Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

python-packages: bleach 1.4.3 -> 1.5 #21450

Closed
wants to merge 1 commit into from
Closed

python-packages: bleach 1.4.3 -> 1.5 #21450

wants to merge 1 commit into from

Conversation

spacekitteh
Copy link
Contributor

Motivation for this change
Things done
  • Tested using sandboxing
    (nix.useSandbox on NixOS,
    or option build-use-sandbox in nix.conf
    on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • Linux
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@mention-bot
Copy link

@spacekitteh, thanks for your PR! By analyzing the history of the files in this pull request, we identified @FRidh to be a potential reviewer.

@FRidh FRidh self-assigned this Dec 28, 2016
FRidh
FRidh reviewed Dec 28, 2016
View reviewed changes
pkgs/top-level/python-packages.nix
};

buildInputs = with self; [ nose ];
propagatedBuildInputs = with self; [ six html5lib ];
propagatedBuildInputs = with self; [ six html5lib_0_9999999 pytestrunner pytest_303];
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does bleach absolutely need that version of html5lib? And that specific version of pytest? And are pytest and pytestrunner runtime dependencies (that is, install_requires)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes

FRidh
FRidh requested changes Dec 28, 2016
View reviewed changes
Copy link
Member

@FRidh FRidh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Python devs often pin dependency versions in setup.py or worse requirements.txt which we then need to unpin. I guess that's what's going on here.

@spacekitteh
Copy link
Contributor Author

Yep to everything you said

@FRidh FRidh closed this in 2f977b4 Dec 29, 2016
@rycee
Copy link
Member

rycee commented Dec 29, 2016

This needs to be backported into stable.

@rycee rycee added the 9.needs: port to stable A PR needs a backport to the stable release. label Dec 29, 2016
@FRidh
Copy link
Member

FRidh commented Dec 29, 2016

Because we broke bleach with the html5lib bump?

@rycee
Copy link
Member

rycee commented Dec 29, 2016

Yeah, for example matrix synapse.

@FRidh
Copy link
Member

FRidh commented Dec 29, 2016

Sigh, why did I merge that bump in the first place; its causing nothing but trouble. I'll see if we can somehow revert to an older version of html5lib that doesn't have the CVE.

@FRidh
Copy link
Member

FRidh commented Dec 29, 2016

Unfortunately that is not possible because the CVE was in the second latest beta of html5lib.

FRidh added a commit that referenced this pull request Dec 29, 2016
@FRidh
pythonPackages.bleach: 1.4.3 -> 1.5.0, closes #21450
5b550e3 
Unfortunately bleach depends on an older version of html5lib and cannot
use the latest version because the sanitizer module has been moved out.
mozilla/bleach#217

This item is cherry-picked to unbreak bleach and thus matrix-synapse on stable.

(cherry picked from commit 2f977b4)
@FRidh
Copy link
Member

FRidh commented Dec 29, 2016

And it's in stable.

@rycee
Copy link
Member

rycee commented Dec 29, 2016

Thanks! Yeah, the html5lib seems a bit crazy with these versions.

@spacekitteh spacekitteh deleted the patch-22 branch December 30, 2016 05:54
@spacekitteh
Copy link
Contributor Author

html5lib-python 1.0 is blocked on this, for the record: html5lib/html5lib-python#307 (comment)

@FRidh FRidh mentioned this pull request Dec 31, 2016
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FRidh FRidh FRidh requested changes

Assignees

@FRidh FRidh

Labels
6.topic: python 8.has: package (update) 9.needs: port to stable A PR needs a backport to the stable release.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@spacekitteh @mention-bot @rycee @FRidh