diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl index 54352a517a24..75c343523e27 100644 --- a/nixos/modules/config/update-users-groups.pl +++ b/nixos/modules/config/update-users-groups.pl @@ -147,7 +147,7 @@ foreach my $g (@{$spec->{groups}}) { if (defined $existing) { $g->{gid} = $existing->{gid} if !defined $g->{gid}; if ($g->{gid} != $existing->{gid}) { - dry_print("warning: not applying", "warning: would not apply", "GID change of group ‘$name’ ($existing->{gid} -> $g->{gid})"); + dry_print("warning: not applying", "warning: would not apply", "GID change of group ‘$name’ ($existing->{gid} -> $g->{gid}) in /etc/group"); $g->{gid} = $existing->{gid}; } $g->{password} = $existing->{password}; # do we want this? @@ -209,7 +209,7 @@ foreach my $u (@{$spec->{users}}) { if (defined $existing) { $u->{uid} = $existing->{uid} if !defined $u->{uid}; if ($u->{uid} != $existing->{uid}) { - dry_print("warning: not applying", "warning: would not apply", "UID change of user ‘$name’ ($existing->{uid} -> $u->{uid})"); + dry_print("warning: not applying", "warning: would not apply", "UID change of user ‘$name’ ($existing->{uid} -> $u->{uid}) in /etc/passwd"); $u->{uid} = $existing->{uid}; } } else { diff --git a/pkgs/applications/networking/mailreaders/betterbird/default.nix b/pkgs/applications/networking/mailreaders/betterbird/default.nix index 1b08cc3eb082..d08bd5dfcc4a 100644 --- a/pkgs/applications/networking/mailreaders/betterbird/default.nix +++ b/pkgs/applications/networking/mailreaders/betterbird/default.nix @@ -6,10 +6,12 @@ , git , libdbusmenu-gtk3 , runtimeShell -, thunderbird-unwrapped +, thunderbirdPackages }: let + thunderbird-unwrapped = thunderbirdPackages.thunderbird-102; + version = "102.12.0"; majVer = lib.versions.major version; diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix index 34b75b05d87f..878d3f756838 100644 --- a/pkgs/development/compilers/edk2/default.nix +++ b/pkgs/development/compilers/edk2/default.nix @@ -36,7 +36,7 @@ buildType = if stdenv.isDarwin then edk2 = buildStdenv.mkDerivation { pname = "edk2"; - version = "202305"; + version = "202211"; patches = [ # pass targetPrefix as an env var @@ -52,7 +52,7 @@ edk2 = buildStdenv.mkDerivation { repo = "edk2"; rev = "edk2-stable${edk2.version}"; fetchSubmodules = true; - hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s="; + sha256 = "sha256-0jE73xPyenAcgJ1mS35oTc5cYw7jJvVYxhPdhTWpKA0="; }; nativeBuildInputs = [ pythonEnv ]; diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix index e492bc2403fd..23ebbae8d1cb 100644 --- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix +++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix @@ -5,12 +5,12 @@ mkDerivation rec { pname = "kernelshark"; - version = "2.2.0"; + version = "2.2.1"; src = fetchgit { url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/"; rev = "kernelshark-v${version}"; - sha256 = "sha256-VkUah8qAlOck9245f/zngtVpHmJdx6eQXqwzLwK2xjU="; + hash = "sha256-V25IzPDOt6V03wgIa/AJ0T8mRaGmXYuMCcvbSOKleY0="; }; outputs = [ "out" ]; diff --git a/pkgs/servers/asterisk/default.nix b/pkgs/servers/asterisk/default.nix index c49e5696a676..6d0b4c5805ea 100644 --- a/pkgs/servers/asterisk/default.nix +++ b/pkgs/servers/asterisk/default.nix @@ -48,6 +48,11 @@ let url = "https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36.patch"; sha256 = "sha256-bpc8e8VAQpfyl5PX96G++6fzkFpw3Or1PJKNPKl7N5k="; }) + (fetchpatch { + name = "CVE-2023-27585.patch"; + url = "https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5.patch"; + hash = "sha256-+yyKKTKG2FnfyLWnc4S80vYtDzmiu9yRmuqb5eIulPg="; + }) ]; common = { version, sha256, externals, pjsip_patches ? [ ] }: stdenv.mkDerivation { diff --git a/pkgs/servers/irrd/default.nix b/pkgs/servers/irrd/default.nix index 13dc0bb0b196..cddb68eca7bb 100644 --- a/pkgs/servers/irrd/default.nix +++ b/pkgs/servers/irrd/default.nix @@ -33,6 +33,66 @@ let ]; }); + hiredis = super.hiredis.overridePythonAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ + "CVE-2021-32765" + ]; + }; + }); + + pydantic = super.pydantic.overridePythonAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ + "CVE-2020-10735" + ]; + }; + }); + + redis = super.redis.overridePythonAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ + "CVE-2023-28858" + "CVE-2023-28859" + ]; + }; + }); + + requests = super.requests.overridePythonAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ + "CVE-2023-32681" + ]; + }; + }); + + sqlalchemy = super.sqlalchemy.overridePythonAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ + "PVE-2022-51668" + ]; + }; + }); + + starlette = super.starlette.overridePythonAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ + "CVE-2023-29159" + "CVE-2023-30798" + ]; + }; + }); + + ujson = super.ujson.overridePythonAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ + "CVE-2021-45958" + "CVE-2022-31116" + "CVE-2022-31117" + ]; + }; + }); + }) ]; }).python.pkgs; diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix index 97d8f06850ce..864856fad13f 100644 --- a/pkgs/servers/mattermost/default.nix +++ b/pkgs/servers/mattermost/default.nix @@ -7,18 +7,18 @@ buildGoModule rec { pname = "mattermost"; - version = "7.8.5"; + version = "7.8.8"; src = fetchFromGitHub { owner = "mattermost"; repo = "mattermost-server"; rev = "v${version}"; - hash = "sha256-qC6tJcWruiTbWXKuACuhl0kwbRdPVXfUlaFJx4DiQgE="; + hash = "sha256-U12vAEyL7epfySonW1eYe2YHK2DLrKVX73ouAHysNls="; }; webapp = fetchurl { url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz"; - hash = "sha256-ojAGa4tZ5aZp+4XSW6ycDvJ295zH8GaYsA9w6z8n2WM="; + hash = "sha256-Vzz2eIcvjts0e/+EUQzls5yPglcCtzaZr0XUf2By1sM="; }; vendorHash = "sha256-VvGLYOESyoBpFmIibHWxazliHcscMxf3KcQ46NQ4syk="; diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix index f201d863b7a3..41323b55d2f5 100644 --- a/pkgs/tools/networking/iperf/3.nix +++ b/pkgs/tools/networking/iperf/3.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "iperf"; - version = "3.13"; + version = "3.14"; src = fetchurl { url = "https://downloads.es.net/pub/iperf/iperf-${version}.tar.gz"; - sha256 = "sha256-vuQnrrE9ai7iIHPyMmH2NxLYK++qg6yMtNtdpMK9yGU="; + hash = "sha256-cj/MQwoCe8aVJij6KjrHdYSh0L0ygnXlc/ybIGwVUAQ="; }; buildInputs = [ openssl ] ++ lib.optionals stdenv.isLinux [ lksctp-tools ]; @@ -30,7 +30,7 @@ stdenv.mkDerivation rec { ''; meta = with lib; { - homepage = "http://software.es.net/iperf/"; + homepage = "https://software.es.net/iperf/"; description = "Tool to measure IP bandwidth using UDP or TCP"; platforms = platforms.unix; license = licenses.bsd3; diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix index 9b604cd1405c..e05d0ce144b2 100644 --- a/pkgs/tools/networking/openssh/default.nix +++ b/pkgs/tools/networking/openssh/default.nix @@ -19,32 +19,33 @@ in openssh_hpn = common rec { pname = "openssh-with-hpn"; - version = "9.2p1"; + version = "9.3p1"; extraDesc = " with high performance networking patches"; src = fetchurl { url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz"; - hash = "sha256-P2bb8WVftF9Q4cVtpiqwEhjCKIB7ITONY068351xz0Y="; + hash = "sha256-6bq6dwGnalHz2Fpiw4OjydzZf6kAuFm8fbEUwYaK+Kg="; }; - extraPatches = [ + extraPatches = let url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/700625bcd86b74cf3fb9536aeea250d7f8cd1fd5/security/openssh-portable/files/extra-patch-hpn"; in + [ ./ssh-keysign-8.5.patch # HPN Patch from FreeBSD ports (fetchpatch { name = "ssh-hpn-wo-channels.patch"; - url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/10491773d88012fe81d9c039cbbba647bde9ebc9/security/openssh-portable/files/extra-patch-hpn"; + inherit url; stripLen = 1; excludes = [ "channels.c" ]; - sha256 = "sha256-kSj0oE7gNHfIciy0/ErhdfrbmfjQmd8hduyiRXFnVZA="; + hash = "sha256-hYB3i0ifNOgGLYwElMJFcT+ktczLKciq3qw1tTHZHcc="; }) (fetchpatch { name = "ssh-hpn-channels.patch"; - url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/10491773d88012fe81d9c039cbbba647bde9ebc9/security/openssh-portable/files/extra-patch-hpn"; + inherit url; extraPrefix = ""; includes = [ "channels.c" ]; - sha256 = "sha256-pDLUbjv5XIyByEbiRAXC3WMUPKmn15af1stVmcvr7fE="; + hash = "sha256-pDLUbjv5XIyByEbiRAXC3WMUPKmn15af1stVmcvr7fE="; }) ]; @@ -53,7 +54,6 @@ in extraConfigureFlags = [ "--with-hpn" ]; extraMeta = { maintainers = with lib.maintainers; [ abbe ]; - knownVulnerabilities = [ "CVE-2023-28531" ]; }; }; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 70f9273827fe..2a4c4a8647dc 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -15388,9 +15388,10 @@ with pkgs; gcc-arm-embedded-12 = callPackage ../development/compilers/gcc-arm-embedded/12 { }; gcc-arm-embedded = gcc-arm-embedded-12; - # Has to match the default gcc so that there are no linking errors when - # using C/C++ libraries in D packages - gdc = wrapCC (gcc.cc.override { + # It would be better to match the default gcc so that there are no linking errors + # when using C/C++ libraries in D packages, but right now versions >= 12 are broken. + gdc = gdc11; + gdc11 = wrapCC (gcc11.cc.override { name = "gdc"; langCC = false; langC = false;