[python-updates] 2025-01-19: major updates

[mweinelt]

This is a bulk update run on the python package set.

• Jobset: https://hydra.lossy.network/jobset/nixpkgs/python-updates
• Eval reports: https://shells.darmstadt.ccc.de/~hexa/636.html

Questions? Join #python:nixos.org on Matrix.

Known issues

• oslo-utils will be fixed via qemu-utils: enable crypto support #376394
• pygit2 will be fixed via libgit2: 1.8.4 -> 1.9.0 (also pygit2 update) #373096

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/586.html

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/589.html

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/593.html

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/594.html

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/599.html

[imincik]

@mweinelt , see #375859 .

[mweinelt]

Did a rebase on staging to get postgresql to build and uncover the hidden build failures behind it.

Also dropped all bumps for which there were reverts and ordered package inits in front of the package that required packaging them.

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/605.html

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/610.html

[SuperSandro2000]

When #376394 is merged, drop the oslo-utils test ignore from this PR

[mweinelt]

I never pushed it.

[mweinelt]

@mweinelt can we somehow exclude playwright from such updates a0cce8a? The lib depends on a specific driver version and must be updated using included update.sh. PR with such update #358638

If a package is fragile and often breaks during these bulks updates, it may be reasonable to set passthru.skipBulkUpdate = true in the derivation. This decision should not be made on a whim and should always be supported by a qualifying comment.

https://github.com/NixOS/nixpkgs/blob/master/doc/languages-frameworks/python.section.md#updating-packages-in-bulk-python-package-bulk-updates

[trofi]

On master python3Packages.androguard fails as:

$ nix build --no-link -f. -L python3Packages.androguard
...
python3.12-androguard> applying patch /nix/store/0ihd8gmffhv6ppx0nv8hzfcrsp1d6dyg-drop-removed-networkx-formats.patch
python3.12-androguard> patching file androguard/cli/main.py
python3.12-androguard> Hunk #1 FAILED at 110.
python3.12-androguard> 1 out of 1 hunk FAILED -- saving rejects to file androguard/cli/main.py.rej

I suspect it's after 47c6362 python3Packages.androguard: 3.4.0a1 -> 4.1.2 (bisect fails early on other intermediate python package failures, thus have to guess).

[linsui]

New androguard requires a broken dep. androguard/androguard#1068

[trofi]

Bisect says 311264f python3Packages.cstruct: 5.3 -> 6.0 broke jefferson (a diffoscope dependency) on master as:

$ nix build --no-link -f. jefferson -L
...
jefferson> Checking runtime dependencies for jefferson-0.4.5-py3-none-any.whl
jefferson>   - cstruct<6.0,>=5.2 not satisfied by version 6.0

[sikmir]

h3 is broken after update (#380382).

[happysalada]

@drawbu it looks like duckduckgo-search is broken on a mismatch of primp package. If you have time of course.

[Sigmanificient]

This breaks fava too, #380197

[arjan-s]

This breaks XWayland support in Qtile. We were already tracking the problem in #371737 and qtile/qtile#5101 and this PR just blindly updated Qtile without looking at it.
Can we revert the qtile and qtile-extras updates done by this PR?

[terlar]

@mweinelt: This seems to have broken checkov, it is possible to work around by pinning the version:

pkgs.checkov.overridePythonAttrs {
  dependencies = map (pkg:
    if pkg.pname == "cyclonedx-python-lib" then
      pkg.overrideAttrs (old: rec {
        name = builtins.replaceStrings [ old.version ] [ version ] old.name;
        version = "7.6.2";
        src = pkgs.fetchFromGitHub {
          owner = "CycloneDX";
          repo = "cyclonedx-python-lib";
          tag = "v${version}";
          hash = "sha256-nklizCiu7Nmynjd5WU5oX/v2TWy9xFVF4GkmCwFKZLI=";
        };
      })
    else
      pkg
  ) pkgs.checkov.dependencies;
}

They have it pinned to the older version https://github.com/bridgecrewio/checkov/blob/main/Pipfile#L69

The question is how do we handle these local dependency limitations. Do we create a new cyclonedx-python-lib_7, do we inline it inside the checkov package or do we try to patch it to work?

[mweinelt]

Use an overwritten python with packageOverrides to pin dependencies within the checkov package.

https://github.com/NixOS/nixpkgs/blob/master/doc/languages-frameworks/python.section.md#how-to-override-a-python-package-how-to-override-a-python-package

[philipwilk]

Broke python3Packages.imbalanced-learn as dependency python3Packages.sklearn-compat was not added.

52270a8 adds sklearn-compat but 2 tests still fail on imbalanced-learn.