From 3cd42154d432e5fe7b4b42e620cff3182b563b16 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 7 Jul 2026 22:10:03 -0400
Subject: [PATCH] xorg-server: 21.1.23 -> 21.1.24

announcement: https://lists.x.org/archives/xorg-announce/2026-July/003718.html
advisory: https://lists.x.org/archives/xorg-announce/2026-July/003716.html

Fixes: CVE-2026-55999, CVE-2026-56000
(cherry picked from commit 4c4f2e325fd86a76888d8287691939dd3cc0379c)
---
 pkgs/by-name/xo/xorg-server/package.nix | 4 ++--
 pkgs/by-name/xv/xvfb/package.nix        | 9 ++++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index 25dd29a82489..4718e0a524ba 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   # `xvfb` inherits `version` and `src` from here, leading to many rebuilds. If
   # necessary, these can be moved out of lockstep in order to merge updates
   # quickly.
-  version = "21.1.23";
+  version = "21.1.24";
 
   outputs = [
     "out"
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
+    hash = "sha256-Gk6zbKZcw7G5NlZtZ3qXhuE8Ec1YBulRrFXz9c45hK8=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index 934fade5a795..17cc2e9418ca 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -38,7 +38,14 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  inherit (xorg-server) src version;
+  # TODO: commented out for rebuild avoidance after xorg-server update. revert
+  # on staging.
+  # inherit (xorg-server) src version;
+  version = "21.1.23";
+  src = fetchurl {
+    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
+    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
+  };
 
   strictDeps = true;