DhTiyoyw@mail.gmail.com>
 <CAB28AsgnUm444vSZ6-e6y6VmnbkCkx5oBst+ZYGyFvVTZhKtiA@mail.gmail.com>
 <4544a675-453f-428f-8445-40df04b22ed6@gwdg.de>
 <a61d2cdd-8d6f-447f-a858-92c4a6c2f867@gwdg.de>
Message-ID: <CAED_52oh+TZ6f7GZXAwEgYP6CsMPb70XtMLDq48voKFQs4PdaQ@mail.gmail.com>

Hi Rainer,
Thanks for working on this and all of your work on SAGA. I am
considering taking over the plugin because I use and teach with SAGA in
QGIS and it works for me in the current state.
If I wanted to ask questions or get updates on potentially breaking changes
would I do that on the sourceforge forum?
I did try using PySAGA found it to be much slower but I don't think I was
using the pre file conversion the the current plugin uses or I wasn't
batching my calls correctly so I would be interested to find out the best
way to set this up in the future.
the repository is here-
https://github.com/baswein/qgis-processing-saga-nextgen
Thanks again.
-Bas

On Mon, Jun 1, 2026 at 2:24?PM Rainer Hurling via QGIS-Developer <
qgis-developer at lists.osgeo.org> wrote:

> Dear QGIS developers,
> I had promised to get back to you after a meeting with our SAGA
> dev-team. I would like to do so here.
>
> Am 25.05.26 um 18:25 schrieb Rainer Hurling via QGIS-Developer:
> > Dear QGIS devs,
> > I am writing to you on behalf of the small group of SAGA GIS developers.
> > This thread has raised several points and perspectives that are of great
> > interest to us, and we would like to share the SAGA team?s perspective
> > on them.
> >
> > However, before we contribute here, we would like to discuss this at our
> > regular developer meeting next Friday (May 29). We have already added
> > the topic to the agenda :)
> > After that, we will post here in the thread and try to outline our
> options.
> >
> > @Nyall: Could you please make the ?SAGA Processing Nextgen? plugin,
> > which is currently set to ?private?, public again for a while? I?d like
> > to fork it, thanks!
> >
> > Best wishes,
> > Rainer  (FreeBSD ports committer)
>
>
> Since this thread concerns the ?Processing Saga NextGen Provider?
> plugin, it should be noted up front that this is a QGIS plugin developed
> by a QGIS developer. The SAGA team was never involved in its development.
>
> We discussed the following in our SAGA meeting:
>
> - Basically, we (at SAGA) have no interest in maintaining the existing
> plugin, further developing it, or even developing a new, more
> comprehensive SAGA plugin for QGIS.
>
> - If there is interest within the QGIS community in developing a more
> comprehensive plugin for integrating SAGA, we recommend not building on
> the SAGA command-line tool ?saga_cmd? but instead using PySAGA (or the
> C++ API). This would allow the respective functionalities and parameters
> of all non-interactive SAGA tools to be used directly and
> comprehensively. It would also allow in-memory passing of datasets, i.e.
> no temporary files would need to be written.
>
> - Converting all data types on a 1:1 basis is likely to remain a
> challenge. There are data types in SAGA that do not exist in QGIS.
>
> - Overall, we are positive about the integration of SAGA in QGIS, but we
> think such a project needs a sustainable approach. If the QGIS community
> wishes to improve or update the integration of SAGA with QGIS, the SAGA
> team is happy to provide information and advice if requested. We would
> also be happy to establish or point to communication channels so that
> the community can stay informed about new SAGA versions and upcoming
> changes.
>
>
> A personal note on the ?Processing Saga NextGen Provider? plugin: Since
> I am the maintainer (rhurlin at FreeBSD.org) of both the SAGA GIS port [1]
> and the QGIS port [2] for FreeBSD, I decided out of curiosity to copy
> the SAGA NextGen Provider plugin from a QGIS 3 installation to a QGIS 4
> installation and then run the ?scan_qt6_compat? v1.2 plugin by Fran?ois
