python312Packages.js2py: mark insecure #348943
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 tasks
|
Oh, that’s fun… Looks like It’s only used for tests. Could you strip out the dependency and just do |
ofborg
bot
added
10.rebuild-darwin: 0
|
done! btw, how did you get the output telling you which packages were removed by the PR? |
ofborg
bot
added
10.rebuild-darwin: 11-100
10.rebuild-linux: 11-100
and removed
10.rebuild-darwin: 0
emilazy
approved these changes
Oct 17, 2024
There was a problem hiding this comment.
The output is from nixpkgs-review. Looks a lot better now, thanks:
50 packages updated:
cassandra cassandra cassandra checkov python3.11-aiohomekit python3.11-amarna python3.11-ansible-compat python3.11-ansible-core python3.11-ansible-kernel python3.11-ansible-runner python3.11-ansible-vault-rw python3.11-awswrangler python3.11-bc-python-hcl2 python3.11-beancount-black python3.11-beancount-parser python3.11-beanhub-cli python3.11-beanhub-import python3.11-canmatrix python3.11-canopen python3.11-cassandra-driver python3.11-commentjson python3.11-dissect-cobaltstrike python3.11-dragonfly python3.11-extract-msg python3.11-flake8-bugbear python3.11-gremlinpython python3.11-hypothesmith python3.11-ifcopenshell python3.11-langchain python3.11-langchain-azure-dynamic-sessions python3.11-langchain-community python3.11-langchain-huggingface python3.11-langchain-mongodb python3.11-langchain-openai python3.11-lark python3.11-ldfparser python3.11-molecule python3.11-outlines python3.11-pycep-parser python3.11-pyocd python3.11-pyocd-pemicro python3.11-pytest-ansible python3.11-pytest-testinfra python3.11-python-hcl2 python3.11-python-ndn python3.11-pyzx python3.11-radish-bdd python3.11-resolvelib python3.11-rtfde python3.11-spsdk
4 packages removed:
python3.11-django-js-reverse (†0.10.1-b1) python3.11-js2py (†0.74) python3.11-jupysql (†0.10.13) python3.11-tandoor-recipes (†1.5.19)
Result of nixpkgs-review pr 348943 run on aarch64-linux 1
96 packages built:
- cassandra
- cassandra_3_0
- cassandra_3_11
- checkov
- checkov.dist
- python311Packages.aiohomekit
- python311Packages.aiohomekit.dist
- python311Packages.amarna
- python311Packages.amarna.dist
- python311Packages.ansible-compat
- python311Packages.ansible-compat.dist
- python311Packages.ansible-core
- python311Packages.ansible-core.dist
- python311Packages.ansible-kernel
- python311Packages.ansible-kernel.dist
- python311Packages.ansible-runner
- python311Packages.ansible-runner.dist
- python311Packages.ansible-vault-rw
- python311Packages.ansible-vault-rw.dist
- python311Packages.awswrangler
- python311Packages.awswrangler.dist
- python311Packages.bc-python-hcl2
- python311Packages.bc-python-hcl2.dist
- python311Packages.beancount-black
- python311Packages.beancount-black.dist
- python311Packages.beancount-parser
- python311Packages.beancount-parser.dist
- python311Packages.beanhub-cli
- python311Packages.beanhub-cli.dist
- python311Packages.beanhub-import
- python311Packages.beanhub-import.dist
- python311Packages.canmatrix
- python311Packages.canmatrix.dist
- python311Packages.canopen
- python311Packages.canopen.dist
- python311Packages.cassandra-driver
- python311Packages.cassandra-driver.dist
- python311Packages.commentjson
- python311Packages.commentjson.dist
- python311Packages.dissect-cobaltstrike
- python311Packages.dissect-cobaltstrike.dist
- python311Packages.dragonfly
- python311Packages.dragonfly.dist
- python311Packages.extract-msg
- python311Packages.extract-msg.dist
- python311Packages.flake8-bugbear
- python311Packages.flake8-bugbear.dist
- python311Packages.gremlinpython
- python311Packages.gremlinpython.dist
- python311Packages.hypothesmith
- python311Packages.hypothesmith.dist
- python311Packages.ifcopenshell
- python311Packages.langchain
- python311Packages.langchain-azure-dynamic-sessions
- python311Packages.langchain-azure-dynamic-sessions.dist
- python311Packages.langchain-community
- python311Packages.langchain-community.dist
- python311Packages.langchain-huggingface
- python311Packages.langchain-huggingface.dist
- python311Packages.langchain-mongodb
- python311Packages.langchain-mongodb.dist
- python311Packages.langchain-openai
- python311Packages.langchain-openai.dist
- python311Packages.langchain.dist
- python311Packages.lark
- python311Packages.lark.dist
- python311Packages.ldfparser
- python311Packages.ldfparser.dist
- python311Packages.molecule
- python311Packages.molecule.dist
- python311Packages.outlines
- python311Packages.outlines.dist
- python311Packages.pycep-parser
- python311Packages.pycep-parser.dist
- python311Packages.pyocd
- python311Packages.pyocd-pemicro
- python311Packages.pyocd-pemicro.dist
- python311Packages.pyocd.dist
- python311Packages.pytest-ansible
- python311Packages.pytest-ansible.dist
- python311Packages.pytest-testinfra
- python311Packages.pytest-testinfra.dist
- python311Packages.python-hcl2
- python311Packages.python-hcl2.dist
- python311Packages.python-ndn
- python311Packages.python-ndn.dist
- python311Packages.pyzx
- python311Packages.pyzx.dist
- python311Packages.radish-bdd
- python311Packages.radish-bdd.dist
- python311Packages.resolvelib
- python311Packages.resolvelib.dist
- python311Packages.rtfde
- python311Packages.rtfde.dist
- python311Packages.spsdk
- python311Packages.spsdk.dist
I’ll merge this and get it backported to 24.05. Would you be up for another PR that removes it from its other users and drops the package entirely? Probably best to not keep around a vulnerable package that doesn’t work with the default Python version we’re about to ship in 24.11. If not, no worries; it’s marked as vulnerable now so at least the risk is dealt with.
emilazy
added
1.severity: security
|
Successfully created backport PR for |
1 task
13 tasks
Please backport the change unbreaking these packages: #351433 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.