Merge pull request #118312 from NixOS/staging-next

Staging next

pkgs/development/python-modules/Pygments/2_5.nix

@@ -3,6 +3,7 @@
 , fetchPypi
 , fetchpatch
 , docutils
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -25,8 +26,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ docutils ];
 
-  # Circular dependency with sphinx
-  doCheck = false;
+  checkInputs = [ pytestCheckHook ];
 
   meta = {
     homepage = "https://pygments.org/";

pkgs/development/python-modules/Pygments/default.nix

@@ -2,6 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , docutils
+, pytestCheckHook
+, doCheck ? true
 }:
 
 buildPythonPackage rec {
@@ -15,8 +17,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ docutils ];
 
-  # Circular dependency with sphinx
-  doCheck = false;
+  inherit doCheck;
+  checkInputs = [ pytestCheckHook ];
 
   meta = {
     homepage = "https://pygments.org/";

pkgs/development/python-modules/bootstrapped-pip/2.nix

@@ -0,0 +1,67 @@
+{ lib, stdenv, python, fetchPypi, makeWrapper, unzip, makeSetupHook
+, pipInstallHook
+, setuptoolsBuildHook
+, wheel, pip, setuptools
+, isPy27
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pip";
+  inherit (pip) version;
+  name = "${python.libPrefix}-bootstrapped-${pname}-${version}";
+
+  srcs = [ wheel.src pip.src setuptools.src ];
+  sourceRoot = ".";
+
+  dontUseSetuptoolsBuild = true;
+  dontUsePipInstall = true;
+
+  # Should be propagatedNativeBuildInputs
+  propagatedBuildInputs = [
+    # Override to remove dependencies to prevent infinite recursion.
+    (pipInstallHook.override{pip=null;})
+    (setuptoolsBuildHook.override{setuptools=null; wheel=null;})
+  ];
+
+  postPatch = ''
+    mkdir -p $out/bin
+  '';
+
+  nativeBuildInputs = [ makeWrapper unzip ];
+  buildInputs = [ python ];
+
+  buildPhase = ":";
+
+  installPhase = lib.strings.optionalString (!stdenv.hostPlatform.isWindows) ''
+    export SETUPTOOLS_INSTALL_WINDOWS_SPECIFIC_FILES=0
+  '' + ''
+    # Give folders a known name
+    mv pip* pip
+    mv setuptools* setuptools
+    mv wheel* wheel
+    # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
+    # $out is where we are installing to and takes precedence
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel:$PYTHONPATH"
+
+    echo "Building setuptools wheel..."
+    pushd setuptools
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
+    popd
+
+    echo "Building wheel wheel..."
+    pushd wheel
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
+    popd
+
+    echo "Building pip wheel..."
+    pushd pip
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
+    popd
+  '';
+
+  meta = {
+    description = "Version of pip used for bootstrapping";
+    license = lib.unique (pip.meta.license ++ setuptools.meta.license ++ wheel.meta.license);
+    homepage = pip.meta.homepage;
+  };
+}

pkgs/development/python-modules/bootstrapped-pip/default.nix

@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
 
     echo "Building setuptools wheel..."
     pushd setuptools
+    rm pyproject.toml
     ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
     popd
 

pkgs/development/python-modules/cryptography/default.nix

@@ -22,18 +22,18 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "3.4.6"; # Also update the hash in vectors.nix
+  version = "3.4.7"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11wgsihfq72fav67c3igi0xbhbd6c5dj869byd1jkq0fbcz24cid";
+    sha256 = "04x7bhjkglxpllad10821vxddlmxdkd3gjvp35iljmnj2s0xw41x";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    sha256 = "1i0sd2y4a5g1yqwcpw2ycp6p4p8sk5v7clblq756i5864j52v6w1";
+    sha256 = "1wisxmq26b8ml144m2458sgcbk8jpv419j01qmffsrfy50x9i1yw";
   };
 
   cargoRoot = "src/rust";

pkgs/development/python-modules/cryptography/vectors.nix

@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1a1d5ix5b3ajhrqaf8rm6qmd6gkaidij0jgd1vrb8q1xn1gqmy75";
+    sha256 = "1hh4j88ywil3jf62ppj1blygmdirbqz86pynd9lqfijiaym3mb57";
   };
 