> Thevand on the SAGA plugin in QGIS 4. This allowed the SAGA plugin to be
> converted to Qt6 and QGIS 4 fully automatically and seemingly without
> errors, and it can now be used in QGIS 4 as usual. Perhaps this is a way
> for the QGIS community to continue working with this plugin for the time
> being?
>
> [1] https://www.freshports.org/math/saga
> [2] https://www.freshports.org/graphics/qgis and
>      https://www.freshports.org/graphics/qgis-ltr
>
> Best regards,
> Rainer
>
>
> > Am 22.05.26 um 01:55 schrieb Nyall Dawson via QGIS-Developer:
> >> On Thu, 21 May 2026 at 19:53, Stefano Campus via QGIS-Developer <qgis-
> >> developer at lists.osgeo.org <mailto:qgis-developer at lists.osgeo.org>>
> wrote:
> >>
> >>  > I?m writing to the dev list because I think this issue is of
> interest.
> >>  >
> >>  > For the past few days, the SAGA Next plugin?which allows you to use
> >> SAGA GIS modules within QGIS Processing?has been unavailable.
> >>
> >> Thanks for kicking off this discussion -- I've been waiting for
> >> someone to raise it ??
> >>
> >> To explain the situation:
> >>
> >> I've been "maintaining" that plugin for years. That's an over-
> >> exaggeration... it hasn't received any love from me beyond reviewing a
> >> pull request once every couple of years. I initially forked it (SAGA
> >> NextGen) from the core SAGA plugin back in 2019 to help solve issues
> >> with SAGA availability of LTR releases and broken stable API. Then in
> >> 2019 https://github.com/qgis/QGIS-Enhancement-Proposals/issues/230
> >> <https://github.com/qgis/QGIS-Enhancement-Proposals/issues/230>
> >> followed, when the built-in SAGA plugin was removed and it went from
> >> being an out-of-the-box, "qgis.org <http://qgis.org> maintained"
> >> plugin to relying on the third party SAGA NextGen "community
> >> maintained" plugin. That's 100% because it was concluded by all the
> >> developers responsible for that code that it wasn't up to the quality
> >> standards of the rest of QGIS.
> >>
> >> It was always a fragile mess of a plugin. Part of that was because of
> >> the difficulties associated with SAGA versioning, part of that was
> >> because it was initially forked from old python code that no-one had
> >> ever modernised. To say it was held together with chewing gum would be
> >> a lie... it was held together with some soggy wet toilet paper at
> >> best! ? This really bugged me. I'd see constant user frustration
> >> because it never worked well, and IMO this user frustration was
> >> harming the reputation of QGIS itself. It didn't help that I'd keep
> >> reading blogs/guides/tutorials where people were recommending using it
> >> for operations where QGIS native tools are SOOOO much better (eg
> >> vector operations like buffering).
> >>
> >> It was never my desire to become the maintainer of the plugin and put
> >> in the work required to bring it up to the quality standard I hold to,
> >> rather, I offered it on an initially voluntary basis to fix immediate
> >> issues I saw users were experiencing and with the hope that making it
> >> a third party plugin would help grow a healthy community that would
> >> take it over.
> >>
> >> That never happened... Instead it was just another burden that I
> >> carried for everyone, with the associated lack of thanks and lack of
> >> any recognition beyond angry emails when it didn't work. ?. Ah well,
> >> that's just life as a QGIS developer, we all deal with that, and I'm
> >> thick- skinned enough to handle it!
> >>
> >> At least, I thought so. Then the AI apocalypse hit in 2026.
> >>
> >> As a response to my frustration with the lack of support the user
> >> community is giving to open-source developers during this INCREDIBLY
> >> challenging time, I decided to close off a bunch of my public
> >> repositories. Because, hey, I don't want to directly train the
> >> technologies that will likely destroy the whole economics behind open-
> >> source software development. So I closed off repositories for things
