[python-updates] 2025-05-18: Python 3.13

[mweinelt]

This is a bulk update run on the python package set.

• Jobset: https://hydra.lossy.network/jobset/nixpkgs/python-updates
• Eval reports: https://shells.darmstadt.ccc.de/~hexa/742.html

Questions? Join #python:nixos.org on Matrix.

Backed out

• Cython 3.1.0 (too early for the ecosystem)
• pip 25.1.0 (breaks pip-tools tests, because dependency resolution complexity exception)
• beautifulsoup 4.13 break django-compressor and thereby pretalx, pretix, healthchecks, weblate, seahub
• marshmallow 4.0 (required heavy patching for dataclasses-json, breaks platformio for example) python313Packages.marshmallow: 3.26.1 -> 4.0.0 #409223
• clldutils>3.22.0 (requires bibtexparser>2.0b4, which breaks e.g. scholarly and calibre-web)

Known issues

• LLVM versions 15 and earlier break due to pipes battery removal

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/726.html

This eval was a bit early and incomplete and I've pushed like 50 more commits since.

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/733.html

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/738.html

[mweinelt]

I hope that's all, because this is already a full rebuild of all 21k packages in the Python scope. We maybe have 48-72h to land this PR for the next staging cycle.

[mweinelt]

https://shells.darmstadt.ccc.de/~hexa/742.html

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/82

[trofi]

Bisect says 033d93e python3: 3.12.10 -> 3.13.3 broke the eval of noto-fonts-color-emoji in staging as:

$ nix-instantiate -A noto-fonts-color-emoji
error:
       … while calling the 'derivationStrict' builtin
         at <nix/derivation-internal.nix>:37:12:
           36|
           37|   strict = derivationStrict drvAttrs;
             |            ^
           38|

       … while evaluating derivation 'noto-fonts-color-emoji-2.047'
         whose name attribute is located at pkgs/stdenv/generic/make-derivation.nix:480:13

       … while evaluating attribute 'nativeBuildInputs' of derivation 'noto-fonts-color-emoji-2.047'
         at pkgs/stdenv/generic/make-derivation.nix:532:13:
          531|             depsBuildBuild = elemAt (elemAt dependencies 0) 0;
          532|             nativeBuildInputs = elemAt (elemAt dependencies 0) 1;
             |             ^
          533|             depsBuildTarget = elemAt (elemAt dependencies 0) 2;

       … while calculating requiredPythonModules for python3.13-nototools-0.2.20:

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: typed-ast-1.5.5 not supported for interpreter python3.13

[Kernald]

Is this going to be backported to 25.05 by any chance? (I'm mostly curious about #401010)

[mweinelt]

Backporting pydantic in #411096.

[trofi]

Somehow fea291d hotdoc: 0.15 -> 0.17.4 broke gst_all_1.gst-vaapi in staging as:

$ nix build --no-link -f. gst_all_1.gst-vaapi -j1 --keep-going
...
Program hotdoc found: YES (/nix/store/4xa0psmhr8gj57hkj199gnyyigfvlhhb-hotdoc-0.17.4/bin/hotdoc)
Program hotdoc found: YES (/nix/store/4xa0psmhr8gj57hkj199gnyyigfvlhhb-hotdoc-0.17.4/bin/hotdoc)

docs/meson.build:68:8: ERROR: Problem encountered: Documentation enabled but gi-extension missing

[mweinelt]

It was unfortunately failing at the version it was sitting at, so backing out of the change seems equally bad.

[mweinelt]

Could rollback and just apply hotdoc/hotdoc@ce57d18.

Bisecting is annoying with submodules and npm dependencies.

• 0.15.1 is already bad

Possibly related #98769 (comment) (the initial idea to build docs).
In #306016 (comment) we bumped to 0.16.0 but it brokle a test and was reverted.

[mweinelt]

Oh god, it needs clang to find its extensions. hotdoc/hotdoc#286

[jonhermansen]

python-wheel library was updated from 0.45.1 to 0.46.1, but the hash was never changed, could this be a problem with the update tooling? It's also possible that the tag was changed after these changes, so I wanted to ask here.

@mweinelt Check this commit b2fc3a5923ff2

I found an issue when building the python-wheel from source:

error: hash mismatch in fixed-output derivation '/nix/store/hjvnmjmkmcaldyskp24gab42zf0qcfld-source.drv':
         specified: sha256-tgueGEWByS5owdA5rhXGn3qh1Vtf0HGYC6+BHfrnGAs=
            got:    sha256-iyGfGr3pLVZSEIHetjsPbIIXkuXrmIPiSqqOw31l9Qw=
error: 1 dependencies of derivation '/nix/store/5946268h696fsfbv2i0hrgr5dr2ckqdl-python3.13-wheel-0.46.1.drv' failed to build

I opened #424195 to pull in the latest changes from python-wheel 0.46.1

[Zaczero]

CVE-2025-4516.patch appears to be dead. Do we need it, or can it be removed? Or am I not seeing something?