nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-02 13:00:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge release-26.05 into staging-nixos-26.05

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2026-07-24 00:33:07 +00:00
committed by GitHub
parent 7f8c0c3a7d 3563880639
commit 2a3cbcc402
59 changed files with 2336 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
maintainers/maintainer-list.nix
View File

@@ -30181,6 +30181,11 @@
githubId = 106241330;
name = "Success Kingsley";
};
xqtc161 = {
github = "xqtc161";
githubId = 65857432;
name = "tila";
};
xrelkd = {
github = "xrelkd";
githubId = 46590321;

3
nixos/modules/programs/bat.nix
View File

@@ -8,6 +8,7 @@ let
inherit (builtins) isList;
inherit (lib)
concatMapStrings
escapeShellArg
literalExpression
maintainers
mapAttrs'
@@ -34,7 +35,7 @@ let
else if isBool value then
boolToString value
else
toString value;
escapeShellArg (toString value);
in
{
options.programs.bat = {

8
nixos/modules/system/boot/resolved.nix
View File

@@ -30,9 +30,8 @@ let
dnsmasqResolve = config.services.dnsmasq.enable && config.services.dnsmasq.resolveLocalQueries;
transformSettings =
settings:
lib.mapAttrs (
transformSettings = settings: {
Resolve = lib.mapAttrs (
key: value:
# concat lists for options that should result in space-separated values
if
@@ -46,7 +45,8 @@ let
concatStringsSep " " value
else
value
) settings;
) settings.Resolve;
};
resolvedConf = settingsToSections (transformSettings cfg.settings);
in

2
nixos/tests/coredns.nix
View File

@@ -28,7 +28,7 @@
position = "start-of-file";
}
];
vendorHash = "sha256-66WNU+t/frHfbxexYdiXzgXKLxPyLnN6JuKnlG/kSQY=";
vendorHash = "sha256-cvgq/Djlxjiu0C5QjaxrlEeG7O2mB6mGAwV7/reYlpY=";
};
};
};

4
pkgs/applications/gis/qgis/unwrapped-ltr.nix
View File

@@ -85,7 +85,7 @@ let
];
in
mkDerivation rec {
version = "3.44.10";
version = "3.44.11";
pname = "qgis-ltr-unwrapped";
outputs = [ "out" ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) "man";
@@ -93,7 +93,7 @@ mkDerivation rec {
owner = "qgis";
repo = "QGIS";
rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
hash = "sha256-wWLbnZpLIchm0NXuU7jEXCBctrI6G1z8iqf9R2YhS8Y=";
hash = "sha256-gWSl9OrRSxreQdKxKKDCOUWBE5uE2w3/ebW266LCWLI=";
};
passthru = {

26
pkgs/applications/networking/browsers/chromium/info.json
View File

@@ -838,7 +838,7 @@
}
},
"ungoogled-chromium": {
"version": "150.0.7871.128",
"version": "150.0.7871.181",
"deps": {
"depot_tools": {
"rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
@@ -850,16 +850,16 @@
"hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
},
"ungoogled-patches": {
"rev": "150.0.7871.128-1",
"hash": "sha256-GxSsGTC68IEMPt85RLBCVDT0dTl7ZVVPc8o4vxc50H8="
"rev": "150.0.7871.181-1",
"hash": "sha256-ifqEnOcvi49cFOYan8ShiwteXYnFrLPclrIBZiE1rGY="
},
"npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
},
"DEPS": {
"src": {
"url": "https://chromium.googlesource.com/chromium/src.git",
"rev": "81891e5ca708047763816c778216799ef14c66cb",
"hash": "sha256-lGHZZ2xIih+TaH145CZwEwyXsM1ZQWwqXsIQjWQ/jvk=",
"rev": "24b04c927b23c39cf9c5227cc8dc6f64a744c8e9",
"hash": "sha256-F52wmxyNPEV26v8YgAz+MRhyEGyV7YUX+/wj95H4Lf0=",
"recompress": true
},
"src/third_party/clang-format/script": {
@@ -929,8 +929,8 @@
},
"src/third_party/angle": {
"url": "https://chromium.googlesource.com/angle/angle.git",
"rev": "13e691adf3d4d3ebee2f7239731a07d3b9704956",
"hash": "sha256-fbjREn3D+quRRADGwR7V65BZt5b+1DgnsG4ZMhwGq6o="
"rev": "edae461ad2122a3a2be0b5d3d067472aa0e3329c",
"hash": "sha256-V4D7jAPJy4llbfJ6WmgCaqaH3TgkWIg5UtRAUaB9dE4="
},
"src/third_party/angle/third_party/glmark2/src": {
"url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -974,8 +974,8 @@
},
"src/third_party/dawn": {
"url": "https://dawn.googlesource.com/dawn.git",
"rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5",
"hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM="
"rev": "d089fc91e7e4881362463faf8efe9ae435e34660",
"hash": "sha256-ZcfSMBvdAdEJQv+qfwAe8EFHPAfPtuKLTIR5lDRKP3Q="
},
"src/third_party/dawn/third_party/glfw3/src": {
"url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1494,8 +1494,8 @@
},
"src/third_party/skia": {
"url": "https://skia.googlesource.com/skia.git",
"rev": "bee4c917220040e147f14964635ff92ce6c5a3f6",
"hash": "sha256-SWmoX+sNaw4KnlTBPt63uBSYfQavJejB3+Vlw/gtWX8="
"rev": "587c5b0f5a7b0260826a0c19094c2d952195066e",
"hash": "sha256-COvdvWVfafVhccLIj2dJzu62Rbyi3oDgORtjIGolCRo="
},
"src/third_party/smhasher/src": {
"url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1664,8 +1664,8 @@
},
"src/v8": {
"url": "https://chromium.googlesource.com/v8/v8.git",
"rev": "2b2f69158528fdd9d86b778cfcc2d0a1c4f8c59f",
"hash": "sha256-bqzCZSpKdXgKv3O1I7ck1PEXCa/2jBT7hpBEKW0LgTA="
"rev": "49df3678d1b6a1511167b15a6b7499d3ab37a638",
"hash": "sha256-T9FWX3zuP1V7wvxeHgv2MEfRiwbJC0ElI3eazSYq3fs="
},
"src/agents/shared": {
"url": "https://chromium.googlesource.com/chromium/agents.git",

10
pkgs/applications/virtualization/docker/default.nix
View File

@@ -420,18 +420,18 @@ in
docker_29 =
let
version = "29.6.1";
version = "29.6.2";
in
callPackage dockerGen {
inherit version;
cliRev = "v${version}";
cliHash = "sha256-cpK2UMRP/WXHsehG9Sq5UJAjhMesmXTrhe00y4RMRZc=";
cliHash = "sha256-WpPSePMCfWAVxCkX1nZyI+sra/Vug009ZPmnVKDaX0I=";
mobyRev = "docker-v${version}";
mobyHash = "sha256-gv+mea9X5TYDWN3IBRpmw0+R2waGxCiubdatNTeUQZI=";
mobyHash = "sha256-zrvrZCRUuiZ2vixZNOUFeGmDehHzSI+FzDMzV1gMqMc=";
runcRev = "v1.3.6";
runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
containerdRev = "v2.2.5";
containerdHash = "sha256-3ui+0AjEU6H4VHYwF3G85ggVMUdONCLJ5KfciFasmkk=";
containerdRev = "v2.2.6";
containerdHash = "sha256-Ngo9x847cXFYPnj/0I+g7BeV7e1/5T2YXfA1zkIdiPg=";
tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
};

13
pkgs/by-name/cl/clickhouse/generic.nix
View File

@@ -165,8 +165,17 @@ llvmStdenv.mkDerivation (finalAttrs: {
gitHash = rev;
in
''
cat <<'EOF' > cmake/autogenerated_versions.txt
SET(VERSION_REVISION 0)
# Preserve VERSION_REVISION from the source tree, like ClickHouse CI
# does. It identifies the server release line to clients (exposed via
# the revision() SQL function)
versionRevision=$(sed -n 's/^SET(VERSION_REVISION \([0-9]\{1,\}\))$/\1/p' cmake/autogenerated_versions.txt)
if [[ -z "$versionRevision" ]]; then
echo "Could not extract VERSION_REVISION from cmake/autogenerated_versions.txt" >&2
exit 1
fi
cat <<EOF > cmake/autogenerated_versions.txt
SET(VERSION_REVISION $versionRevision)
SET(VERSION_MAJOR ${major})
SET(VERSION_MINOR ${minor})
SET(VERSION_PATCH ${patch})

13
pkgs/by-name/co/commitizen/package.nix
View File

@@ -12,19 +12,19 @@
python3Packages.buildPythonPackage rec {
pname = "commitizen";
version = "4.13.9";
version = "4.16.4";
pyproject = true;
src = fetchFromGitHub {
owner = "commitizen-tools";
repo = "commitizen";
tag = "v${version}";
hash = "sha256-bT154qRnZCf3StYs+acv4Be/SUCA5ovGjY/j2EDmUEc=";
hash = "sha256-lVc1Kdy/IWRa8uoPZfOSSa379bDDknE3dpm0U7DVv0s=";
};
postPatch = ''
substituteInPlace pyproject.toml \
--replace-fail "uv_build >= 0.9.17, <0.10.0" "uv-build"
--replace-fail "uv_build >= 0.9.17, <0.12" "uv-build"
'';
pythonRelaxDeps = [
@@ -54,6 +54,13 @@ python3Packages.buildPythonPackage rec {
tomlkit
];
makeWrapperArgs = [
"--prefix"
"PATH"
":"
(lib.makeBinPath [ gitMinimal ])
];
nativeCheckInputs = [
gitMinimal
versionCheckHook