> >> I'd voluntarily made public, including dropping any QGIS plugin that I
> >> wasn't directly using myself anymore, and that wasn't funded or in use
> >> by my customers (or where a better native tool now exists). And that
> >> included the SAGA NextGen plugin. I have no use for it, and none of my
> >> customers use it, and it's a PITA to "maintain".
> >>
> >> I knew that by doing so I'd be stirring up trouble, and honestly, that
> >> was partly my intention! I wanted to force a discussion about this,
> >> and raise widespread attention to the issues that would otherwise go
> >> unnoticed. It's the SAGA plugin today, but tomorrow it could easily be
> >> QGIS itself, or GDAL, or PostGIS, or PDAL, or ... ?
> >>
> >> My personal preference would be that we continue to port useful tools
> >> from SAGA to native QGIS versions of these tools. I've done this in
> >> the past (see https://github.com/qgis/QGIS/pull/53794 <https://
> >> github.com/ qgis/QGIS/pull/53794>, https://github.com/qgis/QGIS/
> >> pull/61722 <https:// github.com/qgis/QGIS/pull/61722>) for tools that
> >> I need myself, or that my customers rely on, and the QGIS native tools
> >> are so much better (***FOR QGIS USERS***) then calling out to the SAGA
> >> versions. They have full format support for all the data sources QGIS
> >> supports, they work with massive rasters without memory issues, and
> >> they are much faster as they don't require data conversion to
> >> intermediate formats. And on top of that, they "just work" everywhere
> >> QGIS works -- there's no fussing around with SAGA version
> >> compatibility, and no security risks with python code shelling out to
> >> run random batch files.
> >>
> >> (Please understand that I'm not insulting the SAGA developers or their
> >> versions of these tools here... in my experience the SAGA developer's
> >> logic is great, the code is well written and the algorithms themselves
> >> are well designed. It's a testament to the SAGA developers how easy it
> >> is to port the tools to QGIS, they are very readable and well
> >> documented. My point is that we offer a better experience to **QGIS**
> >> users by porting the tools to native equivalents using QGIS API
> >> directly).
> >>
> >> If anyone has particular SAGA tools they rely on for their work, then
> >> please reach out and I'll let you know how much it would cost to
> >> sponsor a port of that tool.
> >>
> >> Finally, please note that I didn't delete the plugin repository, I
> >> just made it private instead of public. I'm happy to temporarily make
> >> it public again if someone wants to fork it, but after they do that
> >> I'll then permanently erase my repo. If someone wants to do this then
> >> let me know and I'll re-open temporarily.
> >>
> >> Nyall
> >>
> >>
> >>  >
> >>  > According to reports in the QGIS community?s Telegram group,
> >> maintaining this plugin is becoming increasingly difficult due to
> >> developments in the SAGA project, which can cause the plugin to stop
> >> working.
> >>  >
> >>  > I recall that until a couple of years ago, SAGA was, like GRASS, a
> >> resource installed directly within QGIS, but then, precisely because
> >> of the difficulty in keeping up with SAGA?s developments, it was
> >> decided to treat SAGA as a third-party resource accessible via plugins.
> >>  >
> >>  > I believe it is right that this important resource should not be
> >> maintained on a voluntary basis by a single developer/user, but that
> >> it should be taken on by the community.
> >>  >
> >>  > Do you think it would be a good idea to propose to the Steering
> >> Group that its maintenance be taken on directly by the QGIS.org
> >> Foundation and that a certain sum (1000?2000 euros?) be set aside in
> >> the annual budget for its maintenance?
> >>  >
> >>  > Thank you
> >>  >
> >>  > stefano campus
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>


