python3Packages.xmlschema: 4.1.0 -> 4.2.0#452743
Merged
dotlambda merged 2 commits intoNixOS:masterfrom Nov 11, 2025
Merged
Conversation
nixpkgs-ci
bot
added
10.rebuild-linux: 11-100
Member
|
@melvyn2 @sumnerevans @Ma27 @fadenb @mguentner @D4ndellion @NickCao @teutat3s You maintain the two packages that depend on pysaml2 (djangosml2 and matrix-synapse). Eventually xmlschema will have to be updated which breaks pysaml2 and thus your package. Please find a solution. |
dotlambda
added
the
1.severity: security
Member
|
In fact, this release adds protections against DoS (MAX_SCHEMA_SOURCES, MAX_XML_ELEMENTS, MAX_XML_DEPTH) so I'd consider it as fixing a vulnerability and this PR should be merged soon. |
Member
|
Contributor
|
|
Member
|
It looks like upstream is at least aware of the issue IdentityPython/pysaml2#947. |
It is incompatible with our version of xmlschema.
Member
|
Contributor
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release-25.05
git worktree add -d .worktree/backport-452743-to-release-25.05 origin/release-25.05
cd .worktree/backport-452743-to-release-25.05
git switch --create backport-452743-to-release-25.05
git cherry-pick -x d44056ae07c72ed1b68f3af1709d38193ea3de06 ea9c00b162c441f9ab41f004a1ddc82b5c5c2002 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automatic update generated by nixpkgs-update tools. This update was made based on information from passthru.updateScript.
meta.description for python3Packages.xmlschema is: XML Schema validator and data conversion library for Python
meta.homepage for python3Packages.xmlschema is: https://github.com/sissaschool/xmlschema
meta.changelog for python3Packages.xmlschema is: https://github.com/sissaschool/xmlschema/blob/v4.2.0/CHANGELOG.rst
Updates performed
To inspect upstream changes
Impact
Checks done
passthru.tests, if any, passedRebuild report (if merged into master) (click to expand)
Instructions to test this update (click to expand)
Either download from the cache:
(The nixpkgs-update cache is only trusted for this store-path realization.)
For the cached download to work, your user must be in the
trusted-userslist or you can usesudosince root is effectively trusted.Or, build yourself:
Or:
After you've downloaded or built it, look at the files and if there are any, run the binaries:
Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
nixpkgs-reviewresultGenerated using
nixpkgs-review.Command:
nixpkgs-review --extra-nixpkgs-config '{ allowBroken = false; }'Commit:
d44056ae07c72ed1b68f3af1709d38193ea3de06x86_64-linux❌ 48 packages failed to build:
✅ 49 packages built:
Maintainer pings
Tip
As a maintainer, if your package is located under
pkgs/by-name/*, you can comment@NixOS/nixpkgs-merge-bot mergeto automatically merge this update using thenixpkgs-merge-bot.Add a 👍 reaction to pull requests you find important.