NixOS · Mar 28, 2021 · Mar 28, 2021 · Apr 1, 2021 · Apr 1, 2021 · Apr 1, 2021
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
@@ -10,7 +10,7 @@ let
   mkListen = kind: addr: let
     al_v4 = builtins.match "([0-9.]\+):([0-9]\+)" addr;
     al_v6 = builtins.match "\\[(.\+)]:([0-9]\+)" addr;
-    al_portOnly = builtins.match "()([0-9]\+)" addr;
+    al_portOnly = builtins.match "([0-9]\+)" addr;
     al = findFirst (a: a != null)
       (throw "services.kresd.*: incorrect address specification '${addr}'")
       [ al_v4 al_v6 al_portOnly ];

diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -29,11 +29,13 @@ let unwrapped = stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
-  buildInputs = [
+  buildInputs = let
+    python-with-dbus = python.withPackages (pp: with pp; [ dbus-python ]);
+  in [
     aspell startupnotification
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
     libxml2 nss nspr
-    libXScrnSaver ncurses python
+    libXScrnSaver ncurses python-with-dbus
     avahi dbus dbus-glib intltool libidn
     libICE libXext libSM cyrus_sasl
   ]
@@ -72,6 +74,15 @@ let unwrapped = stdenv.mkDerivation rec {
       --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
   '';
 
+  doInstallCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  # In particular, this detects missing python imports in some of the tools.
+  postInstallCheck = ''
+    for f in "''${!outputBin}"/bin/{purple-remote,pidgin}; do
+      echo "Testing: $f --help"
+      "$f" --help
+    done
+  '';
+
   meta = with stdenv.lib; {
     description = "Multi-protocol instant messaging client";
     homepage = "http://pidgin.im";

diff --git a/pkgs/development/python-modules/Pygments/default.nix b/pkgs/development/python-modules/Pygments/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , docutils
 }:
 
@@ -13,6 +14,15 @@ buildPythonPackage rec {
     sha256 = "647344a061c249a3b74e230c739f434d7ea4d8b1d5f3721bc0f3558049b38f44";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-27291.patch";
+      url = "https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14.patch";
+      sha256 = "0ap7jgkmvkkzijabsgnfrwl376cjsxa4jmzvqysrkwpjq3q4rxpa";
+      excludes = ["CHANGES"];
+    })
+  ];
+
   propagatedBuildInputs = [ docutils ];
 
   # Circular dependency with sphinx

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1zidx62sxh2r4fmjfjzd4f6i4yxgzkpd20nafbyr0i0wnw9da3fd";
+    sha256 = "1rhkv75qr4ij3653l97sy752gyp6f20sxfpiqp1vp08fpy47q8qn";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs

diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
@@ -7,11 +7,11 @@ let inherit (stdenv.lib) optional optionals; in
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "2.9.8";
+  version = "2.9.9";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "d07b4441b853ef9230be3620f9805e5116f3b9fc7557f710db03cc0791e9cd6b";
+    sha256 = "9e20697629dadf6fac596f0baa7d6d13d5acaa901a38d5a1ef571e4cb444158d";
   };
 
   outputs = [ "bin" "out" "dev" ];