-- 
___________________________
Sebastian "Bas* " Gutwein
*rhymes with Josh

Regenerative Design Group
1 Chevalier Ave
Greenfield, Ma 01301
Web: regenerativedesigngroup.com
(631) 241-1018

*Look close, think big, make change. *
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260722/bf85a773/attachment-0001.htm>

From nyall.dawson at gmail.com  Sun Jul 26 17:07:02 2026
From: nyall.dawson at gmail.com (Nyall Dawson)
Date: Mon, 27 Jul 2026 10:07:02 +1000
Subject: [QGIS-Developer] QEP: Removal of deprecated Processing GUI API
In-Reply-To: <CAB28Asj7B23UOhKfw1hPK734rBRBOGBFw_kkjzvd+9mmQF=_1w@mail.gmail.com>
References: <CAB28Asj7B23UOhKfw1hPK734rBRBOGBFw_kkjzvd+9mmQF=_1w@mail.gmail.com>
Message-ID: <CAB28Asim__He33tvshiuXdXE7rvx5vtAODFzuPzW0n+JP0ADvg@mail.gmail.com>

On Tue, 14 Jul 2026 at 10:44, Nyall Dawson <nyall.dawson at gmail.com> wrote:
>
> Hi lists,
>
> Following up the recent formalisation of a process for removal of deprecated API mid-release cycle (see https://github.com/qgis/QGIS-Enhancement-Proposals/pull/384), I've just submitted a proposal to remove the deprecated Python Processing "WidgetWrapper" API.
>
> As per clause 1.4.4 of the Stable API policy, this API should be removed on the grounds that maintaining backward compatibility both introduces an insurmountable maintenance burden and fundamentally blocks critical bug fixes (condition 1.4.4.1).
>
> This pure Python API is an ongoing source of unsolvable issues in the Processing framework, such as https://github.com/qgis/QGIS/issues/66282. It relies on a fragile memory management model, where the lifetime of objects created in C++ vs Python results in unpredictable object deletion or memory leakage. Over time the conclusion from QGIS developers familiar with this code is that this approach just cannot be fixed, and we need to move solely to the approach used elsewhere in QGIS, where Python is used solely to subclass C++ base classes, with all memory management living at the C++ level (either through direct C++ memory management or via C++ Qt parent/child associations).
>
> In addition, the old API predated major overhauls of Processing GUI components such as the model designer, and the assumptions used in that API no longer apply (such as existence of Python dialog classes). Working around these old assumptions is a considerable drain on QGIS developers, and is blocking further desirable revamps and modernisation of the QGIS model designer interface.
>
> This API has been marked as deprecated since QGIS 3.4, with developer-facing warnings being shown for over 7 years.
>
> See https://github.com/qgis/QGIS-Enhancement-Proposals/pull/386 for the proposed changes and a detailed write up on the plan for removal.
>
> Please give all feedback on this proposed change as comments on the PR itself (not direct email replies) to keep the discussion centralized.

This has now passed the two week discussion period and has moved to
the voting stage.

Kind regards,
Nyall

From paolo.tormene at globalquakemodel.org  Mon Jul 27 00:36:54 2026
From: paolo.tormene at globalquakemodel.org (Paolo Tormene)
Date: Mon, 27 Jul 2026 09:36:54 +0200
Subject: [QGIS-Developer] Plugin approval
Message-ID: <CADQ4pmB9WKqZbZpa=UECwFCb9fK=M7KscUuvyMcdLy-LZg6RBA@mail.gmail.com>

Dear QGIS developers,
on July 16th I uploaded a new version of the "OpenQuake Integrated Risk
Modelling Toolkit" plugin (version 3.26.0 experimental). It passed the
security scan, but I see it has not been approved yet. Could you check
about it, please?
Thank you in advance,
Paolo Tormene

-- 
PAOLO TORMENE | Senior Software Developer | Profile Page
<https://www.globalquakemodel.org/gem-team/paolo-tormene> | +39 0382 5169865
GLOBAL EARTHQUAKE MODEL | working together to assess risk
GEM - globalquakemodel.org <http://www.globalquakemodel.org/> | F - GEMwrld
<http://www.facebook.com/GEMwrld> | L - gem-foundation
<https://it.linkedin.com/company/gem-foundation> | Insta -
globalearthquakemodel <https://www.instagram.com/globalearthquakemodel>
----
[image: gem_email_signature]FOR A WORLD THAT IS RESILIENT TO EARTHQUAKES
AND OTHER NATURAL HAZARDS
[image: adduser_emailsignature]Follow GEM on LinkedIn
<https://it.linkedin.com/company/gem-foundation> to help us expand global
access to trusted seismic risk tools and data.
[image: GEM Conference 2026]
<https://www.globalquakemodel.org/gemevents/gem2026-conference-from-faults-to-future-scenarios>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260727/b634bbf2/attachment.htm>

From g.montini at appenninosettentrionale.it  Mon Jul 27 06:04:11 2026
From: g.montini at appenninosettentrionale.it (Giovanni Montini)
Date: Mon, 27 Jul 2026 13:04:11 +0000
Subject: [QGIS-Developer] Plugin approval status: InSAR Suite v3.3.1
Message-ID: <DU2PR01MB800721BC27AF9BCC2280573D81CC2@DU2PR01MB8007.eurprd01.prod.exchangelabs.com>

Hello,

I uploaded two new versions of my plugin "InSAR Suite" on Monday
20/07/2026: version 3.2.3 (for QGIS 3) and version 3.3.1
(for QGIS 4). Version 3.2.3 was approved on Wednesday, but version
3.3.1 is still pending approval as of today (over a week later).