6
pkgs/by-name/co/coredns/package.nix
View File

@@ -6,7 +6,7 @@
installShellFiles,
nixosTests,
externalPlugins ? [ ],
vendorHash ? "sha256-9LLTgIjOOMvYx4nhy+6X9bEBvqlKeTx//39q+YWXeHw=",
vendorHash ? "sha256-K7cHC6IVawJmlCLR45SKEowXw7SfURIePHzj1LvKS84=",
}:
let
@@ -14,13 +14,13 @@ let
in
buildGoModule (finalAttrs: {
pname = "coredns";
version = "1.14.3";
version = "1.14.6";
src = fetchFromGitHub {
owner = "coredns";
repo = "coredns";
tag = "v${finalAttrs.version}";
hash = "sha256-Uk4oWsUxaGdLQzX5JywYzi7pmQHGo06uQdLeOkP4U/s";
hash = "sha256-3BKXmrsSsDWFl6MT6c5Q8wcQiApO1vG0KeUtJLm89jU=";
};
inherit vendorHash;

4
pkgs/by-name/do/dokuwiki/package.nix
View File

@@ -9,13 +9,13 @@
stdenv.mkDerivation rec {
pname = "dokuwiki";
version = "2025-05-14b";
version = "2026-07-14a";
src = fetchFromGitHub {
owner = "dokuwiki";
repo = "dokuwiki";
rev = "release-${version}";
sha256 = "sha256-J7B+mvvGtAPK+WjlkHyadG61vli+zZfozfEmEynYQaE=";
sha256 = "sha256-qj+Ng20aB3qV2afrER309kvlh6gXRFPh3MqnomvvCf4=";
};
preload = writeText "preload.php" ''

4
pkgs/by-name/ex/exim/package.nix
View File

@@ -39,11 +39,11 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "exim";
version = "4.99.4";
version = "4.99.5";
src = fetchurl {
url = "https://ftp.exim.org/pub/exim/exim4/exim-${finalAttrs.version}.tar.xz";
hash = "sha256-h/84gVcA37HuTrfo26eRbfenVZBTVNLQ+qGuF5DE/Z0=";
hash = "sha256-wtL4Ctx8cdQk/YKkZlXqotfZtMoud4g+upB2lHt+5ic=";
};
enableParallelBuilding = true;

6
pkgs/by-name/fl/flameshot/package.nix
View File

@@ -12,6 +12,7 @@
nix-update-script,
enableWlrSupport ? !stdenv.hostPlatform.isDarwin,
enableMonochromeIcon ? false,
fetchpatch,
wrapGAppsHook3,
}:
@@ -48,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
patches = [
./load-missing-deps.patch
./macos-build.patch
(fetchpatch {
name = "CVE-2026-62294.patch";
url = "https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96.patch";
hash = "sha256-bhJ6fQJXkRoUME8juj6/8bQAO5V50tJfV0wcJfIoPg0=";
})
];
nativeBuildInputs = [

6
pkgs/by-name/fr/framework-tool-tui/package.nix
View File

@@ -7,16 +7,16 @@
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "framework-tool-tui";
version = "0.8.3";
version = "0.8.4";
src = fetchFromGitHub {
owner = "grouzen";
repo = "framework-tool-tui";
tag = "v${finalAttrs.version}";
hash = "sha256-LNGfjDRJ6sGLBfnANzrLWUFB0ZPDVPLaw7powdsC43I=";
hash = "sha256-IZq2amZYQJxt9ojZfjgrj303vdh+NAKg6fmd2TZa4q8=";
};
cargoHash = "sha256-ERyVdowVf7bFyupAuCKCgih9M0K/ThKjBJ2TEjbPqD4=";
cargoHash = "sha256-jd6M7tq4BTAsETimFsSmX1KLz7G+wTloBFmq4V8svRg=";
nativeBuildInputs = [ pkg-config ];
buildInputs = [ udev ];

6
pkgs/by-name/fr/frankenphp/package.nix
View File

@@ -30,13 +30,13 @@ let
in
buildGoModule (finalAttrs: {
pname = "frankenphp";
version = "1.12.4";
version = "1.12.5";
src = fetchFromGitHub {
owner = "php";
repo = "frankenphp";
tag = "v${finalAttrs.version}";
hash = "sha256-DzncOAhdDyc5qOipMI8OPss0WciAQIam6GmaUoe8mR8=";
hash = "sha256-1f+3w9x6P1euUZr4hC4jOkgEJEbS/MJ11u+chGShCno=";
};
sourceRoot = "${finalAttrs.src.name}/caddy";
@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
# frankenphp requires C code that would be removed with `go mod tidy`
# https://github.com/golang/go/issues/26366
proxyVendor = true;
vendorHash = "sha256-XY5a8pd5vJ/ouZMASzVqPoeXVfPbnEVDJFKkVNQF+2M=";
vendorHash = "sha256-d6ZTi1Ihu011eKVdHMiW9oSdPB4SYpDHMFxH65XLGac=";
buildInputs = [
phpUnwrapped

9
pkgs/by-name/gc/gclient2nix/gclient2nix.py
View File

@@ -60,7 +60,14 @@ class Repo:
)
deps_file = self.get_file("DEPS")
evaluated = gclient_eval.Parse(deps_file, vars_override=repo_vars, filename="DEPS")
evaluated = gclient_eval.Parse(
deps_file,
filename="DEPS",
vars_override=repo_vars,
# KeyError: "host_cpu was used as a variable, but was not declared in the vars dict (file 'DEPS', line 114)"
# https://chromium.googlesource.com/webpagereplay.git/+/b2b856131e36c99e9de9c419fe8ca02f857082ba/DEPS#114
builtin_vars= {"host_cpu": "*host_cpu_placeholder*"} if path == "src/third_party/webpagereplay" else None,
)
repo_vars = dict(evaluated.get("vars", {})) | repo_vars

4
pkgs/by-name/gc/gclient2nix/package.nix
View File

@@ -68,8 +68,8 @@ runCommand "gclient2nix"
# substitutions
depot_tools_checkout = fetchgit {
url = "https://chromium.googlesource.com/chromium/tools/depot_tools";
rev = "977d597d75def6781f890cdce459969a9568ea07";
hash = "sha256-OCIay+a+DHvKKIbDMSjTf6CbHHVfp8k0n1AO3E4yx1U=";
rev = "1b1b01fa912786b88a79f3504176a275183839b5";
hash = "sha256-SRPeosetXYUklafhcuqsJiIKfItUJACG70m4Z5pBQiU=";
};
passthru = {

22
pkgs/by-name/ge/gecode/package.nix
View File

@@ -2,8 +2,8 @@
lib,
stdenv,
fetchFromGitHub,
fetchpatch,
bison,
cmake,
flex,
perl,
gmp,
@@ -12,30 +12,22 @@
enableGist ? true,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "gecode";
version = "6.2.0";
version = "6.4.0";
src = fetchFromGitHub {
owner = "Gecode";
repo = "gecode";
rev = "release-${version}";
sha256 = "0b1cq0c810j1xr2x9y9996p894571sdxng5h74py17c6nr8c6dmk";
tag = "release-${finalAttrs.version}";
hash = "sha256-WhMN7QC+VQfvHUV1LLaW7I7fG++/fznh1ZDUY/Q8zD8=";
};
patches = [
# https://github.com/Gecode/gecode/pull/74
(fetchpatch {
name = "fix-const-weights-clang.patch";
url = "https://github.com/Gecode/gecode/commit/c810c96b1ce5d3692e93439f76c4fa7d3daf9fbb.patch";
sha256 = "0270msm22q5g5sqbdh8kmrihlxnnxqrxszk9a49hdxd72736p4fc";
})
];
enableParallelBuilding = true;
dontWrapQtApps = true;
nativeBuildInputs = [
bison
cmake
flex
];
buildInputs = [
@@ -52,4 +44,4 @@ stdenv.mkDerivation rec {
platforms = lib.platforms.all;
maintainers = [ ];
};
}
})

4
pkgs/by-name/gi/gitaly/package.nix
View File

@@ -7,7 +7,7 @@
}:
let
version = "18.11.6";
version = "18.11.7";
package_version = "v${lib.versions.major version}";
gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
@@ -21,7 +21,7 @@ let
owner = "gitlab-org";
repo = "gitaly";
rev = "v${version}";
hash = "sha256-fsr8ttV2q2iedTA5yn4iHry92Mgu775K1GW3JBz5N1U=";
hash = "sha256-CupoX+Jv/4JDn50T7KF4+k9dd2bL+1zWd+3BsFIKOM8=";
};
vendorHash = "sha256-/RJnCcmUoqGy08MSGEVM/taV1qZK65kiZw19n6S3ZQ0=";

4
pkgs/by-name/gi/gitlab-pages/package.nix
View File

@@ -6,14 +6,14 @@
buildGoModule (finalAttrs: {
pname = "gitlab-pages";
version = "18.11.6";
version = "18.11.7";
# nixpkgs-update: no auto update
src = fetchFromGitLab {
owner = "gitlab-org";
repo = "gitlab-pages";
rev = "v${finalAttrs.version}";
hash = "sha256-D/AlIXbcgvPyP2TX/lXVYlnG2HXKZlxOhqRTfTXsaew=";
hash = "sha256-AW/zzQiiGz8JBw1c5JAwo2boWKoeD1wx0dUA4nOyARA=";
};
vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";

14
pkgs/by-name/gi/gitlab/data.json
View File

@@ -1,17 +1,17 @@
{
"version": "18.11.6",
"repo_hash": "sha256-bdnBX6M4BtuA03CP/N0teKnuey3V9qHseBoxTIGXE5Q=",
"version": "18.11.7",
"repo_hash": "sha256-LSrdAz4bt5h3Z2V4vlazH5hKoq3LNvoRz02AyUb4Ka4=",
"yarn_hash": "sha256-og09R28lwYvDk4pe7z1dRMaanYiTsUSx+SUKoWc53do=",
"frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
"owner": "gitlab-org",
"repo": "gitlab",
"rev": "v18.11.6-ee",
"rev": "v18.11.7-ee",
"passthru": {
"GITALY_SERVER_VERSION": "18.11.6",
"GITLAB_KAS_VERSION": "18.11.6",
"GITLAB_PAGES_VERSION": "18.11.6",
"GITALY_SERVER_VERSION": "18.11.7",
"GITLAB_KAS_VERSION": "18.11.7",
"GITLAB_PAGES_VERSION": "18.11.7",
"GITLAB_SHELL_VERSION": "14.50.0",
"GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
"GITLAB_WORKHORSE_VERSION": "18.11.6"
"GITLAB_WORKHORSE_VERSION": "18.11.7"
}
}

