diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 323b54cae1d6..f1ad3d04951e 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -32,31 +32,31 @@ "5.15": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.15.104-hardened1.patch", - "sha256": "0gz3csflp34aadrgmlhy4y3sybxdlzvb2wsss9yb9l5zikxm2h1c", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.104-hardened1/linux-hardened-5.15.104-hardened1.patch" + "name": "linux-hardened-5.15.105-hardened1.patch", + "sha256": "0hkg9198ljp7hv5n5wv6dg2fh042wxlm1mzfk5adfylyl7rrm7js", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.105-hardened1/linux-hardened-5.15.105-hardened1.patch" }, - "sha256": "0m3bscml2mvafbj5k9a3qa8akfxms8wfpzsr687lfblr17735ibi", - "version": "5.15.104" + "sha256": "0kz4ymaqb1kpniqq2mwv3z8rirz5yyf1c9m648kqblij0djkgd81", + "version": "5.15.105" }, "5.4": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.4.238-hardened1.patch", - "sha256": "0fj3q8ykf9fi179hjspi5zq5bzxmn154g5nsdcvnphmizvlzy1qg", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.238-hardened1/linux-hardened-5.4.238-hardened1.patch" + "name": "linux-hardened-5.4.239-hardened1.patch", + "sha256": "12lmajxli4v84h3197xzyj21hyqdn4v596c24iirg72xch3ca5hw", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.239-hardened1/linux-hardened-5.4.239-hardened1.patch" }, - "sha256": "07x9ibcshsm451qcpawv3l0z7g8w8jg79h6dfdmbm3jrhpdb58kh", - "version": "5.4.238" + "sha256": "0nw02lqkvachksyan4n11q0g6jhm1ii7d5zs276n46891ypn80m9", + "version": "5.4.239" }, "6.1": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-6.1.21-hardened1.patch", - "sha256": "04sksmh4zym2z8bjg8hdr1zv1fv1r08z1b5kyl7rm9b1ic3gd39w", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.21-hardened1/linux-hardened-6.1.21-hardened1.patch" + "name": "linux-hardened-6.1.22-hardened1.patch", + "sha256": "1nwjchs8jlishdcxc4f5834d7p03f1iiyhbp1gv2j1b48qrlf17l", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.22-hardened1/linux-hardened-6.1.22-hardened1.patch" }, - "sha256": "0fnr2pw4pi0vnkpv8hfipya09cgdz6ghks7p6vdl2d71dawb2g5k", - "version": "6.1.21" + "sha256": "1a7xkjqj13q5dgk1gml27kdzs381p0z203alamd0wkgprr0r3s1b", + "version": "6.1.22" } } diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix index ae8e8125bf50..4e1912d6e9f5 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.14.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "4.14.311"; + version = "4.14.312"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "1mbwrgjz575qxg4gwi2fxc94kprmiblwap3jix0mj4887zllqgw0"; + sha256 = "03bwrnm7z8jxxn681dd5jffrj76l14ngkcccfgbg1p4a0471q436"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix index 208f67bdc636..f9691c864f35 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.19.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "4.19.279"; + version = "4.19.280"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "104qkyflkfkp8iyshpirb9q708vvsgfbxfwgl0dnas3k7nyc6v3k"; + sha256 = "1xmg9p3ky75n5q894f522s8nwcmbd5c15nmjr0n96m6xzag3kd7w"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix index e49fc9f01a44..515072be9389 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.10.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.10.176"; + version = "5.10.177"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "14zpdrrrpgxx44nxjn0rifrchnmsvvpkzpm1n82kw5q4p9h2q1yf"; + sha256 = "0waml6svj07b7f8yb1kzrflqlf61x4kcqbgsr372s484m3z628lz"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix index 3ab936807c98..617b03a3472a 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.15.