   # No tests included

pkgs/development/python-modules/django/2.nix

@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.18";
+  version = "2.2.19";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1d0b91343i9n0qz8xia1fbm4s3q8wi98nyc9a3acncm0w3sr9jf9";
+    sha256 = "0hysjf8bz4g8xrn2cdx6pmawimpyr6ag2fg3jxsnc1byr3g3bhih";
   };
 
   patches = lib.optional withGdal

pkgs/development/python-modules/lxml/default.nix

@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1zidx62sxh2r4fmjfjzd4f6i4yxgzkpd20nafbyr0i0wnw9da3fd";
+    sha256 = "1rhkv75qr4ij3653l97sy752gyp6f20sxfpiqp1vp08fpy47q8qn";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs

pkgs/development/python-modules/packaging/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "packaging";
-  version = "20.8";
+  version = "20.9";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-eFmBhacAikcNZFJqgFnemqpEkjjygPyetrE7psQQkJM=";
+    sha256 = "sha256-WzJ6wTINyGPcpy9FFOzAhvMRhnRLhKIwN0zB/Xdv6uU=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pillow/6.nix

@@ -25,5 +25,23 @@ import ./generic.nix (rec {
     '';
     license = "http://www.pythonware.com/products/pil/license.htm";
     maintainers = with maintainers; [ goibhniu prikhi SuperSandro2000 ];
+    knownVulnerabilities = [
+      "CVE-2020-10177"
+      "CVE-2020-10378"
+      "CVE-2020-10379"
+      "CVE-2020-10994"
+      "CVE-2020-11538"
+      "CVE-2020-35653"
+      "CVE-2020-35654"
+      "CVE-2020-35655"
+      "CVE-2021-25289"
+      "CVE-2021-25290"
+      "CVE-2021-25291"
+      "CVE-2021-25292"
+      "CVE-2021-25293"
+      "CVE-2021-27921"
+      "CVE-2021-27922"
+      "CVE-2021-27923"
+    ];
   };
 } // args )

pkgs/development/python-modules/pillow/default.nix

@@ -5,13 +5,13 @@
 
 import ./generic.nix (rec {
   pname = "Pillow";
-  version = "8.1.1";
+  version = "8.1.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "086g7nhv52wclrwnzbzs2x3nvyzs2hfq1bvgivsrp5f7r7wiiz7n";
+    sha256 = "0i7w0fi24za3naz3k3qav6lrhf034nzdy6m9025djlj80476cz5h";
   };
 
   meta = with lib; {

pkgs/development/python-modules/pip/20.nix

@@ -0,0 +1,44 @@
+{ lib
+, python
+, buildPythonPackage
+, bootstrapped-pip
+, fetchFromGitHub
+, mock
+, scripttest
+, virtualenv
+, pretend
+, pytest
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "pip";
+  version = "20.3.4";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = pname;
+    rev = version;
+    sha256 = "0hkhs9yc1cjdj1gn9wkycd3sy65c05q8k8rhqgsm5jbpksfssiwn";
+    name = "${pname}-${version}-source";
+  };
+
+  nativeBuildInputs = [ bootstrapped-pip ];
+
+  # pip detects that we already have bootstrapped_pip "installed", so we need
+  # to force it a little.
+  pipInstallFlags = [ "--ignore-installed" ];
+
+  checkInputs = [ mock scripttest virtualenv pretend pytest ];
+  # Pip wants pytest, but tests are not distributed
+  doCheck = false;
+
+  meta = {
+    description = "The PyPA recommended tool for installing Python packages";
+    license = with lib.licenses; [ mit ];
+    homepage = "https://pip.pypa.io/";
+    priority = 10;
+  };
+}

