lol

python3Packages.js2py: remove

unmaintained and insecure: https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape

ruby0b 0f79dd41 cff2da87

+26 -82
+17 -19
pkgs/applications/networking/pyload-ng/default.nix
··· 30 30 sed -i -E 's/([A-z0-9]*)~=[^;]*(.*)/\1\2/' setup.cfg 31 31 ''; 32 32 33 - dependencies = 34 - with python3.pkgs; 35 - [ 36 - bitmath 37 - certifi 38 - cheroot 39 - cryptography 40 - filetype 41 - flask 42 - flask-babel 43 - flask-caching 44 - flask-compress 45 - flask-session 46 - flask-themes2 47 - pycurl 48 - semver 49 - setuptools 50 - ] 51 - ++ (if pythonOlder "3.12" then [ js2py ] else [ dukpy ]); 33 + dependencies = with python3.pkgs; [ 34 + bitmath 35 + certifi 36 + cheroot 37 + cryptography 38 + dukpy 39 + filetype 40 + flask 41 + flask-babel 42 + flask-caching 43 + flask-compress 44 + flask-session 45 + flask-themes2 46 + pycurl 47 + semver 48 + setuptools 49 + ]; 52 50 53 51 optional-dependencies = { 54 52 plugins = with python3.pkgs; [
+3 -2
pkgs/development/python-modules/django-js-reverse/default.nix
··· 7 7 django, 8 8 packaging, 9 9 nodejs, 10 - js2py, 11 10 six, 12 11 }: 13 12 ··· 25 24 26 25 propagatedBuildInputs = [ django ] ++ lib.optionals (pythonAtLeast "3.7") [ packaging ]; 27 26 27 + # Js2py is needed for tests but it's unmaintained and insecure 28 + doCheck = false; 29 + 28 30 nativeCheckInputs = [ 29 31 nodejs 30 - js2py 31 32 six 32 33 ]; 33 34
-47
pkgs/development/python-modules/js2py/default.nix
··· 1 - { 2 - lib, 3 - fetchPypi, 4 - buildPythonPackage, 5 - pythonAtLeast, 6 - setuptools, 7 - tzlocal, 8 - six, 9 - pyjsparser, 10 - }: 11 - 12 - buildPythonPackage rec { 13 - pname = "js2py"; 14 - version = "0.74"; 15 - pyproject = true; 16 - 17 - # broken with Python 3.12 18 - # https://github.com/PiotrDabkowski/Js2Py/issues/317 19 - disabled = pythonAtLeast "3.12"; 20 - 21 - src = fetchPypi { 22 - pname = "Js2Py"; 23 - inherit version; 24 - hash = "sha256-OfOmqoRpGA77o8hncnHfJ8MTMv0bRx3xryr1i4e4ly8="; 25 - }; 26 - 27 - nativeBuildInputs = [ setuptools ]; 28 - 29 - propagatedBuildInputs = [ 30 - pyjsparser 31 - six 32 - tzlocal 33 - ]; 34 - 35 - # Test require network connection 36 - doCheck = false; 37 - 38 - pythonImportsCheck = [ "js2py" ]; 39 - 40 - meta = with lib; { 41 - description = "JavaScript to Python Translator & JavaScript interpreter written in 100% pure Python"; 42 - homepage = "https://github.com/PiotrDabkowski/Js2Py"; 43 - license = licenses.mit; 44 - maintainers = with maintainers; [ onny ]; 45 - knownVulnerabilities = [ "CVE-2024-28397" ]; 46 - }; 47 - }
+3 -2
pkgs/development/python-modules/jupysql/default.nix
··· 22 22 grpcio, 23 23 ipython, 24 24 ipywidgets, 25 - js2py, 26 25 matplotlib, 27 26 numpy, 28 27 pandas, ··· 69 68 grpcio 70 69 ipython 71 70 ipywidgets 72 - js2py 73 71 matplotlib 74 72 numpy 75 73 pandas ··· 101 99 "src/tests/test_plot.py" 102 100 "src/tests/test_magic.py" 103 101 "src/tests/test_magic_plot.py" 102 + 103 + # require js2py (which is unmaintained and insecure) 104 + "src/tests/test_widget.py" 104 105 ]; 105 106 106 107 preCheck = ''
+1 -1
pkgs/development/python-modules/lark/default.nix
··· 30 30 "lark.grammars" 31 31 ]; 32 32 33 - # Js2py is needed for tests but it's marked as insecure 33 + # Js2py is needed for tests but it's unmaintained and insecure 34 34 doCheck = false; 35 35 36 36 meta = with lib; {
+1 -9
pkgs/development/python-modules/pyjsparser/default.nix
··· 3 3 fetchFromGitHub, 4 4 buildPythonPackage, 5 5 pytestCheckHook, 6 - js2py, 7 6 }: 8 7 9 8 let ··· 21 20 22 21 nativeCheckInputs = [ 23 22 pytestCheckHook 24 - js2py 25 23 ]; 26 24 27 - # escape infinite recursion with js2py 25 + # js2py is needed for tests but it's unmaintained and insecure 28 26 doCheck = false; 29 - 30 - passthru.tests = { 31 - check = pyjsparser.overridePythonAttrs (_: { 32 - doCheck = true; 33 - }); 34 - }; 35 27 36 28 pythonImportsCheck = [ "pyjsparser" ]; 37 29
+1
pkgs/top-level/python-aliases.nix
··· 286 286 jinja2_pluralize = jinja2-pluralize; # added 2023-11-01 287 287 jinja2_time = jinja2-time; # added 2022-11-07 288 288 JPype1 = jpype1; # added 2023-02-19 289 + js2py = throw "js2py has been removed, as it is unmaintained and insecure"; # added 2024-10-17 289 290 jsonpath_rw = jsonpath-rw; # added 2024-01-06 290 291 jsonschema_3 = throw "jsonschema 3 is neither the latest version nor needed inside nixpkgs anymore"; # added 2023-06-28 291 292 jupyter_client = jupyter-client; # added 2021-10-15
-2
pkgs/top-level/python-packages.nix
··· 6476 6476 inherit (pkgs) jq; 6477 6477 }; 6478 6478 6479 - js2py = callPackage ../development/python-modules/js2py { }; 6480 - 6481 6479 jsbeautifier = callPackage ../development/python-modules/jsbeautifier { }; 6482 6480 6483 6481 jschema-to-python = callPackage ../development/python-modules/jschema-to-python { };