Could someone please check on the status of this submission?

Thank you,
Giovanni Montini



Geol. Giovanni Montini
Area pianificazione assetto idrogeologico e frane
Autorit? di bacino distrettuale dell'Appennino settentrionale
Sede di Firenze
tel. 055.26743226

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260727/b196dd09/attachment-0001.htm>

From barbot.yvann at gmail.com  Tue Jul 28 05:18:47 2026
From: barbot.yvann at gmail.com (Yvann Barbot)
Date: Tue, 28 Jul 2026 14:18:47 +0200
Subject: [QGIS-Developer] Trusted status request for the TerraLab plugins
 (yvannbarbot)
Message-ID: <CAF=gfOWwugfGMG2uzabQTdfFTfWqfanEHKuT1ej8TfNU1jZu-g@mail.gmail.com>

Hi all,

I am Yvann, co-author with Lilien of AI Segmentation and AI Edit, two QGIS
plugins published under TerraLab. We were in Brest in March for the
"Rencontres des utilisateurs francophones de QGIS".

I would like to ask for trusted status (plugins.can_approve) on the account
yvannbarbot.

We ship small fixes often, and a lot of people now rely on these plugins for
daily work. AI Segmentation 2.2.1 is waiting for approval, so our users stay
on the older build. Every version we have uploaded passed the security scan
with no findings.

Both plugins are GPL, and the segmentation runs locally on the user's own
machine. Giving that away is the part we are happiest about.

If you need more hands on plugin review, mine are free. And if there is a
checklist before trusted status, tell me and we will follow it.

Thanks for everything you put into the repository.

Yvann Barbot
TerraLab, Paris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260728/6f0167ce/attachment.htm>

From mlechner at bfs.de  Wed Jul 29 05:24:24 2026
From: mlechner at bfs.de (Marco Lechner)
Date: Wed, 29 Jul 2026 12:24:24 +0000
Subject: [QGIS-Developer] Problems uploading a new Plugin version due to
 homepage supposedly not being reachable
Message-ID: <4e0d7e094b464ae1be7e32aebaf896fb@bfs.de>

Hi,

I try to upload a new Version of my plugin, but the Check fails with
?There were errors reading plugin package (please check also your plugin's metadata).
Please provide valid URL link for the following key(s) in the metadata source: homepage. The website(s) cannot be reached within 10 seconds.?

In metadata.txt homepage is set to homepage=https://www.bfs.de that should be reachable without problems. Any ideas how to fix it? Do I have to change anything mor in my metadata.txt or is this a bug in the plugin-Infrastructure?

Regards
Marco

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260729/dc40084e/attachment.htm>

From lova at kartoza.com  Thu Jul 30 00:52:38 2026
From: lova at kartoza.com (Lova Andriarimalala)
Date: Thu, 30 Jul 2026 10:52:38 +0300
Subject: [QGIS-Developer] Problems uploading a new Plugin version due to
 homepage supposedly not being reachable
In-Reply-To: <4e0d7e094b464ae1be7e32aebaf896fb@bfs.de>
References: <4e0d7e094b464ae1be7e32aebaf896fb@bfs.de>
Message-ID: <CAMLC-sDrq2__5yyjSPRUaGnkCQZR9FSfJpFx+-gVjM-6xWT2kw@mail.gmail.com>

Hi Marco,

Thanks for raising this. It's a temporary issue because the timeout is
likely too short for the plugin infrastructure to check the homepage. I
suggest trying again a few times or opening an issue at
https://github.com/qgis/QGIS-Plugins-Website if it persists. I would be
happy to check this specific case.