pkgs/development/python-modules/pip/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pip";
-  version = "20.3.4";
+  version = "21.0.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = version;
-    sha256 = "0hkhs9yc1cjdj1gn9wkycd3sy65c05q8k8rhqgsm5jbpksfssiwn";
+    sha256 = "sha256-Yt5xqdo735f5sQKP8GnKM201SoIi7ZP9l2gw+feUVW0=";
     name = "${pname}-${version}-source";
   };
 

pkgs/development/python-modules/setuptools-rust/default.nix

@@ -2,7 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchPypi
-, isPy27
+, pythonOlder
 , semantic-version
 , setuptools
 , setuptools-scm
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "0.11.6";
-  disabled = isPy27;
+  version = "0.12.1";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a5b5954909cbc5d66b914ee6763f81fa2610916041c7266105a469f504a7c4ca";
+    sha256 = "647009e924f0ae439c7f3e0141a184a69ad247ecb9044c511dabde232d3d570e";
   };
 
   nativeBuildInputs = [ setuptools-scm ];

pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix

@@ -17,5 +17,9 @@ callPackage ../../../tools/rust/maturin/pyo3-test/generic.nix {
     rust.rustc
   ]);
 
-  sourceRoot = "source/examples/word-count";
+  preConfigure = ''
+    # sourceRoot puts Cargo.lock in the wrong place due to the
+    # example setup.
+    cd examples/word-count
+  '';
 }

pkgs/development/python-modules/setuptools/default.nix

@@ -1,4 +1,5 @@
 { stdenv
+, fetchurl
 , buildPythonPackage
 , fetchFromGitHub
 , python
@@ -13,7 +14,12 @@
 
 let
   pname = "setuptools";
-  version = "50.3.1";
+  version = "54.2.0";
+
+  bootstrap = fetchurl {
+    url = "https://raw.githubusercontent.com/pypa/setuptools/v52.0.0/bootstrap.py";
+    sha256 = "sha256-HzhlnJvMskBfb3kVnYltdnjS63wt1GWd0RK+VQqrJQ8=";
+  };
 
   # Create an sdist of setuptools
   sdist = stdenv.mkDerivation rec {
@@ -23,7 +29,7 @@ let
       owner = "pypa";
       repo = pname;
       rev = "v${version}";
-      sha256 = "Z4KHB3Pv4wZPou/Vbp1DFDgDp47OTDfVChGP55GtIJE=";
+      sha256 = "sha256-ZHJZiwlWLHP4vf2TLwj/DYB9wjbRp0apVmmjsKCLPq0=";
       name = "${pname}-${version}-source";
     };
 
@@ -32,6 +38,7 @@ let
     ];
 
     buildPhase = ''
+      cp ${bootstrap} bootstrap.py
       ${python.pythonForBuild.interpreter} bootstrap.py
       ${python.pythonForBuild.interpreter} setup.py sdist --formats=gztar
 

pkgs/development/python-modules/urllib3/2.nix

@@ -4,6 +4,7 @@
 , certifi
 , cryptography
 , dateutil
+, fetchpatch
 , fetchPypi
 , idna
 , mock
@@ -26,6 +27,14 @@ buildPythonPackage rec {
     sha256 = "19188f96923873c92ccb987120ec4acaa12f0461fa9ce5d3d0772bc965a39e08";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-28363.patch";
+      url = "https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0.patch";
+      sha256 = "1lqhrd11p03iv14bp89rh67ynf000swmwsfvr3jpfdycdqr3ka9q";
+    })
+  ];
+
   propagatedBuildInputs = [
     brotli
     certifi

pkgs/development/python-modules/urllib3/default.nix

@@ -19,11 +19,11 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "de3eedaad74a2683334e282005cd8d7f22f4d55fa690a2a1020a416cb0a47e73";
+    sha256 = "0dw9w9bs3hmr5dp3r3h43jyzzb1g1046ag7lj8pqf58i4kvj3c77";
   };
 
   propagatedBuildInputs = [