2
pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
View File

@@ -10,7 +10,7 @@ in
buildGoModule (finalAttrs: {
pname = "gitlab-workhorse";
version = "18.11.6";
version = "18.11.7";
# nixpkgs-update: no auto update
src = fetchFromGitLab {

10
pkgs/by-name/go/google-chrome/package.nix
View File

@@ -179,11 +179,11 @@ let
linux = stdenvNoCC.mkDerivation (finalAttrs: {
inherit pname meta passthru;
version = "150.0.7871.181";
version = "150.0.7871.186";
src = fetchurl {
url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
hash = "sha256-/sUJBfexI1pECXeoM0duAWKHT1ynnlBs30C3GvZNkvQ=";
hash = "sha256-QZPgC21dWWnuY/emlZaGj1RqoOjLB3s+C/nMHixxnQA=";
};
# With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let
darwin = stdenvNoCC.mkDerivation (finalAttrs: {
inherit pname meta passthru;
version = "150.0.7871.182";
version = "150.0.7871.187";
src = fetchurl {
url = "http://dl.google.com/release2/chrome/mb6usb7722qbv5pqtlgpq72utm_150.0.7871.182/GoogleChrome-150.0.7871.182.dmg";
hash = "sha256-eNrCQqKqd+6cuvGDbQ0VM5JpolHusOZou2elsAh0TD4=";
url = "http://dl.google.com/release2/chrome/ecziwrw2etq4lm3vlbpv5wzvce_150.0.7871.187/GoogleChrome-150.0.7871.187.dmg";
hash = "sha256-I1a+wR5zNfOSYyns2ehDek5DP1xccRQvmBLymxB/R7A=";
};
dontPatch = true;

22
pkgs/by-name/go/google-cloud-sdk/cloudsdk-vendored-protobuf-upb.patch Normal file
View File

@@ -0,0 +1,22 @@
diff --git a/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py b/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py
--- a/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py
+++ b/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py
@@ -55,7 +55,7 @@ _implementation_type = 'python'
if _implementation_type is None:
- if _CanImport('google._upb._message'):
+ if _CanImport('cloudsdk.google._upb._message'):
_implementation_type = 'upb'
- elif _CanImport('google.protobuf.pyext._message'):
+ elif _CanImport('cloudsdk.google.protobuf.pyext._message'):
_implementation_type = 'cpp'
else:
_implementation_type = 'python'
@@ -96,7 +96,7 @@ if _implementation_type == 'cpp':
if _implementation_type == 'upb':
try:
# pylint: disable=g-import-not-at-top
- from google._upb import _message
+ from cloudsdk.google._upb import _message
_c_module = _message
del _message
except ImportError:

9
pkgs/by-name/go/google-cloud-sdk/package.nix
View File

@@ -70,6 +70,9 @@ stdenv.mkDerivation rec {
./gcloud-path.patch
# Disable checking for updates for the package
./gsutil-disable-updates.patch
# Cloud SDK vendors protobuf under the cloudsdk.google.protobuf namespace.
# Keep that vendored runtime from loading external google._upb modules.
./cloudsdk-vendored-protobuf-upb.patch
];
installPhase = ''
@@ -184,6 +187,12 @@ stdenv.mkDerivation rec {
# Avoid trying to write logs to homeless-shelter
export HOME=$(mktemp -d)
$out/bin/gcloud version --format json | jq '."Google Cloud SDK"' | grep "${version}"
$out/bin/gcloud storage ls --help > /dev/null
# Exercises generated clients that use Cloud SDK's vendored protobuf. This
# catches regressions where external protobuf/upb is selected instead of the
# vendored pure-Python protobuf implementation.
$out/bin/gcloud kms asymmetric-sign --help > /dev/null
PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=upb $out/bin/gcloud kms asymmetric-sign --help > /dev/null
$out/bin/gsutil version | grep -w "$(cat platform/gsutil/VERSION)"
'';

14
pkgs/by-name/kn/knot-resolver_5/package.nix
View File

@@ -2,7 +2,6 @@
lib,
stdenv,
fetchurl,
fetchpatch,
# native deps.
runCommand,
pkg-config,
@@ -36,11 +35,11 @@ let
unwrapped = stdenv.mkDerivation (finalAttrs: {
pname = "knot-resolver_5";
version = "5.7.6";
version = "5.7.7";
src = fetchurl {
url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-${finalAttrs.version}.tar.xz";
sha256 = "500ccd3a560300e547b8dc5aaff322f7c8e2e7d6f0d7ef5f36e59cb60504d674";
sha256 = "481d2a6eb8690023895d389601e56fffbaeba3cc18cc1de5a5f177df9d0f9530";
};
outputs = [
@@ -48,15 +47,6 @@ let
"dev"
];
patches = [
(fetchpatch {
# https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1772
url = "https://gitlab.nic.cz/knot/knot-resolver/-/commit/f4eaf8e69cc9839f68b613d0be10103e05c57fe9.patch";
hash = "sha256-u/YQ85Jb5OxV8G3HeVPQUw0cmA+TLIDPze9mreqJGL4=";
excludes = [ "daemon/ratelimiting.test/tests.inc.c" ];
})
];
# Path fixups for the NixOS service.
postPatch = ''
patch meson.build <<EOF

4
pkgs/by-name/kn/knot-resolver_6/package.nix
View File

@@ -36,11 +36,11 @@ let
# TODO: we could cut the `let` short here, but it would de-indent everything.
unwrapped = stdenv.mkDerivation (finalAttrs: {
pname = "knot-resolver_6";
version = "6.4.0";
version = "6.4.1";
src = fetchurl {
url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-${finalAttrs.version}.tar.xz";
hash = "sha256-T0v+CfjXOw7n1nDdHJD18qwOkGD5sUeDVfJvJzdGrIA=";
hash = "sha256-GqTClyHAm86amfPVZXIjEQNj1ms1ytSYm5Wyr9qTeag=";
};
outputs = [

6
pkgs/by-name/li/libsignal-ffi/package.nix
View File

@@ -13,14 +13,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
pname = "libsignal-ffi";
# must match the version used in mautrix-signal
# see https://github.com/mautrix/signal/issues/401
version = "0.94.4";
version = "0.97.2";
src = fetchFromGitHub {
fetchSubmodules = true;
owner = "signalapp";
repo = "libsignal";
tag = "v${finalAttrs.version}";
hash = "sha256-Uh/j8cXUWgWgSo9UBfYOFuC8i+2YdMwGHcXf55PkGgU=";
hash = "sha256-p9NIt+n7MTsYWAFS+FOuSGMJUZi8rBlTb6ATgVJ+uU8=";
};
postPatch =
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
};
cargoHash = "sha256-st6zTKvxSsyMce22E8nFsJMGjQkk9sEAzSCmyZP8x20=";
cargoHash = "sha256-JtNGubDMrUINCCiawrAW63L1trcBCAIibFpojK8mzhc=";
cargoBuildFlags = [
"-p"

2
pkgs/by-name/li/listmonk/email-builder.nix
View File

@@ -17,7 +17,7 @@ stdenv.mkDerivation {
offlineCache = fetchYarnDeps {
yarnLock = "${src}/frontend/email-builder/yarn.lock";
hash = "sha256-sFRmnMPStNp45hxcF+Iq1WhH6LtVFtgq2regq6MPzcc=";
hash = "sha256-ANPLOL9j0gljtNtbfb+ZifVRN9vLexPddAevpeFwX4o=";
};
nativeBuildInputs = [

2
pkgs/by-name/li/listmonk/frontend.nix
View File

@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
offlineCache = fetchYarnDeps {
yarnLock = "${src}/frontend/yarn.lock";
hash = "sha256-VCaEMftA7AzW/6jyceVO596iby0wC3LW9YDG66kLJmw=";
hash = "sha256-R2xHcHksTtFfFh41FLeBhpuz84ceixGt6oz6SQWWyMQ=";
};
nativeBuildInputs = [

6
pkgs/by-name/li/listmonk/package.nix
View File

@@ -11,16 +11,16 @@
buildGoModule (finalAttrs: {
pname = "listmonk";
version = "6.1.0";
version = "6.2.0";
src = fetchFromGitHub {
owner = "knadh";
repo = "listmonk";
rev = "v${finalAttrs.version}";
hash = "sha256-SG9PhQOu3QB0LA9dNLnNzwwtfaib7MCfvOcBMkWMRPw=";
hash = "sha256-yLOs1vhTV/0zzq/2Rk5rJ3/1z+kE5xaYODM5NO06F6U=";
};
vendorHash = "sha256-0KrjaExgT9tN4M99CfyQpqpGYnXOpzsPRk/Ih4qXsuE=";
vendorHash = "sha256-t4l8872bniTmNIW4ias1gImURJgrR6htXkncqfrJ+AU=";
nativeBuildInputs = [
stuffbin

4
pkgs/by-name/ma/mapserver/package.nix
View File

@@ -30,13 +30,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "mapserver";
version = "8.6.4";
version = "8.6.5";
src = fetchFromGitHub {
owner = "MapServer";
repo = "MapServer";
rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
hash = "sha256-kqCP0QZ8gNqS54B8nL8M9Wr9WyMQnORCs42O1eiMtRw=";
hash = "sha256-HEQ+bBb6cXXqR+4Yw5H+3xwQMQvlv0LjlBRT0baFeZQ=";
};
nativeBuildInputs = [

