diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index c06940bafbec..8164ed7572b2 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -2318,6 +2318,12 @@ github = "brianmcgee"; githubId = 1173648; }; + brianmcgillion = { + name = "Brian McGillion"; + email = "bmg.avoin@gmail.com"; + github = "brianmcgillion"; + githubId = 1044263; + }; brodes = { email = "me@brod.es"; github = "brhoades"; diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix index 22ff1d75399c..33582647a972 100644 --- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix +++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix @@ -3,7 +3,7 @@ , fetchFromGitHub , makeWrapper , makeDesktopItem -, fixup_yarn_lock +, prefetch-yarn-deps , yarn , nodejs , fetchYarnDeps @@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // { sha256 = desktopYarnHash; }; - nativeBuildInputs = [ yarn fixup_yarn_lock nodejs makeWrapper jq ] + nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs makeWrapper jq ] ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ]; inherit seshat; @@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // { export HOME=$(mktemp -d) yarn config --offline set yarn-offline-mirror $offlineCache - fixup_yarn_lock yarn.lock + fixup-yarn-lock yarn.lock yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive patchShebangs node_modules/ diff --git a/pkgs/applications/networking/instant-messengers/element/element-web.nix b/pkgs/applications/networking/instant-messengers/element/element-web.nix index e6b73d2983a6..554dfaaa54a4 100644 --- a/pkgs/applications/networking/instant-messengers/element/element-web.nix +++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix @@ -35,6 +35,17 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // { nativeBuildInputs = [ yarn fixup_yarn_lock jq nodejs ]; + buildPhase = '' + runHook preBuild + + export VERSION=${finalAttrs.version} + yarn --offline build:res + yarn --offline build:module_system + yarn --offline build:bundle + + runHook postBuild + ''; + configurePhase = '' runHook preConfigure @@ -54,17 +65,6 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // { runHook postConfigure ''; - buildPhase = '' - runHook preBuild - - export VERSION=${finalAttrs.version} - yarn build:res --offline - yarn build:module_system --offline - yarn build:bundle --offline - - runHook postBuild - ''; - installPhase = '' runHook preInstall diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix index a49a2f271583..a730d8611b78 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.nix +++ b/pkgs/applications/networking/instant-messengers/element/pin.nix @@ -1,9 +1,9 @@ { - "version" = "1.11.47"; + "version" = "1.11.50"; "hashes" = { - "desktopSrcHash" = "sha256-Ea3LJt+3HAOX2PTREMojtuPVTeA6u7VJtysd8bbTbwU="; - "desktopYarnHash" = "1nssv92yk1a53v7mvijkrb3gzif5xrz2j6lxvg7p340z42rm7f9v"; - "webSrcHash" = "sha256-DPBMZMjDnwjdNsePcUBBU0KRGOpOmNHgQZn9/ad/Qss="; - "webYarnHash" = "0rzipmaq0jarzdawl7lmxnapwzl52kklxadm859hgx9b1hd5vwj7"; + "desktopSrcHash" = "sha256-ZSzH0QWUSmoSk57TF7EH3DbUFO4VX8jCrH55oruMP+s="; + "desktopYarnHash" = "044sjxpd86zhmd0wcqmsnjvrh1krspp2qd9xzlxii4zwm9jz1hxn"; + "webSrcHash" = "sha256-6BzqETzQL4Xi4YqSyjFmIgajPPpagTS4tYhOZrEfEpo="; + "webYarnHash" = "1aw40r44dvl43bfgl2cr52hdj833maq2xyg3xa49837m7lf6pr8c"; }; } diff --git a/pkgs/applications/networking/instant-messengers/element/seshat/default.nix b/pkgs/applications/networking/instant-messengers/element/seshat/default.nix index 915e3faa3e40..cd1420fd958c 100644 --- a/pkgs/applications/networking/instant-messengers/element/seshat/default.nix +++ b/pkgs/applications/networking/instant-messengers/element/seshat/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs, python3, yarn, fixup_yarn_lock, CoreServices, fetchYarnDeps, removeReferencesTo }: +{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs, python3, yarn, prefetch-yarn-deps, CoreServices, fetchYarnDeps, removeReferencesTo }: let pinData = lib.importJSON ./pin.json; @@ -16,7 +16,7 @@ in rustPlatform.buildRustPackage rec { sourceRoot = "source/seshat-node/native"; - nativeBuildInputs = [ nodejs python3 yarn ]; + nativeBuildInputs = [ nodejs python3 yarn prefetch-yarn-deps ]; buildInputs = [ sqlcipher ] ++ lib.optional stdenv.isDarwin CoreServices; npm_config_nodedir = nodejs; @@ -33,7 +33,7 @@ in rustPlatform.buildRustPackage rec { export HOME=$PWD/tmp mkdir -p $HOME yarn config --offline set yarn-offline-mirror $yarnOfflineCache - ${fixup_yarn_lock}/bin/fixup_yarn_lock yarn.lock + fixup-yarn-lock yarn.lock yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive patchShebangs node_modules/ node_modules/.bin/neon build --release diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix index fb3399ee569b..86b9f43156cf 100644 --- a/pkgs/applications/networking/sniffers/wireshark/default.nix +++ b/pkgs/applications/networking/sniffers/wireshark/default.nix @@ -52,7 +52,7 @@ assert withQt -> qt6 != null; stdenv.mkDerivation rec { pname = "wireshark-${if withQt then "qt" else "cli"}"; - version = "4.0.10"; + version = "4.0.11"; outputs = [ "out" "dev" ]; @@ -60,7 +60,7 @@ stdenv.mkDerivation rec { repo = "wireshark"; owner = "wireshark"; rev = "v${version}"; - hash = "sha256-R8CoatIZC7vkKn4UZ3G7h5qBexfKMdJJ0swi+IxAjG0="; + hash = "sha256-tyYcL9K/TcW7Q+VrfYJPnqWh4pc06CKK7YHDEJjM090="; }; patches = [ diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix index 0b9e1a9d93ab..e4f987c65154 100644 --- a/pkgs/applications/version-management/gitea/default.nix +++ b/pkgs/applications/version-management/gitea/default.nix @@ -88,5 +88,28 @@ buildGoModule rec { license = licenses.mit; maintainers = with maintainers; [ disassembler kolaente ma27 techknowlogick ]; broken = stdenv.isDarwin; + knownVulnerabilities = [ + '' + Gitea's API and web endpoints before version 1.20.5 are affected by multiple + critical security vulnerabilities. + + Non-exhaustive list: + - reveal comments from issues and pull-requests from private repositories + - delete comments from issues and pull-requests + - get private release attachments + - delete releases and tags + - get ssh deployment keys (public key) + - get OAuth2 applications (except for the secret) + - 2FA not being enforced for the container registry login (docker login) + + There isn't a clear way how to backport and validate all those fixes to the now EOL + Gitea 1.19.x and bumping the release from 1.19.x to 1.20.x is not possible due to + its breaking nature. + Given nixpkgs 23.11 has been released by now and nixpkgs 23.05 will reach EOL very + soon (2023-12-31), please update to nixpkgs 23.11 instead. + + forgejo's blogpost on these issues: https://forgejo.org/2023-11-release-v1-20-5-1/#responsible-disclosure-to-gitea + '' + ]; }; } diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix index f3b5a6bd163b..aeb6a4ed2e40 100644 --- a/pkgs/build-support/node/fetch-yarn-deps/default.nix +++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix @@ -60,6 +60,7 @@ in { nativeBuildInputs = [ prefetch-yarn-deps ]; GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt"; + NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt"; buildPhase = '' runHook preBuild diff --git a/pkgs/games/prismlauncher/default.nix b/pkgs/games/prismlauncher/default.nix index 9f260aaba9d5..2409794cdfdc 100644 --- a/pkgs/games/prismlauncher/default.nix +++ b/pkgs/games/prismlauncher/default.nix @@ -1,7 +1,6 @@ { lib , stdenv , fetchFromGitHub -, fetchpatch , canonicalize-jars-hook , cmake , cmark @@ -23,51 +22,24 @@ let libnbtplusplus = fetchFromGitHub { owner = "PrismLauncher"; repo = "libnbtplusplus"; - rev = "2203af7eeb48c45398139b583615134efd8d407f"; - sha256 = "sha256-TvVOjkUobYJD9itQYueELJX3wmecvEdCbJ0FinW2mL4="; + rev = "a5e8fd52b8bf4ab5d5bcc042b2a247867589985f"; + hash = "sha256-A5kTgICnx+Qdq3Fir/bKTfdTt/T1NQP2SC+nhN1ENug="; }; in assert lib.assertMsg (stdenv.isLinux || !gamemodeSupport) "gamemodeSupport