Best regards,

Lova Andriarimalala


*QGIS Full Stack Developer   *
*T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W* :
kartoza.com



*This email and any attachments are confidential and intended solely for
the use of the individual or entity to whom they are addressed. If you *
*have received this email in error, please notify the sender immediately
and delete it from your system. Unauthorised use, disclosure, or copying*
*of the contents is prohibited.*


On Wed, 29 Jul 2026 at 15:32, Marco Lechner via QGIS-Developer <
qgis-developer at lists.osgeo.org> wrote:

> Hi,
>
>
>
> I try to upload a new Version of my plugin, but the Check fails with
>
> ?There were errors reading plugin package (please check also your plugin's
> metadata).
> Please provide valid URL link for the following key(s) in the metadata
> source: * homepage*. The website(s) cannot be reached within 10 seconds.?
>
>
>
> In metadata.txt homepage is set to homepage=https://www.bfs.de that
> should be reachable without problems. Any ideas how to fix it? Do I have to
> change anything mor in my metadata.txt or is this a bug in the
> plugin-Infrastructure?
>
>
>
> Regards
>
> Marco
>
>
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260730/d6f0e954/attachment.htm>

From mlechner at bfs.de  Thu Jul 30 02:54:19 2026
From: mlechner at bfs.de (Marco Lechner)
Date: Thu, 30 Jul 2026 09:54:19 +0000
Subject: [QGIS-Developer] Problems uploading a new Plugin version due to
 homepage supposedly not being reachable
In-Reply-To: <CAMLC-sDrq2__5yyjSPRUaGnkCQZR9FSfJpFx+-gVjM-6xWT2kw@mail.gmail.com>
References: <4e0d7e094b464ae1be7e32aebaf896fb@bfs.de>
 <CAMLC-sDrq2__5yyjSPRUaGnkCQZR9FSfJpFx+-gVjM-6xWT2kw@mail.gmail.com>
Message-ID: <b95e32f7b127464e908fac7bf6a3860a@bfs.de>

Done. See https://github.com/qgis/QGIS-Plugins-Website/issues/406
I would be happy to support fixing this issue with tests, information, ?

Regards
Marco

Von: Lova Andriarimalala <lova at kartoza.com>
Gesendet: Donnerstag, 30. Juli 2026 09:53
An: Marco Lechner <mlechner at bfs.de>
Cc: qgis-developer at lists.osgeo.org
Betreff: Re: [QGIS-Developer] Problems uploading a new Plugin version due to homepage supposedly not being reachable

Hi Marco,

Thanks for raising this. It's a temporary issue because the timeout is likely too short for the plugin infrastructure to check the homepage. I suggest trying again a few times or opening an issue at https://github.com/qgis/QGIS-Plugins-Website if it persists. I would be happy to check this specific case.

Best regards,

Lova Andriarimalala
QGIS Full Stack Developer
T : +27(0) 87 809 2702          E : lova at kartoza.com<mailto:lova at kartoza.com>          W : kartoza.com<http://kartoza.com>

[https://erp.kartoza.com/files/KartozaEmailSignatureTest.gif]

This email and any attachments are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you
have received this email in error, please notify the sender immediately and delete it from your system. Unauthorised use, disclosure, or copying
of the contents is prohibited.


On Wed, 29 Jul 2026 at 15:32, Marco Lechner via QGIS-Developer <qgis-developer at lists.osgeo.org<mailto:qgis-developer at lists.osgeo.org>> wrote:
Hi,

I try to upload a new Version of my plugin, but the Check fails with
?There were errors reading plugin package (please check also your plugin's metadata).
Please provide valid URL link for the following key(s) in the metadata source: homepage. The website(s) cannot be reached within 10 seconds.?

In metadata.txt homepage is set to homepage=https://www.bfs.de that should be reachable without problems. Any ideas how to fix it? Do I have to change anything mor in my metadata.txt or is this a bug in the plugin-Infrastructure?

Regards
Marco

_______________________________________________
QGIS-Developer mailing list
QGIS-Developer at lists.osgeo.org<mailto:QGIS-Developer at lists.osgeo.org>
List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260730/cf7105ef/attachment-0001.htm>

From gdt at lexort.com  Thu Jul 30 03:26:11 2026
From: gdt at lexort.com (Greg Troxel)
Date: Thu, 30 Jul 2026 06:26:11 -0400
Subject: [QGIS-Developer] Problems uploading a new Plugin version due to
 homepage supposedly not being reachable
In-Reply-To: <CAMLC-sDrq2__5yyjSPRUaGnkCQZR9FSfJpFx+-gVjM-6xWT2kw@mail.gmail.com>
 (Lova Andriarimalala via's message of "Thu, 30 Jul 2026 10:52:38
 +0300")
References: <4e0d7e094b464ae1be7e32aebaf896fb@bfs.de>
 <CAMLC-sDrq2__5yyjSPRUaGnkCQZR9FSfJpFx+-gVjM-6xWT2kw@mail.gmail.com>
Message-ID: <rmiy0esojss.fsf@s1.lexort.com>

Lova Andriarimalala via QGIS-Developer <qgis-developer at lists.osgeo.org>
writes:

> Thanks for raising this. It's a temporary issue because the timeout is
> likely too short for the plugin infrastructure to check the homepage. I
> suggest trying again a few times or opening an issue at
> https://github.com/qgis/QGIS-Plugins-Website if it persists. I would be
> happy to check this specific case.