6
pkgs/by-name/ma/markdown-code-runner/package.nix
View File

@@ -8,16 +8,16 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "markdown-code-runner";
version = "0.5.1";
version = "0.5.2";
src = fetchFromGitHub {
owner = "drupol";
repo = "markdown-code-runner";
tag = finalAttrs.version;
hash = "sha256-GcPMkwXwLyHoVljOpfnhmysDYIFXSyvNL5P3f6q/KJw=";
hash = "sha256-xToBnuWjjh1Zle6lcWdYWO9iDhSJh1cbOOEr9p0n1vU=";
};
cargoHash = "sha256-ul5cl6FDYkW02HGtQmLHkOsSaTIn2lCaTpKjCUzdcjM=";
cargoHash = "sha256-tGEXJMlrxIBCzWVgOfcDNHq2Zli0mJVaOMdmwP9GhCk=";
dontUseCargoParallelTests = true;

8
pkgs/by-name/ma/matrix-authentication-service/package.nix
View File

@@ -20,21 +20,21 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "matrix-authentication-service";
version = "1.20.0";
version = "1.21.0";
src = fetchFromGitHub {
owner = "element-hq";
repo = "matrix-authentication-service";
tag = "v${finalAttrs.version}";
hash = "sha256-0fvGhBxwXhSzWvNhflreEFoCBycM10vMkMf4sj95vfY=";
hash = "sha256-4z+u1IM2pclccv9+IH8IWjCodDxWZmffbqWPC726sIg=";
};
cargoHash = "sha256-3V50qNvg24WZvQ9z7IZJAnPXHTibZ6o3EzUoinLU6Gw=";
cargoHash = "sha256-HQU0zaK7rLJnTX5WVZrqNEaT5HfFLDzs+pHRxx5XTaA=";
pnpmDeps = fetchPnpmDeps {
inherit (finalAttrs) pname version src;
fetcherVersion = 4;
hash = "sha256-j2A2VCKQPfoyrNDtazu8hzUHpS130Ju/Cy3yfu9tC5I=";
hash = "sha256-9a62WlBQW8lgXluMh+DM21CkFCqFYd7yUz220G1uTIY=";
};
pnpmRoot = "frontend";

8
pkgs/by-name/ma/mautrix-signal/package.nix
View File

@@ -20,14 +20,14 @@ let
in
buildGoModule rec {
pname = "mautrix-signal";
version = "26.06";
tag = "v0.2606.0";
version = "26.07";
tag = "v0.2607.0";
src = fetchFromGitHub {
owner = "mautrix";
repo = "signal";
inherit tag;
hash = "sha256-DSOf6kyNcsknwKM77vUQs6pWX8hMo4mU9dOGai62QR0=";
hash = "sha256-l6IIL2bClC6t5+P0/AkFIjkD/eDpQnnmA8x4i5ROaY4=";
};
buildInputs =
@@ -46,7 +46,7 @@ buildGoModule rec {
CGO_LDFLAGS = toString [ cppStdLib ];
};
vendorHash = "sha256-e9Et97QEn12kkiqrQTaDtwECLhwvxwDUF6IcWoL/+Mg=";
vendorHash = "sha256-0ifGza94s4+ED5OrlrqoDKIDZIYJWJhB2q3LJRpKiJs=";
ldflags = [
"-X"

8
pkgs/by-name/ma/mautrix-whatsapp/package.nix
View File

@@ -14,20 +14,20 @@
buildGoModule rec {
pname = "mautrix-whatsapp";
version = "26.06";
tag = "v0.2606.0";
version = "26.07";
tag = "v0.2607.0";
src = fetchFromGitHub {
owner = "mautrix";
repo = "whatsapp";
inherit tag;
hash = "sha256-xxUsFrBX6wwANKECwL6ITDkc88XpCyGpWDPjGQlH3fI=";
hash = "sha256-cl3nJY9ui9J9fE9T1hBUV/o8lH0usrsUcpj9OwXxgtY=";
};
buildInputs = lib.optional (!withGoolm) olm;
tags = lib.optional withGoolm "goolm";
vendorHash = "sha256-H8dSwOPVJ3TofAJDupYhX6/Vm5qshhFXaMtUDWM/0mw=";
vendorHash = "sha256-fVs5su6UkjvQEkoWJH6WL1FCZNdwj0jzrjfpbWOHWDU=";
ldflags = [
"-s"

16
pkgs/by-name/mi/minizinc/package.nix
View File

@@ -13,22 +13,6 @@
zlib,
}:
let
gecode_6_3_0 = gecode.overrideAttrs (_: {
version = "6.3.0";
src = fetchFromGitHub {
owner = "gecode";
repo = "gecode";
rev = "f7f0d7c273d6844698f01cec8229ebe0b66a016a";
hash = "sha256-skf2JEtNkRqEwfHb44WjDGedSygxVuqUixskTozi/5k=";
};
patches = [ ];
});
in
let
gecode = gecode_6_3_0;
in
stdenv.mkDerivation (finalAttrs: {
pname = "minizinc";
version = "2.9.7";

8
pkgs/by-name/mo/mochi/package.nix
View File

@@ -12,14 +12,14 @@
let
pname = "mochi";
version = "1.21.16";
version = "1.21.17";
linux = appimageTools.wrapType2 rec {
inherit pname version meta;
src = fetchurl {
url = "https://download.mochi.cards/releases/Mochi-${version}.AppImage";
hash = "sha256-LWwv/+2/djc2bdqhnJiG5etXg+MFaEZbpttewVBZdeg=";
hash = "sha256-QYBh9ZvmJse3ZimvpU+9ky6ml0pCSZ3mVrYtWtMQGA0=";
};
appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -44,9 +44,9 @@ let
url = "https://download.mochi.cards/releases/Mochi-${version}${lib.optionalString stdenv.hostPlatform.isAarch64 "-arm64"}.dmg";
hash =
if stdenv.hostPlatform.isAarch64 then
"sha256-dtdQZYGrukT/UgfNdsnGxOYmpuebJCDHXW8cAGN2GZE="
"sha256-2NADaVzkibWjxBymeF1McGEQH6xHaqDMBg080kCI0F8="
else
"sha256-FdNFpuIOMgRzniB9Aze3GUpNY27h++StTdwqfF1k07I=";
"sha256-XM4vQVQ9QtvqyDu2Wx/8/Z+8H2DetfCufJYrX/1JHFw=";
};
sourceRoot = ".";

2
pkgs/by-name/pr/proton-pass-cli/package.nix
View File

@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
meta = {
description = "Command-line interface for managing your Proton Pass vaults, items, and secrets";
homepage = "https://github.com/protonpass/pass-cli";
license = lib.licenses.unfree;
license = lib.licenses.gpl3Plus;
mainProgram = "pass-cli";
maintainers = with lib.maintainers; [ delafthi ];
platforms = lib.attrNames finalAttrs.passthru.sources;

4
pkgs/by-name/pr/protozero/package.nix
View File

@@ -7,13 +7,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "protozero";
version = "1.8.1";
version = "1.8.2";
src = fetchFromGitHub {
owner = "mapbox";
repo = "protozero";
tag = "v${finalAttrs.version}";
hash = "sha256-69GEAz6wSGMGozsWS9xmoTgyH8mTuDM9mUTCXfVI6f8=";
hash = "sha256-pqRlSrCPBybKzKfXClGEIa8Pd1vS5vTpjIDhmz5UhYE=";
};
nativeBuildInputs = [ cmake ];

6
pkgs/by-name/ru/rustywind/package.nix
View File

@@ -8,16 +8,16 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "rustywind";
version = "0.25.2";
version = "0.26.0";
src = fetchFromGitHub {
owner = "avencera";
repo = "rustywind";
tag = "v${finalAttrs.version}";
hash = "sha256-PeYKBLTQ7/fmNuWtIQiqC47omrdGuIlB55OPxBQJQiM=";
hash = "sha256-uxgp8cwOswrhDLtx5ZAxsdy96/+UjYhzNKwvt0DBmhk=";
};
cargoHash = "sha256-76gC+nw/eV4j68O74XsJDaDFYAEdqZB9EzsRj5vdOvs=";
cargoHash = "sha256-W5dPMSkihxWryLEpQhqt9IpiwyAYSsIgQLbwjnXVjEk=";
doInstallCheck = true;
nativeInstallCheckInputs = [ versionCheckHook ];

6
pkgs/by-name/yo/youtrack/package.nix
View File

@@ -10,15 +10,15 @@
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "youtrack";
version = "2026.2.17012";
version = "2026.2.17765";
src = dockerTools.exportImage {
diskSize = 8192;
fromImage = dockerTools.pullImage {
imageName = "jetbrains/youtrack";
arch = "amd64";
imageDigest = "sha256:fa50e2e07435dc91461c00ef05ee064ff76748d4d8feaf8aeaa9f9e4a9bf6606";
hash = "sha256-8hoMtFqG5T4gnMDorIe6UXs/d3z7epAS352reipPjWI=";
imageDigest = "sha256:54d25c6f100330cc43cc60219846711eed5e598bad11ce3611c42756b5ba197a";
hash = "sha256-009ZLutj1fv8gPlRuDB+vI3sosIRBg6r87o69aW0v5s=";
};
};
unpackPhase = ''

48
pkgs/by-name/zi/ziglint/package.nix Normal file
View File

@@ -0,0 +1,48 @@
{
lib,
stdenv,
fetchFromGitHub,
zig_0_16,
versionCheckHook,
}:
let
zig = zig_0_16;
in
stdenv.mkDerivation (finalAttrs: {
pname = "ziglint";
version = "0.5.3";
src = fetchFromGitHub {
owner = "rockorager";
repo = "ziglint";
tag = "v${finalAttrs.version}";
hash = "sha256-kLcUIFMDJHuCA0rn3l5a3h/E6TUwNWA5mWRADCDB1cw=";
};
postPatch = ''
substituteInPlace build.zig \
--replace-fail "getVersion(b)" '"${finalAttrs.version}"'
'';
nativeBuildInputs = [ zig.hook ];
strictDeps = true;
__structuredAttrs = true;
doCheck = true;
doInstallCheck = true;
nativeInstallCheckInputs = [ versionCheckHook ];
meta = {
homepage = "https://github.com/rockorager/ziglint";
description = "Linter for Zig source code";
changelog = "https://github.com/rockorager/ziglint/releases/tag/v${finalAttrs.version}";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ xqtc161 ];
mainProgram = "ziglint";
inherit (zig.meta) platforms;
};
})