is only available on Linux"; -stdenv.mkDerivation -rec { +stdenv.mkDerivation (finalAttrs: { pname = "prismlauncher-unwrapped"; - version = "7.2"; + version = "8.0"; src = fetchFromGitHub { owner = "PrismLauncher"; repo = "PrismLauncher"; - rev = version; - sha256 = "sha256-RArg60S91YKp1Mt97a5JNfBEOf2cmuX4pK3VAx2WfqM="; + rev = finalAttrs.version; + hash = "sha256-WBajtfj3qAMq8zd2S53CQyHiyqtvffLOHOjmOpdALAA="; }; - patches = lib.optionals stdenv.isDarwin [ - # https://github.com/PrismLauncher/PrismLauncher/pull/1452 - # These patches allow us to disable the Sparkle updater and cmake bundling - # TODO: remove these when updating to 8.0 - (fetchpatch { - name = "disable-sparkle-when-url-is-empty.patch"; - url = "https://github.com/PrismLauncher/PrismLauncher/commit/48e50401968a72846350c6fbd76cc957b64a6b5a.patch"; - hash = "sha256-IFxp6Sj87ogQcMooV4Ql5/4B+C7oTzEk+4tlMud2OLo="; - }) - (fetchpatch { - name = "make-install_bundle-cached.patch"; - url = "https://github.com/PrismLauncher/PrismLauncher/commit/a8498b0dab94d0ab6c9e5cf395e5003db541b749.patch"; - hash = "sha256-ji5GGUnzVut9xFXkynqf9aVR9FO/zsqIbt3P9dexJ2I="; - }) - (fetchpatch { - name = "dont-include-sparkle-when-not-enabled.patch"; - url = "https://github.com/PrismLauncher/PrismLauncher/commit/51bfda937d47837ed426150ed6f43a60b4ca0ce1.patch"; - hash = "sha256-7hMgANOg4zRIf3F2AfLXGR3dAEBqVmKm/J5SH0G5oCk="; - }) - (fetchpatch { - name = "introduce-internal-updater-variable.patch"; - url = "https://github.com/PrismLauncher/PrismLauncher/commit/b1aa9e584624a0732dd55fc6c459524a8abfe6ba.patch"; - hash = "sha256-mm++EfnBxz7NVtKLMb889mMq8F/OdQmzob8OmlvNlRA="; - }) - ]; - nativeBuildInputs = [ extra-cmake-modules cmake jdk17 ninja canonicalize-jars-hook ]; buildInputs = [ @@ -111,4 +83,4 @@ rec { license = licenses.gpl3Only; maintainers = with maintainers; [ minion3665 Scrumplex getchoo ]; }; -} +}) diff --git a/pkgs/servers/teleport/11/default.nix b/pkgs/servers/teleport/11/default.nix index 269ec4f78ad8..7bea34001ec2 100644 --- a/pkgs/servers/teleport/11/default.nix +++ b/pkgs/servers/teleport/11/default.nix @@ -1,7 +1,7 @@ { callPackage, ... }@args: callPackage ../generic.nix ({ - version = "11.3.25"; - hash = "sha256-KIbRn90BUJp8Uc8GMHuIMMSn5tJQbxzE0ntngx1ELaE="; + version = "11.3.27"; + hash = "sha256-A3EeFQsDOaggfb5S+eyRCe/vm054MabfRrcHPxhO0So="; vendorHash = "sha256-hjMv/H4dlinlv3ku7i1km2/b+6uCdbznHtVOMIjDlUc="; yarnHash = "sha256-hip0WQVZpx2qfVDmEy4nk4UFYEjX1Xhj8HsIIQ8PF1Y="; cargoLock = { diff --git a/pkgs/tools/text/mdbook-footnote/default.nix b/pkgs/tools/text/mdbook-footnote/default.nix new file mode 100644 index 000000000000..d69c7e4fdd86 --- /dev/null +++ b/pkgs/tools/text/mdbook-footnote/default.nix @@ -0,0 +1,28 @@ +{ lib +, stdenv +, fetchFromGitHub +, rustPlatform +, CoreServices +}: +rustPlatform.buildRustPackage rec { + pname = "mdbook-footnote"; + version = "0.1.1"; + + src = fetchFromGitHub { + owner = "daviddrysdale"; + repo = "mdbook-footnote"; + rev = "v${version}"; + hash = "sha256-WUMgm1hwsU9BeheLfb8Di0AfvVQ6j92kXxH2SyG3ses="; + }; + + cargoSha256 = "sha256-Ig+uVCO5oHIkkvFsKiBiUFzjUgH/Pydn4MVJHb2wKGc="; + + buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ]; + + meta = with lib; { + description = "A preprocessor for mdbook to support the inclusion of automatically numbered footnotes"; + homepage = "https://github.com/daviddrysdale/mdbook-footnote"; + license = licenses.asl20; + maintainers = with maintainers; [ brianmcgillion ]; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 6cf8b9ef82bf..74a3d9283177 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -9448,6 +9448,10 @@ with pkgs; inherit (darwin.apple_sdk.frameworks) CoreServices; }; + mdbook-footnote = callPackage ../tools/text/mdbook-footnote { + inherit (darwin.apple_sdk.frameworks) CoreServices; + }; + mdcat = callPackage ../tools/text/mdcat { inherit (darwin.apple_sdk.frameworks) Security; inherit (python3Packages) ansi2html;