Can we deprecate pyyaml_3?

davidak commented 5 years ago

In https://github.com/NixOS/nixpkgs/pull/68481 the pinned pyyaml_3 was removed since the package works now with the current version.

It is still used in other packages. Check if it is still needed.

https://github.com/NixOS/nixpkgs/search?q=pyyaml_3&unscoped_q=pyyaml_3

When no package needs it anymore, wen can deprecate pyyaml_3.

cc maintainers @HaoZeke @muflax

veprbl commented 5 years ago

Relevant issue: #67422

jonringer commented 5 years ago

seems that only 3 packages use it, we should be able to push that into the application expressions themselves.

[11:11:58] jon@jon-desktop /home/jon/projects/nixpkgs (master)
$ rg -C3 pyyaml_3
pkgs/top-level/python-packages.nix
4673-
4674-  pyyaml = callPackage ../development/python-modules/pyyaml { };
4675-
4676:  pyyaml_3 = (callPackage ../development/python-modules/pyyaml { }).overridePythonAttrs (oldAttrs: rec {
4677-    version = "3.13";
4678-    src = oldAttrs.src.override {
4679-      inherit version;

pkgs/top-level/all-packages.nix
2944-          sha256 = "f15516df478d5a56180fbf80e68f206010e6d160fc39fa508b65e035fd75130b";
2945-        };
2946-      });
2947:      pyyaml = super.pyyaml_3;
2948-    };
2949-  }).pkgs; toPythonApplication elasticsearch-curator;
2950-

pkgs/tools/admin/awscli/default.nix
22-          sha256 = "48eb22f4f8461b1df5734a074b57042430fb06e1d61bd1e11b078c0fe6d7a1f1";
23-        };
24-      });
25:      pyyaml = super.pyyaml_3;
26-    };
27-  };
28-

pkgs/development/tools/build-managers/conan/default.nix
37-        sha256 = "c0abe3218b86533cca287e7057a37481883c07acef7814b70583406938214cc8";
38-      };
39-    });
40:    pyyaml = super.pyyaml_3;
41-  };
42-};
43-

ckauhaus commented 4 years ago

Please do that. PyYAML 3.x is known for numerous security problems and won't get fixed upstream.

NixOS / nixpkgs

Can we deprecate pyyaml_3? #68587