4
pkgs/development/compilers/openjdk/17/source.json
View File

@@ -1,6 +1,6 @@
{
"hash": "sha256-Szed0lCe3parouN7VjBrKY7FcocyIuA4umuDqurbM4Y=",
"hash": "sha256-0cmzR5KZY6q+ZhoF90HkiIqHJsEdMeLOt4bmV8ID5so=",
"owner": "openjdk",
"repo": "jdk17u",
"rev": "refs/tags/jdk-17.0.20+2"
"rev": "refs/tags/jdk-17.0.20+8"
}

4
pkgs/development/compilers/openjdk/25/source.json
View File

@@ -1,6 +1,6 @@
{
"hash": "sha256-A5TWx/HDFlx46VAgPmkanwcZeBeSwtgGCD90mmUu4Vc=",
"hash": "sha256-/42TUyZnw8LVOuUnupVFBkqsT5IIeTw9/WNQ0eCfQRQ=",
"owner": "openjdk",
"repo": "jdk25u",
"rev": "refs/tags/jdk-25.0.4+1"
"rev": "refs/tags/jdk-25.0.4+7"
}

4
pkgs/development/compilers/openjdk/8/source.json
View File

@@ -1,6 +1,6 @@
{
"hash": "sha256-c86eD79qxAHswjSi+GTPPkyRAz8PRA2w+eBLRMazUik=",
"hash": "sha256-7sbEwNSd0SNdsfWREU6EIk+/9UMlZfWYEv+UQ6iJ3VI=",
"owner": "openjdk",
"repo": "jdk8u",
"rev": "refs/tags/jdk8u502-b01"
"rev": "refs/tags/jdk8u502-b07"
}

4
pkgs/development/python-modules/osmnx/default.nix
View File

@@ -20,14 +20,14 @@
buildPythonPackage rec {
pname = "osmnx";
version = "2.1.0";
version = "2.1.1";
pyproject = true;
src = fetchFromGitHub {
owner = "gboeing";
repo = "osmnx";
tag = "v${version}";
hash = "sha256-3uLgc6zptmXlPg93qtsWbqNxXiBD/SEnXBL/IM/1m2c=";
hash = "sha256-PX4Vhf3R9UGKMYp636+tJ5NV/oURd3Zzxfvj7LLCaPM=";
};
build-system = [ uv-build ];

153
pkgs/development/python-modules/stanza/GHSA-2fwf-f686-7p34.patch Normal file
View File

@@ -0,0 +1,153 @@
From 3260967d7fdeeec7dd99f057ae8103e0b89844a5 Mon Sep 17 00:00:00 2001
From: John Bauer <horatio@gmail.com>
Date: Sat, 20 Jun 2026 15:43:05 -0700
Subject: [PATCH 1/3] Fix a possible 'zip slip' attack - frankly unlikely given
that we control the resources being downloaded, but worth protecting against.
See
https://github.com/stanfordnlp/stanza/security/advisories/GHSA-2fwf-f686-7p34
---
stanza/resources/common.py | 18 ++++++
stanza/tests/resources/test_common.py | 87 +++++++++++++++++++++++++++
2 files changed, 105 insertions(+)
diff --git a/stanza/resources/common.py b/stanza/resources/common.py
index 5c73c10e..beeec041 100644
--- a/stanza/resources/common.py
+++ b/stanza/resources/common.py
@@ -79,12 +79,30 @@ def get_md5(path):
raise
return hashlib.md5(data).hexdigest()
+def _is_within_directory(directory, target):
+ """
+ Check that `target` resolves to a path inside `directory`.
+ """
+ directory = os.path.realpath(directory)
+ target = os.path.realpath(target)
+ return os.path.commonpath([directory]) == os.path.commonpath([directory, target])
+
def unzip(path, filename):
"""
Fully unzip a file `filename` that's in a directory `dir`.
+
+ Before unzipping, paths are checked so that a 'zip slip' error cannot happen.
+ See https://github.com/stanfordnlp/stanza/security/advisories/GHSA-2fwf-f686-7p34
"""
logger.debug(f'Unzip: {path}/{filename}...')
with zipfile.ZipFile(os.path.join(path, filename)) as f:
+ for member in f.namelist():
+ member_path = os.path.join(path, member)
+ if not _is_within_directory(path, member_path):
+ raise ValueError(
+ f"Zip file {filename} contains an entry that would extract "
+ f"outside of the target directory: {member}"
+ )
f.extractall(path)
def get_root_from_zipfile(filename):
diff --git a/stanza/tests/resources/test_common.py b/stanza/tests/resources/test_common.py
index 75fed45d..ae577451 100644
--- a/stanza/tests/resources/test_common.py
+++ b/stanza/tests/resources/test_common.py
@@ -6,6 +6,7 @@ import logging
import os
import pytest
import tempfile
+import zipfile
import stanza
from stanza.resources import common
@@ -155,3 +156,89 @@ def test_download_restores_logging_level(tmp_path, monkeypatch):
assert stanza.logger.level == logging.WARNING, (
f"Expected WARNING ({logging.WARNING}) after download, got {stanza.logger.level}"
)
+
+
+def _make_malicious_zip(zip_path, member_name, content=b"pwned"):
+ """
+ Build a zip file containing a single entry whose name is `member_name`.
+
+ zipfile.ZipFile.write() would normalize a path like this, so we use
+ writestr() with an explicit ZipInfo, which does not sanitize the name -
+ this mirrors what a maliciously crafted zip looks like on disk.
+ """
+ with zipfile.ZipFile(zip_path, "w") as zf:
+ zf.writestr(zipfile.ZipInfo(member_name), content)
+
+
+def test_unzip_blocks_relative_traversal():
+ """
+ A zip entry like "../../evil.txt" should not be extracted outside
+ the target directory.
+ """
+ with tempfile.TemporaryDirectory(dir=TEST_WORKING_DIR) as test_dir:
+ target_dir = os.path.join(test_dir, "target")
+ os.makedirs(target_dir)
+ zip_path = os.path.join(target_dir, "evil.zip")
+ _make_malicious_zip(zip_path, "../../evil.txt")
+
+ with pytest.raises(ValueError):
+ common.unzip(target_dir, "evil.zip")
+
+ # nothing should have escaped onto disk outside test_dir
+ assert not os.path.exists(os.path.join(test_dir, "..", "evil.txt"))
+ escaped_path = os.path.normpath(os.path.join(target_dir, "..", "..", "evil.txt"))
+ assert not os.path.exists(escaped_path)
+
+
+def test_unzip_blocks_nested_traversal():
+ """
+ Traversal hidden a few directories deep, e.g. "subdir/../../../evil.txt",
+ should also be rejected.
+ """
+ with tempfile.TemporaryDirectory(dir=TEST_WORKING_DIR) as test_dir:
+ target_dir = os.path.join(test_dir, "target")
+ os.makedirs(target_dir)
+ zip_path = os.path.join(target_dir, "evil.zip")
+ _make_malicious_zip(zip_path, "subdir/../../../evil.txt")
+
+ with pytest.raises(ValueError):
+ common.unzip(target_dir, "evil.zip")
+
+
+def test_unzip_blocks_absolute_path():
+ """
+ A zip entry with an absolute path should not be written to that
+ absolute location.
+ """
+ with tempfile.TemporaryDirectory(dir=TEST_WORKING_DIR) as test_dir:
+ target_dir = os.path.join(test_dir, "target")
+ os.makedirs(target_dir)
+ zip_path = os.path.join(target_dir, "evil.zip")
+
+ # a path well outside any plausible target dir
+ absolute_evil = os.path.join(tempfile.gettempdir(), "stanza_test_evil_absolute.txt")
+ _make_malicious_zip(zip_path, absolute_evil)
+
+ with pytest.raises(ValueError):
+ common.unzip(target_dir, "evil.zip")
+
+ assert not os.path.exists(absolute_evil)
+
+
+def test_unzip_allows_well_formed_zip():
+ """
+ Sanity check: a normal zip with safe relative paths should still
+ extract correctly after the path-safety check is added.
+ """
+ with tempfile.TemporaryDirectory(dir=TEST_WORKING_DIR) as test_dir:
+ target_dir = os.path.join(test_dir, "target")
+ os.makedirs(target_dir)
+ zip_path = os.path.join(target_dir, "good.zip")
+ with zipfile.ZipFile(zip_path, "w") as zf:
+ zf.writestr("models/default.pt", b"fake model data")
+ zf.writestr("readme.txt", b"safe content")
+
+ common.unzip(target_dir, "good.zip")
+
+ assert os.path.exists(os.path.join(target_dir, "models", "default.pt"))
+ assert os.path.exists(os.path.join(target_dir, "readme.txt"))
--
2.54.0

61
pkgs/development/python-modules/stanza/GHSA-487q-m798-cp85.patch Normal file
View File