For what it's worth, I tried to open the homepage URL in a browser, got
a failure, tried with some command line tool (forget), got a failure,
and then a minute or so later the URL worked in the browser.

From lova at kartoza.com  Thu Jul 30 03:36:38 2026
From: lova at kartoza.com (Lova Andriarimalala)
Date: Thu, 30 Jul 2026 13:36:38 +0300
Subject: [QGIS-Developer] Problems uploading a new Plugin version due to
 homepage supposedly not being reachable
In-Reply-To: <rmiy0esojss.fsf@s1.lexort.com>
References: <4e0d7e094b464ae1be7e32aebaf896fb@bfs.de>
 <CAMLC-sDrq2__5yyjSPRUaGnkCQZR9FSfJpFx+-gVjM-6xWT2kw@mail.gmail.com>
 <rmiy0esojss.fsf@s1.lexort.com>
Message-ID: <CAMLC-sCr2UY0fWws2PHuVv6O4uE6e8s6p5K6EVHbVkAo-j6gYQ@mail.gmail.com>

>
> For what it's worth, I tried to open the homepage URL in a browser, got
> a failure, tried with some command line tool (forget), got a failure,
> and then a minute or so later the URL worked in the browser.


Thank you for testing Greg. I am checking it now and it seems to be working
as well (with a redirection to https://www.bfs.de/DE/home/home_node.html).
So the issue is probably from the homepage side.

Best regards,

Lova Andriarimalala


*QGIS Full Stack Developer   *
*T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W* :
kartoza.com



*This email and any attachments are confidential and intended solely for
the use of the individual or entity to whom they are addressed. If you *
*have received this email in error, please notify the sender immediately
and delete it from your system. Unauthorised use, disclosure, or copying*
*of the contents is prohibited.*


On Thu, 30 Jul 2026 at 13:26, Greg Troxel via QGIS-Developer <
qgis-developer at lists.osgeo.org> wrote:

> Lova Andriarimalala via QGIS-Developer <qgis-developer at lists.osgeo.org>
> writes:
>
> > Thanks for raising this. It's a temporary issue because the timeout is
> > likely too short for the plugin infrastructure to check the homepage. I
> > suggest trying again a few times or opening an issue at
> > https://github.com/qgis/QGIS-Plugins-Website if it persists. I would be
> > happy to check this specific case.
>
> For what it's worth, I tried to open the homepage URL in a browser, got
> a failure, tried with some command line tool (forget), got a failure,
> and then a minute or so later the URL worked in the browser.
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260730/ac411475/attachment.htm>

From r.nijssen at terglobo.nl  Tue Jul 14 21:33:10 2026
From: r.nijssen at terglobo.nl (Raymond Nijssen)
Date: Wed, 15 Jul 2026 04:33:10 -0000
Subject: [QGIS-Developer] Dialog borders hardly visible on Ubuntu 26.04
Message-ID: <2b3599d2-0c1f-4a6d-aef8-bf0ac4ede340@terglobo.nl>

Not sure when this started exactly, but my QGIS interface is harder and 
harder to read when dialogs are displayed on top of the main window and 
on top of each other. The dialog borders are hardly visible, making it 
hard to know which widget belongs to which panel.

Could be related to QGIS4+Qt6, Wayland, my update to Ubuntu 26.04 or 
anything else. I attach a screenshot showing 2 dialogs on top of each 
other. And my file browser window which I think has the border the way 
it should be.

Are the QGIS dialog settings wrong? Should I file a bug for this?

Kind regards,
Raymond
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot From 2026-07-15 06-06-44.png
Type: image/png
Size: 145355 bytes
Desc: not available
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260715/096295de/attachment-0001.png>