diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix index 7ad8705ae658..e5e61b73bac1 100644 --- a/nixos/modules/services/web-apps/discourse.nix +++ b/nixos/modules/services/web-apps/discourse.nix @@ -644,8 +644,8 @@ in s3_role_arn = null; s3_role_session_name = null; - max_user_api_reqs_per_minute = 20; - max_user_api_reqs_per_day = 2880; + max_user_api_reqs_per_minute = 50; + max_user_api_reqs_per_day = 4000; max_admin_api_reqs_per_minute = 60; max_reqs_per_ip_per_minute = 200; max_reqs_per_ip_per_10_seconds = 50; diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix index b66d9ddfa942..cead7c2e22d2 100644 --- a/pkgs/servers/web-apps/discourse/default.nix +++ b/pkgs/servers/web-apps/discourse/default.nix @@ -54,13 +54,13 @@ }: let - version = "2026.7.1"; + version = "2026.8.0"; src = fetchFromGitHub { owner = "discourse"; repo = "discourse"; tag = "v${version}"; - hash = "sha256-sGygaOCygtDVjg8uBGdDVaRouUKib8aAukaBAY8aQ9w="; + hash = "sha256-UUDPZVBQXG6kfW8+TFFDHsNMdH8WLxsgva4jSdZWsC8="; }; pnpm = pnpm_10; @@ -350,7 +350,7 @@ let pname = "discourse-assets"; inherit version src pnpm; fetcherVersion = 3; - hash = "sha256-T0qcUYHqpjeGlyozcaiVI/Art0zh2PLyuMzbquhfe/o="; + hash = "sha256-fm6hboG2Bjq0HUnbwdLiC1FpoWRZvq+1bN5SupQ2P2k="; }; nativeBuildInputs = runtimeDeps ++ [ @@ -392,7 +392,7 @@ let # because we fail to copy tmp/ (the default directory where the asset processor is cached, # see notes in the discourse `installPhase`) we need to change the directory to something under # frontend/ which is moved over as expected. - ./prebuild-asset-processor.patch + ./include-precompiled-bundles.patch # safe_exec.rb, which is used to execute ImageMagick among other things, restricts executable paths to standard FHS paths # which breaks on nix. this patch adds the entire /nix/store to allowed paths, which is sub-optimal but @@ -507,7 +507,7 @@ let # because we fail to copy tmp/ (the default directory where the asset processor is cached, # see notes in the discourse `installPhase`) we need to change the directory to something under # frontend/ which is moved over as expected. - ./prebuild-asset-processor.patch + ./include-precompiled-bundles.patch # safe_exec.rb, which is used to execute ImageMagick among other things, restricts executable paths to standard FHS paths # which breaks on nix. this patch adds the entire /nix/store to allowed paths, which is sub-optimal but @@ -517,6 +517,9 @@ let # Our app/assets/generated folder is a symlink, but the ruby File.mkdir_p doesn't allow # a symlink in the way to the last directory. This patch explicitly resolves the symlink. ./resolve_generated_assets_symlink.patch + + # in the imagemagick sandbox, symlinks permissions are checked (as you would hope) but this causes other problems.. + ./optimize-image-fix.patch ]; postPatch = '' diff --git a/pkgs/servers/web-apps/discourse/include-precompiled-bundles.patch b/pkgs/servers/web-apps/discourse/include-precompiled-bundles.patch new file mode 100644 index 000000000000..962398f06eb9 --- /dev/null +++ b/pkgs/servers/web-apps/discourse/include-precompiled-bundles.patch @@ -0,0 +1,26 @@ +diff --git a/lib/asset_processor.rb b/lib/asset_processor.rb +index 0c602a85220..be1e22061b0 100644 +--- a/lib/asset_processor.rb ++++ b/lib/asset_processor.rb +@@ -5,7 +5,7 @@ class AssetProcessor + + BUNDLE = + PrecompiledBundle.new( +- dir: "tmp/asset-processor", ++ dir: "frontend/asset-processor.build", + filename_prefix: "asset-processor", + dependency_globs: %w[ + node_modules/.pnpm/lock.yaml +diff --git a/lib/pretty_text.rb b/lib/pretty_text.rb +index 6f176324799..9815f579212 100644 +--- a/lib/pretty_text.rb ++++ b/lib/pretty_text.rb +@@ -54,7 +54,7 @@ module PrettyText + + CORE_BUNDLE = + PrecompiledBundle.new( +- dir: "tmp/pretty-text-processor", ++ dir: "frontend/pretty-text-processor.build", + filename_prefix: "pretty-text", + dependency_globs: + %w[ diff --git a/pkgs/servers/web-apps/discourse/optimize-image-fix.patch b/pkgs/servers/web-apps/discourse/optimize-image-fix.patch new file mode 100644 index 000000000000..56632d374b42 --- /dev/null +++ b/pkgs/servers/web-apps/discourse/optimize-image-fix.patch @@ -0,0 +1,11 @@ +diff --git a/config/imagemagick/policy.xml b/config/imagemagick/policy.xml +index a29d02c021b..8075d701fee 100644 +--- a/config/imagemagick/policy.xml ++++ b/config/imagemagick/policy.xml +@@ -41,5 +41,5 @@ + + + +- ++ + diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix index aa9437d33559..1f75f3cc44b9 100644 --- a/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix +++ b/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix @@ -10,8 +10,8 @@ mkDiscoursePlugin { src = fetchFromGitHub { owner = "discourse"; repo = "discourse-prometheus"; - rev = "ce51879d2c487cf74ca08d6d83d6ccb41cb28738"; - sha256 = "sha256-OhzWC8dgfwhre1HF5sjqXAeIJd3wuknzb12RMCz3+4Y="; + rev = "8850b2ee1acb69266f8697c3741f34cca80cad61"; + sha256 = "sha256-7koWRb0ifMwHdtpjV6X4yTiKmK7zVCdIJlewkY5Vgzs="; }; patches = [ diff --git a/pkgs/servers/web-apps/discourse/prebuild-asset-processor.patch b/pkgs/servers/web-apps/discourse/prebuild-asset-processor.patch deleted file mode 100644 index 774907ceaad2..000000000000 --- a/pkgs/servers/web-apps/discourse/prebuild-asset-processor.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/lib/asset_processor.rb b/lib/asset_processor.rb -index bacb376c856..11d7d7edd32 100644 ---- a/lib/asset_processor.rb -+++ b/lib/asset_processor.rb -@@ -3,7 +3,7 @@ - class AssetProcessor - BASE_COMPILER_VERSION = 113 - -- PROCESSOR_DIR = "tmp/asset-processor" -+ PROCESSOR_DIR = "frontend/asset-processor.build" - LOCK_FILE = "#{PROCESSOR_DIR}/build.lock" - - CACHE_DEPENDENCY_GLOBS = %w[ diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock index d2cdb9f438e7..0e3517db3815 100644 --- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock +++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock @@ -5,7 +5,7 @@ PATH activesupport colored2 i18n - markbridge (>= 0.3.1) + markbridge (>= 0.4.0) migrations-core pg zeitwerk @@ -53,16 +53,16 @@ GEM remote: https://rubygems.org/ specs: Ascii85 (2.0.1) - actionmailer (8.0.5) - actionpack (= 8.0.5) - actionview (= 8.0.5) - activejob (= 8.0.5) - activesupport (= 8.0.5) + actionmailer (8.0.5.1) + actionpack (= 8.0.5.1) + actionview (= 8.0.5.1) + activejob (= 8.0.5.1) + activesupport (= 8.0.5.1) mail (>= 2.8.0) rails-dom-testing (~> 2.2) - actionpack (8.0.5) - actionview (= 8.0.5) - activesupport (= 8.0.5) + actionpack (8.0.5.1) + actionview (= 8.0.5.1) + activesupport (= 8.0.5.1) nokogiri (>= 1.8.5) rack (>= 2.2.4) rack-session (>= 1.0.1) @@ -70,8 +70,8 @@ GEM rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) useragent (~> 0.16) - actionview (8.0.5) - activesupport (= 8.0.5) + actionview (8.0.5.1) + activesupport (= 8.0.5.1) builder (~> 3.1) erubi (~> 1.11) rails-dom-testing (~> 2.2) @@ -80,16 +80,16 @@ GEM actionview (>= 6.0.a) active_model_serializers (0.8.4) activemodel (>= 3.0) - activejob (8.0.5) - activesupport (= 8.0.5) + activejob (8.0.5.1) + activesupport (= 8.0.5.1) globalid (>= 0.3.6) - activemodel (8.0.5) - activesupport (= 8.0.5) - activerecord (8.0.5) - activemodel (= 8.0.5) - activesupport (= 8.0.5) + activemodel (8.0.5.1) + activesupport (= 8.0.5.1) + activerecord (8.0.5.1) + activemodel (= 8.0.5.1) + activesupport (= 8.0.5.1) timeout (>= 0.4.0) - activesupport (8.0.5) + activesupport (8.0.5.1) base64 benchmark (>= 0.3) bigdecimal @@ -318,7 +318,7 @@ GEM simpleidn (~> 0.2) jwt (2.10.1) base64 - landlock (0.3) + landlock (0.4.1) language_server-protocol (3.17.0.5) libv8-node (24.12.0.1) libv8-node (24.12.0.1-aarch64-linux) @@ -355,7 +355,7 @@ GEM net-imap net-pop net-smtp - markbridge (0.3.1) + markbridge (0.4.0) matrix (0.4.3) maxminddb (0.1.22) memory_profiler (1.1.0) @@ -370,7 +370,7 @@ GEM mime-types-data (3.2026.0414) mini_mime (1.1.5) mini_portile2 (2.8.9) - mini_racer (0.21.4) + mini_racer (0.22.0) libv8-node (~> 24.12.0.1) mini_scheduler (0.20.0) sidekiq (>= 6.5, < 9.0) @@ -547,9 +547,9 @@ GEM rails_multisite (7.0.0) activerecord (>= 7.1) railties (>= 7.1) - railties (8.0.5) - actionpack (= 8.0.5) - activesupport (= 8.0.5) + railties (8.0.5.1) + actionpack (= 8.0.5.1) + activesupport (= 8.0.5.1) irb (~> 1.13) rackup (>= 1.0.0) rake (>= 12.2) @@ -563,7 +563,7 @@ GEM rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rb_sys (0.9.128) + rb_sys (0.9.130) rake-compiler-dock (= 1.12.0) rbs (4.0.2) logger @@ -1007,15 +1007,15 @@ DEPENDENCIES CHECKSUMS Ascii85 (2.0.1) sha256=15cb5d941808543cbb9e7e6aea3c8ec3877f154c3461e8b3673e97f7ecedbe5a - actionmailer (8.0.5) sha256=7918fac842cfe985ed21692f3d212c914a0c816e30e6fa68633177bb22f38561 - actionpack (8.0.5) sha256=c9de868975dd124a0956499140bd5e63c367865deca01292df7c3195c8da4b35 - actionview (8.0.5) sha256=6d0fa9e63df0cf2729b1f54d0988336c149eb2bbc6049f4c2834d7b62f351413 + actionmailer (8.0.5.1) sha256=c3d2b3f96e1989ea25f51699786a97fcb2536eb7abfc2a667cb8f2376ec08403 + actionpack (8.0.5.1) sha256=a5595c9d824d68884ddc4d3965ab78c897760d3752e190df7efe897371caa1eb + actionview (8.0.5.1) sha256=472a108b9cc2295c4ac3ff09b028045e619875801f48c556f0085210b9cb1440 actionview_precompiler (0.4.0) sha256=33b6bd6ec4c1b856e02fdf5f6512c9eb4a92ac1c0545e941b3e354b7d540ed1c active_model_serializers (0.8.4) sha256=7350e3d3b6a5946bbec033241d908013cc85ff4d584230e6aa074225547c754c - activejob (8.0.5) sha256=2dabe5c3bfe284aba4687c52b930564335435dde3a60b047821f9d3bd0d2ea10 - activemodel (8.0.5) sha256=c796813d46dc1373f4c6c0ec91dfc520b53683ea773c3b3f9a12c4b3eb145bc2 - activerecord (8.0.5) sha256=89b261b6cd910c9431cf2475f3f6e5e2f5ce589805043a33ef2b004376a129e6 - activesupport (8.0.5) sha256=37f213ff6a37cf3fadfa1a28c1a9678e2cb73b59bb9ebd0eeeca653cccadcb23 + activejob (8.0.5.1) sha256=142407a21b6c3cbc6ddd92ca111ac18ea5c40298eb94d81845cd897a072a6880 + activemodel (8.0.5.1) sha256=559be32aa9c40db7a3ee0aef926d4508a9ebd22f96f7276c11326d21a7dff4a4 + activerecord (8.0.5.1) sha256=9252968fce404d75eb17092498a440d472167f2f8deee32b4658d6552b1eeea7 + activesupport (8.0.5.1) sha256=329a4280c4fbcfcf338ae2cb9df28b0b14527929dba105e10b3604516d998710 addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af afm (1.0.0) sha256=5bd4d6f6241e7014ef090985ec6f4c3e9745f6de0828ddd58bc1efdd138f4545 annotaterb (4.20.0) sha256=871b2e898d1d60c23bdc59b72a5b840678a56355bf5f6fdeb8c79d317ff98bf7 @@ -1127,7 +1127,7 @@ CHECKSUMS json_completer (1.2.0) sha256=4665749172634eccb208c562eb59ea81dd7a612a1fa9a36df441ac473ff177b1 json_schemer (2.5.0) sha256=2f01fb4cce721a4e08dd068fc2030cffd0702a7f333f1ea2be6e8991f00ae396 jwt (2.10.1) sha256=e6424ae1d813f63e761a04d6284e10e7ec531d6f701917fadcd0d9b2deaf1cc5 - landlock (0.3) sha256=841ae1ef1318082a485ae919b6a481ceb9c2d3ac9294ada27e2a3c529446b23c + landlock (0.4.1) sha256=95c9b119ff831fae35756ddcd5e9d5f99b9705be71f37a0972f86c825b78b14f language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc libv8-node (24.12.0.1) sha256=d93d23b861bfe5de3ba829e34a142402fb83b4c3592dd58d9ac4e027588d739a libv8-node (24.12.0.1-aarch64-linux) sha256=22bd0246cde85d70c88cf772727ac3677a20ac1d169105f82efe5f1f7c39f755 @@ -1148,7 +1148,7 @@ CHECKSUMS lru_redux (1.1.0) sha256=ee71d0ccab164c51de146c27b480a68b3631d5b4297b8ffe8eda1c72de87affb lz4-ruby (0.3.3) sha256=011be5ee230cfddc8308d4e2e0b05300c7bc755a887de799377ca6c5b6aede89 mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941 - markbridge (0.3.1) sha256=a36dff4e79e666fe7f944d4a806f507212191b80d22878ab3ee9008d9df975a3 + markbridge (0.4.0) sha256=27645fd47489d2fd42068153fa471b7e5231dd8dabb31c1bf38c88aa37535b12 matrix (0.4.3) sha256=a0d5ab7ddcc1973ff690ab361b67f359acbb16958d1dc072b8b956a286564c5b maxminddb (0.1.22) sha256=50933be438fbed9dceabef4163eab41884bd8830d171fdb8f739bee769c4907e memory_profiler (1.1.0) sha256=79a17df7980a140c83c469785905409d3027ca614c42c086089d128b805aa8f8 @@ -1163,7 +1163,7 @@ CHECKSUMS mime-types-data (3.2026.0414) sha256=461c4c655373a44bd6c5fe54bcf5b7776026ea96e808144b1ec465c4b99148cc mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289 - mini_racer (0.21.4) sha256=ccf5e37288097f079d84449e111cd4e2170b37f3b80b30900766ffa6df4632db + mini_racer (0.22.0) sha256=52e4c1797bcb01be550d8317764ac5ca8aa96b37f8f72dec6e090db99847ae30 mini_scheduler (0.20.0) sha256=bd8948228bf4a48a603a8e20de850d16b68295413d8651c8c05288f4c6997b05 mini_sql (1.6.0) sha256=5296637f6a4af5bb43e06788037e9a2968ff9c8eb65928befcba8cb41f42d6ee mini_suffix (0.3.3) sha256=8d1d33f92f69a2247c9b7d27173235da90479d955cdb863b63a7f53843b722e7 @@ -1240,14 +1240,14 @@ CHECKSUMS rails-html-sanitizer (1.7.0) sha256=28b145cceaf9cc214a9874feaa183c3acba036c9592b19886e0e45efc62b1e89 rails_failover (2.3.0) sha256=eed6ea0674fd6f9f6b070ad297ad2ead121ecf9202920f6068b6a4f29d9491c9 rails_multisite (7.0.0) sha256=7aacf364ed86d2bee73fb679cbfe6c343ce89067b9746b3d5857fffc57f036f2 - railties (8.0.5) sha256=ad98c6e9a096b7e8cf63c70872b60ec6c1d4152be2a4ffa63483ec02a837a9d5 + railties (8.0.5.1) sha256=da1958e1d9dab04691a2f8721b3ff7fab323715d37f103c19972dedfd644d5c7 rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a raindrops (0.20.1) sha256=aa0eb9ff6834f2d9e232ba688bd49cb30be893bc5a3452e74722c94c1fab4730 rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701 rake-compiler-dock (1.12.0) sha256=f13205c2738f3d2053afcd03491a9e4541b22a59a0bfc53fc8bc883bd8188023 rb-fsevent (0.11.2) sha256=43900b972e7301d6570f64b850a5aa67833ee7d87b458ee92805d56b7318aefe rb-inotify (0.11.1) sha256=a0a700441239b0ff18eb65e3866236cd78613d6b9f78fea1f9ac47a85e47be6e - rb_sys (0.9.128) sha256=9ab81f4d6d4e1895de18762232362d1264475aa7035756b50441e442130538fd + rb_sys (0.9.130) sha256=7d486d99c1da02635515deaf9860fc5aea90bb4ab2589b2deec7fdc7d3548615 rbs (4.0.2) sha256=af75671e66cd03434cc546622741ebf83f6197ec4328375805306330bf78ef25 rbtrace (0.5.4) sha256=8279e40076530f0301e255d0669cfe0d7d31ef872d1ae475c486e5a1199b757b rchardet (1.10.2) sha256=e041cb195f464dc10e49ab130f78c8b5956cd9a4f4f6df84e0c183b87c135f33 diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix index 9e781f718be7..13be53ad0101 100644 --- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix +++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix @@ -12,10 +12,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0qc5ycibnxricdlgmrihds0hqjli5hhksbv947nqbsfg8b4gl63r"; + sha256 = "00w4q1p3gwmqgik2mz5bnxp57cpwjxm7i68nyljym28rdvwv7ln3"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; actionpack = { dependencies = [ @@ -37,10 +37,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0dabvb49acbwvy91587cbn36ghv3bsyl14a9aq4ll4nxfn4qdpn9"; + sha256 = "1sx1r9qp72gygvgr1qaj6w6pd5y8g2mnafadvi6qhs2dhafmqnd5"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; actionview = { dependencies = [ @@ -58,10 +58,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "04ql6lpvdmrl5169y166pfr9w53c6f40jkgmn4ljgkzh7pkaj3vd"; + sha256 = "0h0lrfwi0lh8y1bcaj0zh1srhqay0hlb02gzqd55qaf2kj5i0aj7"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; actionview_precompiler = { dependencies = [ "actionview" ]; @@ -94,10 +94,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "047asb83p78zh93v0q1svrfl6da3aqqbjlkwd2jap172pz1ybard"; + sha256 = "1038583pm2fd8lcdi57bk01c99cfq4d13jljvmnvqg3c3fi0f90l"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; activemodel = { dependencies = [ "activesupport" ]; @@ -110,10 +110,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1hjv2kmv7i0jk8zkng3pxa1kdd90qpgr3v60qvs764yw8qyq35n7"; + sha256 = "197lvykj2v9j25n2gxwn5z9fpa888mnr5vqaxsivf3f4m4mf76sm"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; activerecord = { dependencies = [ @@ -130,10 +130,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1ri9l5v4601bxwrkl105k1ccxxg2wpvg6x94rwqr834irnv63cl9"; + sha256 = "19zf3qmmbmjq8qmy7vld5xzicwnl82j9h9092zmpaka0rs7rcllj"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; activesupport = { dependencies = [ @@ -159,10 +159,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "08ybmp63qrfaxq7bv7mvb4xvfb4fcylw2a0szankzkrpdbzi7wip"; + sha256 = "0447k5nm211n1ghhb8fv55wm450bigr9vjz2i8rwzkzvqj0456ij"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; addressable = { dependencies = [ "public_suffix" ]; @@ -1497,10 +1497,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0g5j8sa54g1agsiav54jmk9w5fffh6jbc6g9b942l20q2gpy26l4"; + sha256 = "0kxig1dq4v7qf84pmwvipq2rg6zrsplxbp3dflssw7w3zwcv3jcm"; type = "gem"; }; - version = "0.3"; + version = "0.4.1"; }; language_server-protocol = { groups = [ @@ -1713,10 +1713,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "18vmz6fqs0797smpha6jh0dij4kja1pq0jjdjizzwrp6g57gyvd3"; + sha256 = "04jvacvsm24cycdircxbipfk2lky3d3zllw10r1gvll9fka5yr17"; type = "gem"; }; - version = "0.3.1"; + version = "0.4.0"; }; matrix = { groups = [ @@ -1929,10 +1929,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1nrj8vgsdzv60y8302xqycvhn5z2shf137j4hjfhfzq9i1rf7xfc"; + sha256 = "0c5f8ycbj389dvn2vxzq6xmsk2naqm57c5w31mavw0fbgdww3r2j"; type = "gem"; }; - version = "0.21.4"; + version = "0.22.0"; }; mini_scheduler = { dependencies = [ "sidekiq" ]; @@ -2858,10 +2858,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1md96yl05v436jkgz9725cax9hf61sv74267cg7yidwnl3lwd65d"; + sha256 = "1iym8kbdzpkjk70h7w9pbmqj7czsywzinwpqla8ldc6sv7hmh6fs"; type = "gem"; }; - version = "8.0.5"; + version = "8.0.5.1"; }; rainbow = { groups = [ @@ -2955,10 +2955,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1z9q0l9l5r210jsmcmq3lxd4fr0j5lv348kn33g9a62fdm6izf4s"; + sha256 = "05c6ak9wgzf7xqnrnn5j9axr1sjszih9ibyy2man60nsq6cnsj3x"; type = "gem"; }; - version = "0.9.128"; + version = "0.9.130"; }; rbs = { dependencies = [ diff --git a/pkgs/servers/web-apps/discourse/safe-exec-from-nix-store.patch b/pkgs/servers/web-apps/discourse/safe-exec-from-nix-store.patch index e3c444958a26..e652eff3924a 100644 --- a/pkgs/servers/web-apps/discourse/safe-exec-from-nix-store.patch +++ b/pkgs/servers/web-apps/discourse/safe-exec-from-nix-store.patch @@ -1,12 +1,14 @@ diff --git a/lib/discourse/safe_exec.rb b/lib/discourse/safe_exec.rb -index c4b8a5e3ecb..31d6f0d469d 100644 +index dc32954245c..a89d9afac97 100644 --- a/lib/discourse/safe_exec.rb +++ b/lib/discourse/safe_exec.rb -@@ -5,7 +5,7 @@ require "landlock" +@@ -4,8 +4,8 @@ require "landlock" + module Discourse class SafeExec - DEFAULT_READ_PATHS = %w[/bin /etc /lib /lib64 /usr].freeze +- DEFAULT_READ_PATHS = %w[/bin /lib /lib64 /usr].freeze - DEFAULT_EXECUTE_PATHS = %w[/bin /lib /lib64 /usr].freeze ++ DEFAULT_READ_PATHS = %w[/bin /lib /lib64 /usr /nix/store].freeze + DEFAULT_EXECUTE_PATHS = %w[/bin /lib /lib64 /usr /nix/store].freeze def self.capture( diff --git a/pkgs/servers/web-apps/discourse/update.py b/pkgs/servers/web-apps/discourse/update.py index 6a1fa3f64b9a..d169c4d5c3e0 100755 --- a/pkgs/servers/web-apps/discourse/update.py +++ b/pkgs/servers/web-apps/discourse/update.py @@ -276,6 +276,8 @@ def update(rev): subprocess.check_output(["rm", "-rf", "migrations"], cwd=rubyenv_dir) # -- end gitlab pkg code + click.echo("updating dart-sass") + # update the sass-embedded override # must run *after* the gemfile update! dart_sass_ver = _nix_eval('discourse.rubyEnv.gemset.sass-embedded.version') @@ -301,17 +303,32 @@ def update(rev): f.write(content) f.truncate() + click.echo("updating discourse package") + # update the discourse package itself _call_nix_update('discourse', version.version) + click.echo("querying old PNPM hash") old_pnpm_hash = _nix_eval('discourse.assets.pnpmDeps.outputHash') + + click.echo("finding new PNPM hash") + # the pnpm builder now requires the has to be set to "" to output a "got: sha256-" line + empty_hash_line = f"hash = \"\";#{old_pnpm_hash}"; + mk_hash_line = lambda hash: f"hash = \"{hash}\";" + with open(Path(__file__).parent / "default.nix", 'r+') as f: + content = f.read() + content = content.replace(mk_hash_line(old_pnpm_hash), empty_hash_line) + f.seek(0) + f.write(content) + f.truncate() new_pnpm_hash = _get_build_lock_hash() + if new_pnpm_hash is not None: click.echo(f"Updating pnpm lock hash: {old_pnpm_hash} -> {new_pnpm_hash}") with open(Path(__file__).parent / "default.nix", 'r+') as f: content = f.read() - content = content.replace(old_pnpm_hash, new_pnpm_hash) + content = content.replace(empty_hash_line, mk_hash_line(new_pnpm_hash)) f.seek(0) f.write(content) f.truncate()