@@ -0,0 +1,61 @@
From 3b7622351afdd1552c69f717da6a02b1dabb9de1 Mon Sep 17 00:00:00 2001
From: John Bauer <horatio@gmail.com>
Date: Thu, 25 Jun 2026 12:07:44 -0700
Subject: [PATCH 3/3] Multi-step mitigation of pickle security issue -
https://github.com/stanfordnlp/stanza/security/advisories/GHSA-487q-m798-cp85
- in this change, we make the unpickler heavily restricted. Future releases
will remove this altogether
(Also, no need to deserialize twice)
---
stanza/models/common/doc.py | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/stanza/models/common/doc.py b/stanza/models/common/doc.py
index 00937171..4543ca18 100644
--- a/stanza/models/common/doc.py
+++ b/stanza/models/common/doc.py
@@ -64,6 +64,22 @@ class DocJSONEncoder(json.JSONEncoder):
return obj.to_json()
return json.JSONEncoder.default(self, obj)
+class RestrictedUnpickler(pickle.Unpickler):
+ # Stanza Document serialization only ever produces tuples, lists, dicts,
+ # and scalar primitives. No custom classes are needed.
+ SAFE_CLASSES = frozenset({
+ ('builtins', 'tuple'),
+ ('builtins', 'list'),
+ ('builtins', 'dict'),
+ })
+
+ def find_class(self, module, name):
+ if (module, name) not in self.SAFE_CLASSES:
+ raise pickle.UnpicklingError(
+ f"Blocked unsafe global: {module}.{name}"
+ )
+ return super().find_class(module, name)
+
class Document(StanzaObject):
""" A document class that stores attributes of a document and carries a list of sentences.
"""
@@ -540,14 +556,14 @@ class Document(StanzaObject):
def from_serialized(cls, serialized_string):
""" Create and initialize a new document from a serialized string generated by Document.to_serialized_string():
"""
- stuff = pickle.loads(serialized_string)
+ stuff = RestrictedUnpickler(io.BytesIO(serialized_string)).load()
if not isinstance(stuff, tuple):
raise TypeError("Serialized data was not a tuple when building a Document")
if len(stuff) == 2:
- text, sentences = pickle.loads(serialized_string)
+ text, sentences = stuff
doc = cls(sentences, text)
else:
- text, sentences, comments = pickle.loads(serialized_string)
+ text, sentences, comments = stuff
doc = cls(sentences, text, comments)
return doc
--
2.54.0

399
pkgs/development/python-modules/stanza/GHSA-c9h2-qmqw-qf6h.patch Normal file
View File