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.15.105"; + version = "5.15.106"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "0kz4ymaqb1kpniqq2mwv3z8rirz5yyf1c9m648kqblij0djkgd81"; + sha256 = "1r4g7ipcmj7k9dpwd5p2kd0f3iidnzl6z9g2cq4mfcw0h97r7rl4"; }; } // (args.argsOverride or { })) diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix index 6a0d972f03cc..94d19aafe977 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.4.239"; + version = "5.4.240"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "0nw02lqkvachksyan4n11q0g6jhm1ii7d5zs276n46891ypn80m9"; + sha256 = "0ihf0rqhx7dav3k3igk29962sscb1xyniy2gx8chyllprr0z126w"; }; } // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix index ac7cd3cc4136..459b29710cc8 100644 --- a/pkgs/os-specific/linux/kernel/linux-6.1.nix +++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "6.1.22"; + version = "6.1.23"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz"; - sha256 = "1a7xkjqj13q5dgk1gml27kdzs381p0z203alamd0wkgprr0r3s1b"; + sha256 = "1szblfmm8gx0am017y30ywc60b1gqarplgmcs5zy7bshhwp3fn3l"; }; } // (args.argsOverride or { })) diff --git a/pkgs/os-specific/linux/kernel/linux-6.2.nix b/pkgs/os-specific/linux/kernel/linux-6.2.nix index 9b2a21a4af1a..5b941f88212d 100644 --- a/pkgs/os-specific/linux/kernel/linux-6.2.nix +++ b/pkgs/os-specific/linux/kernel/linux-6.2.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "6.2.9"; + version = "6.2.10"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = versions.pad 3 version; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz"; - sha256 = "1xa3znandhyn1ygbfv4cl83mwn33hphj1jdc59s0wgy0ck0ljd4h"; + sha256 = "1zm4xvxdy6sqqwcich46mr4dh3kpmp40bawwahrg4lr7rp1n5iap"; }; } // (args.argsOverride or { })) diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix index 940ad6dd7394..ab48284c05a6 100644 --- a/pkgs/servers/dns/pdns-recursor/default.nix +++ b/pkgs/servers/dns/pdns-recursor/default.nix @@ -5,11 +5,11 @@ stdenv.mkDerivation rec { pname = "pdns-recursor"; - version = "4.7.4"; + version = "4.7.5"; src = fetchurl { url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2"; - sha256 = "F7XHyIHj9AC7O1J92GblzyzWLV0zVmsbcLWMYI2ZaNU="; + sha256 = "x+iNyGbXGo9TPy+UFRq73wUWwSJKWAYddkG8NE0IeIk="; }; nativeBuildInputs = [ pkg-config ]; diff --git a/pkgs/servers/geospatial/geoserver/default.nix b/pkgs/servers/geospatial/geoserver/default.nix index ef9cbc7e1018..f1d3d9d832e8 100644 --- a/pkgs/servers/geospatial/geoserver/default.nix +++ b/pkgs/servers/geospatial/geoserver/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "geoserver"; - version = "2.21.2"; + version = "2.21.4"; src = fetchurl { url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip"; - sha256 = "sha256-RL9a6AO6ZXD8NXWh49wwcNd+W5Nu2Ppl8daESR4mUoA="; + sha256 = "sha256-DIUQdR0WMK+iiPTPP9jkD8922rZx8jg7WAKgrJn+cpM="; }; sourceRoot = "."; diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 13c29ac6e399..0455f9e86aca 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -1,4 +1,4 @@ -{ lib, buildGoModule, fetchFromGitHub, nixosTests }: +{ lib, buildGoModule, fetchFromGitHub, nixosTests, fetchpatch }: let # The web client verifies, that the server version is a valid datetime string: @@ -24,6 +24,14 @@ buildGoModule rec { sha256 = "sha256-sABNzhyfBNU5pWyE/VWHUzuSyKsx0glj01ectJPakV8="; }; + patches = [ + (fetchpatch { + name = "CVE-2023-25812.patch"; + url = "https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485.patch"; + sha256 = "sha256-9y7cua6r2hp+cK+rn2b4FMbHbmVXudFTt8ZffUEpkMQ="; + }) + ]; + vendorSha256 = "sha256-wB3UiuptT6D0CIUlHC1d5k0rjIxNeh5yAWOmYpyLGmA="; doCheck = false; diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix index 3045f637e330..26eb39d31b9a 100644 --- a/pkgs/servers/x11/xorg/overrides.nix +++ b/pkgs/servers/x11/xorg/overrides.nix @@ -851,6 +851,11 @@ self: super: url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec.diff"; sha256 = "sha256-/+IuGk09OYVEIB/Y+DTKf7kfHyukEFX/6u1FDIGJieY="; }) + ] ++ [ + (fpgit "fb51d5dd53b02422ea3b6f36bd017488d41f472d" + "TyScXYJE+zHOovDrSiTUWuWg8nbCt/IIkNEPVRst/0Q=" + "CVE-2023-1393" + ) ]; buildInputs = commonBuildInputs ++ [ libdrm mesa ]; propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [