From 1f0104d1c1961e4bedfb5e26dadb389d9dfcb49b Mon Sep 17 00:00:00 2001 From: emilylange Date: Tue, 3 Dec 2024 20:11:33 +0100 Subject: [PATCH 01/11] chromium,chromedriver: 131.0.6778.85 -> 131.0.6778.108 https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html This update includes 4 security fixes. CVEs: CVE-2024-12053 (cherry picked from commit eb48ff562196c485af75879bc81ef99bf52cd231) --- .../networking/browsers/chromium/info.json | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json index b1f96ef6c89b..618730284074 100644 --- a/pkgs/applications/networking/browsers/chromium/info.json +++ b/pkgs/applications/networking/browsers/chromium/info.json @@ -1,9 +1,9 @@ { "chromium": { - "version": "131.0.6778.85", + "version": "131.0.6778.108", "chromedriver": { - "hash_darwin": "sha256-li9wQkcgh5ORPu2kjdyfwvvuykRz1gTL3b8UVQs+MY4=", - "hash_darwin_aarch64": "sha256-r/C6QpmkVzovLJKfMTjUome9nL5WoEvPGRFB+AJJFqk=" + "hash_darwin": "sha256-X0kzihCQsICn5SRdU+THdthov0EPxsmMcrm6YJ6hMhs=", + "hash_darwin_aarch64": "sha256-3Qdj44cZD4wQTzkBx47ZCfqHE2HckkLuqYKpJxxfESk=" }, "deps": { "depot_tools": { @@ -19,8 +19,8 @@ "DEPS": { "src": { "url": "https://chromium.googlesource.com/chromium/src.git", - "rev": "3d81e41b6f3ac8bcae63b32e8145c9eb0cd60a2d", - "hash": "sha256-fREToEHVbTD0IVGx/sn7csSju4BYajWZ+LDCiKWV4cI=", + "rev": "3b014839fbc4fb688b2f5af512d6ce312ad208b1", + "hash": "sha256-ypzu3LveMFcOFm7+JlaERjzs3SK/n9+sfm5wOKB8/zw=", "recompress": true }, "src/third_party/clang-format/script": { @@ -120,8 +120,8 @@ }, "src/third_party/dawn": { "url": "https://dawn.googlesource.com/dawn.git", - "rev": "7e742cac42c29a14ab7f54b134b2f17592711267", - "hash": "sha256-K2gwKNwonzCIu4hnlYuOaYyKaRV11hwDzF4oykiKsl0=" + "rev": "740d2502dbbd719a76c5a8d3fb4dac1b5363f42e", + "hash": "sha256-R41YVv4uWCU6SsACXPRppeCDguTs+/NVJckvMGGTgJE=" }, "src/third_party/dawn/third_party/glfw": { "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw", @@ -600,8 +600,8 @@ }, "src/third_party/skia": { "url": "https://skia.googlesource.com/skia.git", - "rev": "94631d9b9a10697325589e1642af63a0137cac94", - "hash": "sha256-SKKLOxjimQWt8W+Q3wlCJaUC/lxw6EIZDFBuVQKmnVY=" + "rev": "f14f6b1ab7cf544c0190074488d17821281cfa4d", + "hash": "sha256-0p57otDuIShl6MngYs22XA1QYxptDVa3vCwJsH59H34=" }, "src/third_party/smhasher/src": { "url": "https://chromium.googlesource.com/external/smhasher.git", @@ -725,8 +725,8 @@ }, "src/third_party/webrtc": { "url": "https://webrtc.googlesource.com/src.git", - "rev": "8445abdf8069cadcbd134369b70d0ebd436ef477", - "hash": "sha256-EitEjXNtm0gB9wtAwIYHBHkU7paHg5zvsTz171hRmK4=" + "rev": "79aff54b0fa9238ce3518dd9eaf9610cd6f22e82", + "hash": "sha256-xkMnUduSG88EWiwq6PITN0KgAKjFd4QOis3dgxedK30=" }, "src/third_party/wuffs/src": { "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git", @@ -760,8 +760,8 @@ }, "src/v8": { "url": "https://chromium.googlesource.com/v8/v8.git", - "rev": "bd2671b973062afc614b852ec190524b80aaef8a", - "hash": "sha256-uq0CE7Chqzy2d+iifC3hV9RTnDVinpwjl1pOzyNGbSo=" + "rev": "e38771cb283b9689683c5ac0b5831dd89f8ec690", + "hash": "sha256-csSDnepYxil0R3PD/LVxW7JBcasOKG4l6q6vj8zHV/I=" } } }, From 44ef00a569de96ce65acc425507aee4a43f75f01 Mon Sep 17 00:00:00 2001 From: sternenseemann Date: Wed, 13 Nov 2024 23:43:09 +0100 Subject: [PATCH 02/11] haskellPackages.immortal: disable flaky tests on darwin It took 5 tries in for the tests to succeed on x86_64 and aarch64 darwin, respectively. (cherry picked from commit 57fd2fcf1f2264e80347e8ed45f3600130d7375b) --- pkgs/development/haskell-modules/configuration-darwin.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix index 9ecc35c9aac7..6db3d59d9101 100644 --- a/pkgs/development/haskell-modules/configuration-darwin.nix +++ b/pkgs/development/haskell-modules/configuration-darwin.nix @@ -93,6 +93,12 @@ self: super: ({ ''; }) super.git-annex; + # on*Finish tests rely on a threadDelay timing differential of 0.1s. + # You'd think that's plenty of time even though immediate rescheduling + # after threadDelay is not guaranteed. However, it appears that these + # tests are quite flaky on Darwin. + immortal = dontCheck super.immortal; + # Prevents needing to add `security_tool` as a run-time dependency for # everything using x509-system to give access to the `security` executable. # From 34e43a6ad9a2a3025f812fb140e795f8609ddc0c Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Tue, 3 Dec 2024 22:45:06 +0100 Subject: [PATCH 03/11] authentik: flag with `knownVulnerabilities` The bump to 2024.10.x is currently stalled in #345940. The fix for CVE-2024-52289 involves a backward incompatible API and DB change so it is also not great for a backport even if we cherry-picks the security fixes. Given no NixOS module is available in nixpkgs marking the package with `knownVulnerabilities` should have a limited impact. (cherry picked from commit 384f6f592b99f7ed384da7282d6aa6166eae075b) --- pkgs/by-name/au/authentik/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 80afd894f6d0..f7b723e16cd8 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -27,6 +27,12 @@ let license = licenses.mit; platforms = platforms.linux; maintainers = with maintainers; [ jvanbruegge ]; + knownVulnerabilities = [ + "CVE-2024-52307" + "CVE-2024-52287" + "CVE-2024-52289" + "Authentik 2024.6.x is end-of-life, consider using https://github.com/nix-community/authentik-nix for an up-to-date alternative" + ]; }; website = buildNpmPackage { From 2c787076e981d170a962a585bab61c7ff5586a2b Mon Sep 17 00:00:00 2001 From: RodEsp <1084688+RodEsp@users.noreply.github.com> Date: Thu, 28 Nov 2024 15:04:13 -0500 Subject: [PATCH 04/11] warp-terminal: 0.2024.11.19.08.02.stable_01 -> 0.2024.11.19.08.02.stable_03 (cherry picked from commit 7a294f6ffb7b95a0109cc2611e5703139e899427) --- pkgs/by-name/wa/warp-terminal/versions.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json index 7edef151703d..48a4a92c919f 100644 --- a/pkgs/by-name/wa/warp-terminal/versions.json +++ b/pkgs/by-name/wa/warp-terminal/versions.json @@ -1,14 +1,14 @@ { "darwin": { - "hash": "sha256-zvM7CcWYFXMN9dLoJqXnQlENmWDGYRKXQACtUQnXmmE=", - "version": "0.2024.11.19.08.02.stable_01" + "hash": "sha256-N1CvHYWhwi75+eelp3UPrqnigRTg1LWKhmVDNXv96LA=", + "version": "0.2024.11.19.08.02.stable_03" }, "linux_x86_64": { - "hash": "sha256-4uYVA+6NI11X/rYwEzHeTiPnDyntpZcBBBCiZkc9ik8=", - "version": "0.2024.11.19.08.02.stable_01" + "hash": "sha256-vxK9GFYYFZK3NIIejh6dAK3sKkpAR4cyOSC/t2Aodg8=", + "version": "0.2024.11.19.08.02.stable_03" }, "linux_aarch64": { - "hash": "sha256-3Tx/NcWV0zyTRp5FVqWTfnhXoxrW3ph/Ytc2tjfNhcs=", - "version": "0.2024.11.19.08.02.stable_01" + "hash": "sha256-eADShsB0/kKNMzBP1/JZ0Kofh2iTQtsxFz2N1H+hxY0=", + "version": "0.2024.11.19.08.02.stable_03" } } From 64aa5f6925bf118724f5863bdf5fc626b4514646 Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Tue, 3 Dec 2024 13:49:37 +0000 Subject: [PATCH 05/11] koboldcpp: 1.78 -> 1.79.1 Changelog: https://github.com/LostRuins/koboldcpp/releases/tag/v1.79.1 Diff: https://github.com/LostRuins/koboldcpp/compare/v1.78...v1.79.1 (cherry picked from commit bf9afe0e85aacce5336c14fb56d3bcba24ccfcde) --- pkgs/by-name/ko/koboldcpp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix index 4d328bc24401..22feecc0b003 100644 --- a/pkgs/by-name/ko/koboldcpp/package.nix +++ b/pkgs/by-name/ko/koboldcpp/package.nix @@ -53,13 +53,13 @@ let in effectiveStdenv.mkDerivation (finalAttrs: { pname = "koboldcpp"; - version = "1.78"; + version = "1.79.1"; src = fetchFromGitHub { owner = "LostRuins"; repo = "koboldcpp"; rev = "refs/tags/v${finalAttrs.version}"; - hash = "sha256-6RvodNWO/IVGlKxC/zt0itYDzymhk+hEBpbmQ1jHigU="; + hash = "sha256-RHeEI6mJklGF7BQXxLwxSr1xD6GsI9+fio888UxKru0="; }; enableParallelBuilding = true; From c1b848a870cc11377a1f5ebb8df882327a46cea4 Mon Sep 17 00:00:00 2001 From: Joshua Campbell Date: Wed, 4 Dec 2024 12:10:05 -0800 Subject: [PATCH 06/11] obs-studio-plugins.obs-ndi: fix deprecation errors Deprecated functions `void QDateTime::setTimeSpec(Qt::TimeSpec)` and `void QCheckBox::stateChanged(int)` errors disabled. (cherry picked from commit 1538a54cb06a25c296bda62c7b7e134ff2fccd79) --- pkgs/applications/video/obs-studio/plugins/obs-ndi/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/applications/video/obs-studio/plugins/obs-ndi/default.nix b/pkgs/applications/video/obs-studio/plugins/obs-ndi/default.nix index f58d81e9b706..155a9d641d58 100644 --- a/pkgs/applications/video/obs-studio/plugins/obs-ndi/default.nix +++ b/pkgs/applications/video/obs-studio/plugins/obs-ndi/default.nix @@ -30,6 +30,8 @@ stdenv.mkDerivation rec { cmakeFlags = [ "-DENABLE_QT=ON" ]; + env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations"; + dontWrapQtApps = true; meta = with lib; { From 10a1e7df7357bbe96fe6981fe9cc7839f927b96d Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Wed, 4 Dec 2024 22:04:15 +0000 Subject: [PATCH 07/11] raycast: 1.86.0 -> 1.87.2 Changelog: https://www.raycast.com/changelog/1-87-0 (cherry picked from commit 853e29c9540167e046d088b7bcaa4e009bd7ec40) --- pkgs/by-name/ra/raycast/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix index a963e4451c0c..fde6c41cc061 100644 --- a/pkgs/by-name/ra/raycast/package.nix +++ b/pkgs/by-name/ra/raycast/package.nix @@ -11,12 +11,12 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "raycast"; - version = "1.86.0"; + version = "1.87.2"; src = fetchurl { name = "Raycast.dmg"; url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal"; - hash = "sha256-UvMPRLCaGgunpVwoF0Nbz+7Gma7zQP+nMMh5Cvqn0MA="; + hash = "sha256-w4jrtrKCATUsFkMVsGee88pYiL1bahHaSy9emCh2GJE="; }; dontPatch = true; From e1fd97e60111c34c56ab638f52389ff257235ad3 Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Wed, 4 Dec 2024 23:55:33 +0200 Subject: [PATCH 08/11] soundsource: refactor meta (cherry picked from commit 4657c1608956fc5465d88c0d424708cd2a72ee07) --- pkgs/applications/audio/soundsource/default.nix | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/audio/soundsource/default.nix b/pkgs/applications/audio/soundsource/default.nix index 567ca85864e8..9fffbf0b80e8 100644 --- a/pkgs/applications/audio/soundsource/default.nix +++ b/pkgs/applications/audio/soundsource/default.nix @@ -25,15 +25,16 @@ stdenvNoCC.mkDerivation (finalAttrs: { runHook postInstall ''; - meta = with lib; { + meta = { + changelog = "https://rogueamoeba.com/support/releasenotes/?product=SoundSource"; description = "Sound controller for macOS"; homepage = "https://rogueamoeba.com/soundsource"; - license = licenses.unfree; - sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; - maintainers = with maintainers; [ + license = lib.licenses.unfree; + maintainers = with lib.maintainers; [ emilytrau donteatoreo ]; - platforms = platforms.darwin; + platforms = lib.platforms.darwin; + sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; }; }) From 6ead7f1217aa0bbb7e3a177549a57a59ddaedfec Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Wed, 4 Dec 2024 23:55:58 +0200 Subject: [PATCH 09/11] soundsource: quote paths (cherry picked from commit 4c0350d9d096a470eaa33a5022df0db6c5a388a1) --- pkgs/applications/audio/soundsource/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/audio/soundsource/default.nix b/pkgs/applications/audio/soundsource/default.nix index 9fffbf0b80e8..4fd0a8014e07 100644 --- a/pkgs/applications/audio/soundsource/default.nix +++ b/pkgs/applications/audio/soundsource/default.nix @@ -19,8 +19,8 @@ stdenvNoCC.mkDerivation (finalAttrs: { installPhase = '' runHook preInstall - mkdir -p $out/Applications - unzip -d $out/Applications $src + mkdir -p "$out/Applications" + unzip -d "$out/Applications" $src runHook postInstall ''; From 78650f5cccc359014885988c038ab1cffe1696fe Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Wed, 4 Dec 2024 23:58:31 +0200 Subject: [PATCH 10/11] soundsource: 5.7.3 -> 5.7.4 (cherry picked from commit 0d336e398fb360f13aab0d9c9d256a5c5116f730) --- pkgs/applications/audio/soundsource/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/audio/soundsource/default.nix b/pkgs/applications/audio/soundsource/default.nix index 4fd0a8014e07..a3c3ee528546 100644 --- a/pkgs/applications/audio/soundsource/default.nix +++ b/pkgs/applications/audio/soundsource/default.nix @@ -6,12 +6,13 @@ }: stdenvNoCC.mkDerivation (finalAttrs: { pname = "soundsource"; - version = "5.7.3"; + version = "5.7.4"; src = fetchurl { - url = "https://web.archive.org/web/20241112212337/https://cdn.rogueamoeba.com/soundsource/download/SoundSource.zip"; - sha256 = "sha256-Eup7oiq8vVn2MqxJxE/Z2LtDMdluczHusRJ9uoW3X84="; + url = "https://web.archive.org/web/20241204215222/https://cdn.rogueamoeba.com/soundsource/download/SoundSource.zip"; + hash = "sha256-zDIlhwczwXVPOV90EKF9pjO2CKlOEeFsqx17nIXaElw="; }; + dontUnpack = true; nativeBuildInputs = [ unzip ]; From d8f1c5a642bbcf91a691e0cc3d39b349ac185a50 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Wed, 4 Dec 2024 10:06:24 +0100 Subject: [PATCH 11/11] element-desktop: 1.11.86 -> 1.11.87 https://github.com/element-hq/element-desktop/releases/tag/v1.11.87 (cherry picked from commit 3834a03dee11ead822054a0c364e2af0a6966f25) --- .../networking/instant-messengers/element/pin.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix index d8ffd2b40a77..2f12882e5ef0 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.nix +++ b/pkgs/applications/networking/instant-messengers/element/pin.nix @@ -1,9 +1,9 @@ { - "version" = "1.11.86"; + "version" = "1.11.87"; "hashes" = { - "desktopSrcHash" = "sha256-GP5KnXL63J0076cVu0OpodlNT7Ypeso4iGrQNKq/17M="; - "desktopYarnHash" = "0bcq89nmx03h106hp875mv482d4r1xahdsimw3cs5c592zl50kx2"; - "webSrcHash" = "sha256-cqB77ffTbFLoNsGjXUOb2tdlXhSIS3X1/oDXOzOn99s="; - "webYarnHash" = "1cwj77a997lb4229ngry0b6kip1ggs82b9v126rzfgzavvwh9k1v"; + "desktopSrcHash" = "sha256-rIxuXMHQVJrbfWibpiIBmTkXKHrBqnTMiBYIP8VOIH4="; + "desktopYarnHash" = "05qs1an3mbqsfn1nmgwagp564lqvyrbkyj58z5h2cbczqbavnxxz"; + "webSrcHash" = "sha256-FcXYwYCx//fqWuUKRqTTntlT7jVBD1Heayg4T7ACHmc="; + "webYarnHash" = "0anamnfm5g4nj7wp18byi49x38aia490qfard2d34myzjgiby8v3"; }; }