@@ -0,0 +1,399 @@
From 7233600b1bd6897014df3e5fc66655408453f965 Mon Sep 17 00:00:00 2001
From: John Bauer <horatio@gmail.com>
Date: Sat, 20 Jun 2026 22:49:02 -0700
Subject: [PATCH 2/3] From Claude - remove most of the subprocess calls. The
only remaining one is for estimating the size of xz files, has a fallback if
xz is not available, and is not a security hole with the way it is written.
Addresses
https://github.com/stanfordnlp/stanza/security/advisories/GHSA-c9h2-qmqw-qf6h
Although it is worth pointing out that since this script will only be used
with user controlled input files, this is only a theoretical security hole,
and the more significant improvement is making this portable to Windows.
---
stanza/utils/charlm/make_lm_data.py | 316 ++++++++++++++++++++++++----
1 file changed, 272 insertions(+), 44 deletions(-)
diff --git a/stanza/utils/charlm/make_lm_data.py b/stanza/utils/charlm/make_lm_data.py
index 4bd28e5a..e6d8d1aa 100644
--- a/stanza/utils/charlm/make_lm_data.py
+++ b/stanza/utils/charlm/make_lm_data.py
@@ -15,12 +15,48 @@ Args:
- tgt_root: root directory of the target.
- langs: a list of language codes to process; if specified, languages not in this list will be ignored.
Note: edit the {EXCLUDED_FOLDERS} variable to exclude more folders in the source directory.
+
+Implementation note (shuffle/split):
+ Earlier versions of this script shelled out to `cat`, `xzcat`, `zcat`, `shuf`, and `split` via
+ subprocess(shell=True). This relied on filenames never containing shell metacharacters, and did
+ not work on Windows (no shuf/split/xzcat there). This version avoids the shell entirely and
+ instead does a two pass bucket shuffle:
+
+ Pass 1: every source file (decompressed on the fly if .gz / .xz) is streamed line by line, and
+ each line is assigned uniformly at random to one of N bucket files, where N is the same
+ as the eventual number of train shards. This scatters every source file's content
+ proportionally across every bucket, which matters when there are few, large source files
+ (e.g. one big Wikipedia dump and one big Common Crawl dump) -- without this step, naive
+ chunked reading would put long runs of a single source into a single shard, badly skewing
+ dev/test (which are just the first couple of shards). Pass 1 only ever needs N file
+ handles open for writing plus one for reading, so it stays well under OS fd limits
+ regardless of how many source files there are (we've seen 400+ for some languages).
+ Pass 2: each bucket (already approximately shard-sized by construction) is read fully into memory,
+ shuffled locally with random.shuffle, and written out as the corresponding final shard.
+ Because every bucket already contains a proportional mix of all source files, every shard
+ -- including dev/test -- ends up with the same source mixture as the corpus as a whole.
+
+ This trades one extra streaming read+write pass for: no shell dependency, Windows compatibility, and
+ (with the bucket-then-local-shuffle approach) better dev/test distributional properties than a purely
+ local chunk shuffle would give when source files are few and large.
+
+ One narrow subprocess use remains, deliberately: estimating a target bucket/shard count for .xz
+ *source* files shells out to `xz --robot -l path` (list form, no shell=True, so still safe
+ regardless of filename contents) to read the file's size index in O(1) without a full
+ decompression pass. This is only used to size pass 1 -- not load-bearing for correctness -- and
+ falls back to on-disk size (an underestimate for compressed files, which just makes shards a bit
+ larger than split_size) if the xz binary isn't available. Final .xz compression of output files
+ uses the stdlib lzma module instead (pure Python, no subprocess, no xz binary dependency) --
+ single threaded, so slower than `xz -T0` on multi-core machines for very large files, but that
+ tradeoff was preferred over a multiprocessing-based parallel compressor for now.
"""
import argparse
-import glob
+import gzip
+import lzma
import os
from pathlib import Path
+import random
import shutil
import subprocess
import tempfile
@@ -29,6 +65,11 @@ from tqdm import tqdm
EXCLUDED_FOLDERS = ['raw_corpus']
+# Read/write files in fixed-size text chunks to keep streaming I/O fast without
+# loading whole files into memory.
+IO_CHUNK_LINES = 8192
+
+
def main():
parser = argparse.ArgumentParser()
parser.add_argument("src_root", default="src", help="Root directory with all source files. Expected structure is root dir -> language dirs -> package dirs -> text files to process")
@@ -38,6 +79,8 @@ def main():
parser.add_argument("--no_xz_output", default=True, dest="xz_output", action="store_false", help="Output compressed xz files")
parser.add_argument("--split_size", default=50, type=int, help="How large to make each split, in MB")
parser.add_argument("--no_make_test_file", default=True, dest="make_test_file", action="store_false", help="Don't save a test file. Honestly, we never even use it. Best for low resource languages where every bit helps")
+ parser.add_argument("--max_open_handles", default=100, type=int, help="Cap on simultaneously open bucket files in pass 1. Mainly relevant if split_size is set very small, producing a huge number of buckets; keep this comfortably under the OS file descriptor limit (ulimit -n).")
+ parser.add_argument("--bucket_compression", default=False, action="store_true", help="Compress intermediate bucket files (pass 1 output) with xz. Saves disk space at the cost of extra CPU; off by default since buckets are temporary and disk is usually cheaper than CPU time.")
args = parser.parse_args()
print("Processing files:")
@@ -86,54 +129,165 @@ def main():
if not os.path.exists(tgt_dir):
os.makedirs(tgt_dir)
print(f"-> Processing {lang}-{dataset_name}")
- prepare_lm_data(src_dir, tgt_dir, lang, dataset_name, args.xz_output, split_size, args.make_test_file)
+ prepare_lm_data(src_dir, tgt_dir, lang, dataset_name, args.xz_output, split_size,
+ args.make_test_file, args.max_open_handles, args.bucket_compression)
print("")
-def prepare_lm_data(src_dir, tgt_dir, lang, dataset_name, compress, split_size, make_test_file):
+
+def open_text_read(path):
+ """
+ Open a .txt / .txt.gz / .txt.xz file for streaming text reading, regardless of compression.
+ """
+ if path.endswith(".txt"):
+ return open(path, "rt", encoding="utf-8", errors="surrogateescape")
+ elif path.endswith(".txt.xz"):
+ return lzma.open(path, "rt", encoding="utf-8", errors="surrogateescape")
+ elif path.endswith(".txt.gz"):
+ return gzip.open(path, "rt", encoding="utf-8", errors="surrogateescape")
+ else:
+ raise AssertionError("should not have found %s" % path)
+
+
+def open_bucket_read(path, compress):
+ if compress:
+ return lzma.open(path + ".xz", "rt", encoding="utf-8", errors="surrogateescape")
+ else:
+ return open(path, "rt", encoding="utf-8", errors="surrogateescape")
+
+
+def get_input_files(src_dir):
+ src_dir = Path(src_dir)
+ input_files = (sorted(src_dir.glob("*.txt")) +
+ sorted(src_dir.glob("*.txt.xz")) +
+ sorted(src_dir.glob("*.txt.gz")))
+ return [str(f) for f in input_files]
+
+
+def compress_file_to_xz(path):
+ """
+ Compress a file to .xz and remove the original, matching the behavior of the `xz` CLI run on
+ a single file (in-place replace: path -> path + ".xz", original deleted). Pure Python via the
+ stdlib lzma module -- single-threaded, so slower than `xz -T0` on multi-core machines for large
+ files, but removes the xz binary as a hard dependency for producing the final deliverable
+ output files. Binary mode + copyfileobj avoids any text encode/decode roundtrip, since we're
+ just recompressing existing bytes, not transforming them.
+ """
+ xz_path = path + ".xz"
+ with open(path, "rb") as fin, lzma.open(xz_path, "wb") as fout:
+ shutil.copyfileobj(fin, fout)
+ os.remove(path)
+
+
+def gzip_uncompressed_size(path):
+ """
+ Gzip files store the uncompressed size mod 2**32 in their trailer (last 4 bytes) -- a O(1)
+ lookup, no decompression needed. The mod-2**32 wraparound means this is only exact for files
+ under 4GB uncompressed; for anything larger it under-reports, which would just make our bucket
+ count estimate low (buckets/shards end up bigger than split_size) -- a soft target miss, not a
+ correctness problem, and per-source-file files over 4GB uncompressed are not the common case
+ for the per-file granularity this script deals with.
+ """
+ import struct
+ with open(path, "rb") as f:
+ f.seek(-4, os.SEEK_END)
+ return struct.unpack("<I", f.read(4))[0]
+
+
+def xz_uncompressed_size(path):
+ """
+ xz files store an index at the end with exact block sizes; `xz -l` reads just that index
+ (O(1), no decompression) and reports the exact uncompressed size. Falls back to on-disk size
+ (an under-estimate) if the xz binary isn't available or parsing fails, since this is only used
+ for the soft bucket-count target, not a correctness-critical value.
+ """
+ try:
+ result = subprocess.run(["xz", "--robot", "-l", path], capture_output=True, text=True, check=True)
+ for line in result.stdout.splitlines():
+ if line.startswith("file\t"):
+ return int(line.split("\t")[4])
+ except (subprocess.CalledProcessError, FileNotFoundError, ValueError, IndexError):
+ pass
+ return os.path.getsize(path)
+
+
+def measure_size_for_bucket_count(input_files):
+ """
+ Estimate the decompressed size of all input files cheaply (no full decompression pass) to
+ decide how many buckets/shards to target. Uses exact O(1) size lookups where the file format
+ supports them (gzip trailer, xz index); falls back to on-disk size for plain .txt (exact) or
+ if a lookup fails (under-estimate, soft target miss only). This only sets the *target* bucket
+ count -- pass 1 measures and reports the true total byte count as a side effect of scattering,
+ which is what the minimum-size sanity check uses.
+ """
+ total_bytes = 0
+ for f in input_files:
+ if f.endswith(".txt"):
+ total_bytes += os.path.getsize(f)
+ elif f.endswith(".txt.gz"):
+ total_bytes += gzip_uncompressed_size(f)
+ elif f.endswith(".txt.xz"):
+ total_bytes += xz_uncompressed_size(f)
+ else:
+ total_bytes += os.path.getsize(f)
+ return total_bytes
+
+
+def prepare_lm_data(src_dir, tgt_dir, lang, dataset_name, compress, split_size, make_test_file,
+ max_open_handles, bucket_compression):
"""
Combine, shuffle and split data into smaller files, following a naming convention.
+
+ Two pass bucket shuffle (see module docstring for rationale):
+ Pass 1: scatter every line from every source file uniformly at random into one of N bucket
+ files (single read pass over the source data), where N is estimated from total
+ input size / split_size. At most max_open_handles bucket files are held open
+ concurrently; remaining buckets are flushed via brief open-append-close.
+ Pass 2: read each bucket fully, shuffle its lines locally, write out as the corresponding
+ final shard. First one or two shards (post shuffle) become dev.txt / test.txt.
"""
assert isinstance(src_dir, Path)
assert isinstance(tgt_dir, Path)
- with tempfile.TemporaryDirectory(dir=tgt_dir) as tempdir:
- tgt_tmp = os.path.join(tempdir, f"{lang}-{dataset_name}.tmp")
- print(f"--> Copying files into {tgt_tmp}...")
- # TODO: we can do this without the shell commands
- input_files = glob.glob(str(src_dir) + '/*.txt') + glob.glob(str(src_dir) + '/*.txt.xz') + glob.glob(str(src_dir) + '/*.txt.gz')
- for src_fn in tqdm(input_files):
- if src_fn.endswith(".txt"):
- cmd = f"cat {src_fn} >> {tgt_tmp}"
- subprocess.run(cmd, shell=True)
- elif src_fn.endswith(".txt.xz"):
- cmd = f"xzcat {src_fn} >> {tgt_tmp}"
- subprocess.run(cmd, shell=True)
- elif src_fn.endswith(".txt.gz"):
- cmd = f"zcat {src_fn} >> {tgt_tmp}"
- subprocess.run(cmd, shell=True)
- else:
- raise AssertionError("should not have found %s" % src_fn)
- tgt_tmp_shuffled = os.path.join(tempdir, f"{lang}-{dataset_name}.tmp.shuffled")
- print(f"--> Shuffling files into {tgt_tmp_shuffled}...")
- cmd = f"cat {tgt_tmp} | shuf > {tgt_tmp_shuffled}"
- result = subprocess.run(cmd, shell=True)
- if result.returncode != 0:
- raise RuntimeError("Failed to shuffle files!")
- size = os.path.getsize(tgt_tmp_shuffled) / 1024 / 1024 / 1024
- print(f"--> Shuffled file size: {size:.4f} GB")
- if size < 0.1:
+ input_files = get_input_files(src_dir)
+ if not input_files:
+ print(f"--> No input files found in {src_dir}, skipping.")
+ return
+
+ on_disk_bytes = measure_size_for_bucket_count(input_files)
+ num_buckets = max(1, round(on_disk_bytes / split_size))
+ print(f"--> On-disk size: {on_disk_bytes/1024/1024/1024:.4f} GB, targeting ~{num_buckets} shard(s)")
+
+ train_dir = tgt_dir / 'train'
+ if not os.path.exists(train_dir):
+ os.makedirs(train_dir)
+
+ with tempfile.TemporaryDirectory(dir=tgt_dir) as tempdir:
+ bucket_paths = [os.path.join(tempdir, f"bucket-{i:04d}.txt") for i in range(num_buckets)]
+
+ print(f"--> Pass 1/2: scattering {len(input_files)} input file(s) across {num_buckets} bucket(s)...")
+ actual_bytes = scatter_into_buckets(input_files, bucket_paths, max_open_handles, bucket_compression)
+ actual_gb = actual_bytes / 1024 / 1024 / 1024
+ print(f"--> Actual decompressed size: {actual_gb:.4f} GB")
+ if actual_gb < 0.1:
raise RuntimeError("Not enough data found to build a charlm. At least 100MB data expected")
- print(f"--> Splitting into smaller files of size {split_size} ...")
- train_dir = tgt_dir / 'train'
- if not os.path.exists(train_dir): # make training dir
- os.makedirs(train_dir)
- cmd = f"split -C {split_size} -a 4 -d --additional-suffix .txt {tgt_tmp_shuffled} {train_dir}/{lang}-{dataset_name}-"
- result = subprocess.run(cmd, shell=True)
- if result.returncode != 0:
- raise RuntimeError("Failed to split files!")
- total = len(glob.glob(f'{train_dir}/*.txt'))
+ print("--> Pass 2/2: shuffling each bucket and writing final shards...")
+ shard_paths = []
+ random.shuffle(bucket_paths) # randomize which bucket becomes shard 0000, 0001, etc.
+ shard_index = 0
+ for bucket_path in tqdm(bucket_paths):
+ lines = read_bucket_lines(bucket_path, bucket_compression)
+ if not lines:
+ continue
+ random.shuffle(lines)
+ shard_path = os.path.join(train_dir, f"{lang}-{dataset_name}-{shard_index:04d}.txt")
+ with open(shard_path, "wt", encoding="utf-8", errors="surrogateescape") as fout:
+ fout.writelines(lines)
+ shard_paths.append(shard_path)
+ shard_index += 1
+
+ total = len(shard_paths)
print(f"--> {total} total files generated.")
if total < 3:
raise RuntimeError("Something went wrong! %d file(s) produced by shuffle and split, expected at least 3" % total)
@@ -142,21 +296,95 @@ def prepare_lm_data(src_dir, tgt_dir, lang, dataset_name, compress, split_size,
test_file = f"{tgt_dir}/test.txt"
if make_test_file:
print("--> Creating dev and test files...")
- shutil.move(f"{train_dir}/{lang}-{dataset_name}-0000.txt", dev_file)
- shutil.move(f"{train_dir}/{lang}-{dataset_name}-0001.txt", test_file)
- txt_files = [dev_file, test_file] + glob.glob(f'{train_dir}/*.txt')
+ shutil.move(shard_paths[0], dev_file)
+ shutil.move(shard_paths[1], test_file)
+ txt_files = [dev_file, test_file] + shard_paths[2:]
else:
print("--> Creating dev file...")
- shutil.move(f"{train_dir}/{lang}-{dataset_name}-0000.txt", dev_file)
- txt_files = [dev_file] + glob.glob(f'{train_dir}/*.txt')
+ shutil.move(shard_paths[0], dev_file)
+ txt_files = [dev_file] + shard_paths[1:]
if compress:
print("--> Compressing files...")
for txt_file in tqdm(txt_files):
- subprocess.run(['xz', txt_file])
+ compress_file_to_xz(txt_file)
print("--> Cleaning up...")
print(f"--> All done for {lang}-{dataset_name}.\n")
+
+def scatter_into_buckets(input_files, bucket_paths, max_open_handles, bucket_compression):
+ """
+ Pass 1: stream every input file exactly once and randomly assign each line to one bucket file.
+
+ Bucket files are always written as plain uncompressed text during this pass (append mode is
+ simple and well-supported for plain files; incrementally appending to an .xz stream is not a
+ well-defined operation, since xz framing isn't designed for that). If bucket_compression is
+ requested, buckets are compressed in a separate pass *after* all scattering is done, when each
+ bucket is finished and will only ever be read once in pass 2 -- at that point compressing it is
+ just a single whole-file xz pass per bucket, no different in spirit from the final shard
+ compression already done elsewhere in this script.
+
+ To bound simultaneously open file descriptors at max_open_handles, we keep in-memory line
+ buffers for every bucket, but only actually hold open OS file handles for up to
+ max_open_handles buckets at a time ("hot" buckets). When a buffer for a "cold" (not currently
+ open) bucket needs to flush, we open it briefly in append mode, write, and close -- this keeps
+ total *concurrently open* handles bounded by max_open_handles + 1 (the source file being read)
+ while still only reading every source file once.
+
+ Returns the total decompressed byte count actually scattered, measured as a side effect of this
+ pass (avoids a separate, redundant decompression pass just to learn the true input size).
+ """
+ num_buckets = len(bucket_paths)
+ buffers = [[] for _ in range(num_buckets)]
+ total_bytes = 0
+
+ # The first max_open_handles buckets stay open for the whole pass; the rest are flushed via
+ # brief open-append-close, which is cheap relative to the cost of re-reading source data.
+ num_hot = min(max_open_handles, num_buckets)
+ hot_handles = [open(bucket_paths[i], "wt", encoding="utf-8", errors="surrogateescape")
+ for i in range(num_hot)]
+
+ def flush(bucket_idx):
+ if not buffers[bucket_idx]:
+ return
+ if bucket_idx < num_hot:
+ hot_handles[bucket_idx].writelines(buffers[bucket_idx])
+ else:
+ with open(bucket_paths[bucket_idx], "at", encoding="utf-8", errors="surrogateescape") as fout:
+ fout.writelines(buffers[bucket_idx])
+ buffers[bucket_idx] = []
+
+ try:
+ for src_fn in tqdm(input_files, desc="scattering source files"):
+ with open_text_read(src_fn) as fin:
+ for line in fin:
+ total_bytes += len(line.encode("utf-8", errors="surrogateescape"))
+ bucket_idx = random.randrange(num_buckets)
+ buffers[bucket_idx].append(line)
+ if len(buffers[bucket_idx]) >= IO_CHUNK_LINES:
+ flush(bucket_idx)
+ for bucket_idx in range(num_buckets):
+ flush(bucket_idx)
+ finally:
+ for fh in hot_handles:
+ fh.close()
+
+ if bucket_compression:
+ print("--> Compressing buckets...")
+ for path in tqdm(bucket_paths):
+ with open(path, "rt", encoding="utf-8", errors="surrogateescape") as fin, \
+ lzma.open(path + ".xz", "wt", encoding="utf-8", errors="surrogateescape") as fout:
+ shutil.copyfileobj(fin, fout)
+ os.remove(path)
+
+ return total_bytes
+
+
+def read_bucket_lines(bucket_path, bucket_compression):
+ with open_bucket_read(bucket_path, bucket_compression) as fin:
+ return fin.readlines()
+
+
if __name__ == "__main__":
main()
--
2.54.0

13
pkgs/development/python-modules/stanza/default.nix
View File

@@ -29,6 +29,19 @@ buildPythonPackage (finalAttrs: {
tag = "v${finalAttrs.version}";
hash = "sha256-hUI8sZDwBK8ZRS9asyDiTqpoIGnGbHeH/Q9i/gasut0=";
};
patches = [
## Backports from 1.14.0
# Rebased because they don't apply directly.
# https://github.com/stanfordnlp/stanza/security/advisories/GHSA-c9h2-qmqw-qf6h
# https://github.com/stanfordnlp/stanza/commit/4ca4b154af05d71a66586ea9d77b8782e19f3c67
./GHSA-2fwf-f686-7p34.patch
# https://github.com/stanfordnlp/stanza/security/advisories/GHSA-487q-m798-cp85
# https://github.com/stanfordnlp/stanza/commit/031ab2e4a350eec3c7e8abc89f37617c4669b361
./GHSA-487q-m798-cp85.patch
# https://github.com/stanfordnlp/stanza/security/advisories/GHSA-2fwf-f686-7p34
# https://github.com/stanfordnlp/stanza/commit/a7085e75abdf35f277754dda472bba4e6819bcbb
./GHSA-c9h2-qmqw-qf6h.patch
];
build-system = [ setuptools ];

4
pkgs/development/python-modules/starsessions/default.nix
View File

@@ -14,14 +14,14 @@
buildPythonPackage rec {
pname = "starsessions";
version = ".2.2.0";
version = "2.2.1";
pyproject = true;
src = fetchFromGitHub {
owner = "alex-oleshkevich";
repo = "starsessions";
tag = "v${version}";
hash = "sha256-CR8eMyYyr+iFf2l1QE0N762LdkxemOayn/s++mBZRqA=";
hash = "sha256-JI044sn6LQI37PvSLdz2dooa3v5qdHmp6DZD0p7VzJU=";
};
build-system = [ poetry-core ];

11
pkgs/development/tools/electron/binary/info.json
View File

@@ -53,5 +53,16 @@
"x86_64-linux": "3a729b020acb04aefac2c9b4b29c65b37dd7126a14a04d1ef29acb256d3edbd1"
},
"version": "42.5.1"
},
"43": {
"hashes": {
"aarch64-darwin": "2ee24f768c41bc2ed9bd580d7797b185dffb550dafca59c2cd08b51965bcda3a",
"aarch64-linux": "78799ae4fdc7969acb152aa0f33f39bd5eaca2de3eafe817a13487b872abe43c",
"armv7l-linux": "1f32ac165dd1d01f1dcb8bfb881503369c7b739dd292034ef61e2ea75b852a2c",
"headers": "1xqgvsj7pq2j5yvg0yxa4l5l276dmj9zlpxmvy2g993bdypxj8zi",
"x86_64-darwin": "c84cd358a6c58ee9d6ce26ced694ab3b750109e9f29145ff5a639db64037f1de",
"x86_64-linux": "be56b5b8451bda585b56e6a6a67757da2cb7ead59f036b6000431a51c0e0c79b"
},
"version": "43.1.0"
}
}

11
pkgs/development/tools/electron/chromedriver/info.json
View File

@@ -53,5 +53,16 @@
"x86_64-linux": "e0db56b8781035a48aae7fefdac311abb8993a7f6e72009e7adfb70926565bf0"
},
"version": "42.5.1"
},
"43": {
"hashes": {
"aarch64-darwin": "733c8fd5b80e761739cc776c1c6777115bd39cf86d825e895d996734ee3f3515",
"aarch64-linux": "7bdc6d18aafb3aa434374998bbfccdd2087b9495745dd134c06e5f74eafa95d5",
"armv7l-linux": "77a395bb4f4046fb43de81e9eac4b3f5d7d0f5911f2262bcd110bfe2ad1f3076",
"headers": "1xqgvsj7pq2j5yvg0yxa4l5l276dmj9zlpxmvy2g993bdypxj8zi",
"x86_64-darwin": "1450a8af80b7d4c66a4b85779090ce80e1e1b52dacef5dd89322a10b07fe4848",
"x86_64-linux": "e946ae6cad7dc279431e841e0bc19ba4e0dc16a82c5a9c1f7c4d9f3925e5b39a"
},
"version": "43.1.0"
}
}

14
pkgs/development/tools/electron/common.nix
View File

@@ -225,16 +225,20 @@ in
allow_runtime_configurable_key_storage = true;
enable_cet_shadow_stack = false;
is_cfi = false;
v8_builtins_profiling_log_file = "";
enable_dangling_raw_ptr_checks = false;
dawn_use_built_dxc = false;
enable_dangling_raw_ptr_feature_flag = false;
v8_enable_private_mapping_fork_optimization = true;
v8_expose_public_symbols = true;
enable_dangling_raw_ptr_feature_flag = false;
clang_unsafe_buffers_paths = "";
enterprise_cloud_content_analysis = false;
enable_linux_installer = false;
enable_pdf_save_to_drive = false;
}
// lib.optionalAttrs (lib.versionOlder info.version "43") {
enterprise_cloud_content_analysis = false;
}
// lib.optionalAttrs (lib.versionAtLeast info.version "43") {
node_openssl_path = "//third_party/boringssl";
}
// {
# other
enable_widevine = false;

1430
pkgs/development/tools/electron/info.json
View File

File diff suppressed because it is too large Load Diff

4
pkgs/os-specific/linux/kernel/kernels-org.json
View File

@@ -1,7 +1,7 @@
{
"testing": {
"version": "7.2-rc3",
"hash": "sha256:1nf6znpalqikblq6g0yb3hp7i689frhlhb4j1yxj6nn8fvma4rwd",
"version": "7.2-rc4",
"hash": "sha256:02qab36m7xzfwqdrylpacvlkjaxfa0mlnmk38fix6anqi3hgjq3q",
"lts": false
},
"6.1": {

7
pkgs/top-level/all-packages.nix
View File

@@ -5108,6 +5108,7 @@ with pkgs;
electron_40-bin
electron_41-bin
electron_42-bin
electron_43-bin
;
inherit (callPackages ../development/tools/electron/chromedriver { })
@@ -5116,6 +5117,7 @@ with pkgs;
electron-chromedriver_40
electron-chromedriver_41
electron-chromedriver_42
electron-chromedriver_43
;
inherit
@@ -5146,6 +5148,10 @@ with pkgs;
src = electron-source.electron_42;
bin = electron_42-bin;
};
electron_43 = getElectronPkg {
src = electron-source.electron_43;
bin = electron_43-bin;
};
}
)
electron_38
@@ -5153,6 +5159,7 @@ with pkgs;
electron_40
electron_41
electron_42
electron_43
;
electron = electron_41;
electron-bin = electron_41-bin;

6
pkgs/top-level/perl-packages.nix
View File

@@ -25491,10 +25491,10 @@ with self;
NetDNS = buildPerlPackage {
pname = "Net-DNS";
version = "1.48";
version = "1.56";
src = fetchurl {
url = "mirror://cpan/authors/id/N/NL/NLNETLABS/Net-DNS-1.48.tar.gz";
hash = "sha256-5V8+caMcK4VgJL9QYbEWCwP4edgBNUFPONgiBHaUR1M=";
url = "mirror://cpan/authors/id/N/NL/NLNETLABS/Net-DNS-1.56.tar.gz";
hash = "sha256-WTDjn3aJWzgMfKEfwINS0VrXHEH+hMEt+2oyLRf2aUY=";
};
propagatedBuildInputs = [ DigestHMAC ];
makeMakerFlags = [ "--noonline-tests" ];