Merge staging-next-25.11 into staging-25.11

2026-06-05 21:03:40 +00:00 · 2026-05-02 00:40:07 +00:00
parent b08a90504d c05a366604
commit 63b2b54734
22 changed files with 343 additions and 315 deletions
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
@@ -9,11 +9,11 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "140.10.0esr";
+  version = "140.10.1esr";
  applicationName = "Firefox ESR";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "56b274df21d0a908e826af6dda89a42b77fb0f597b75542b0330d448ae22be07a3636a3187ff1b488e466cc8c5264a8a75f79901354a49e35a3e99dcb0852514";
+    sha512 = "aa3481dbdda0a302acefff52007ba2e6927962523408b942a7df673e80618fc381faf1ca70ebaac3760645bf7cb382b85658af49beca705cd636ce9de58349a5";
  };

  meta = {
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@

 let
  pname = "brave";
-  version = "1.89.143";
+  version = "1.89.145";

  allArchives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-js8JQ0W13W7wwjd7+WsA6UHkB80NhkA3Vsj6e13ULBs=";
+      hash = "sha256-WcLCmhbALtVHL4LEPCUyLfRZR30kdc/41pfHxvE0rJQ=";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-PwicpQOZBlKGf5BbKS2w6vA5izUXfL20Ogv9JYDLu7U=";
+      hash = "sha256-t7OXN+42gXd/b9fE8sd40aH2l/nW2OvtLvHCqb7/1qI=";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-rPozAtmeZ/XccmZwj8WvNox44ImI0GjNqgYQ3cZbaT4=";
+      hash = "sha256-A5SGxb+r0wEbdo7ZkUrwm6zVr86+vpOvtfBpZivmNoE=";
    };
    x86_64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-a2pzldxCk76Z6gplcpOVB56XWVgOeVsq+oMKl4QTYVU=";
+      hash = "sha256-kTk6BeKuGkteKlGBk2b5ftDeo9F+EaWwk4DoEzlfJGw=";
    };
  };

--- a/pkgs/by-name/ed/edhm-ui/package.nix
+++ b/pkgs/by-name/ed/edhm-ui/package.nix
@@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "edhm-ui";
-  version = "3.0.63";
+  version = "3.0.64";

  strictDeps = true;

  src = fetchzip {
    url = "https://github.com/BlueMystical/EDHM_UI/releases/download/v${finalAttrs.version}/edhm-ui-v3-linux-x64.zip";
-    hash = "sha256-f+nVupCywLlZYLKB8O1tGJKOKq3zT8PQM5mjLcp2MOY=";
+    hash = "sha256-kBCaQKGO8ySpquEWh91GyqHfHCem5q1gyVdYuWdaMB8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gr/grocy/package.nix
+++ b/pkgs/by-name/gr/grocy/package.nix
@@ -21,7 +21,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-qdN+stXuwChv6IaFSX2SrSdej7Id/M0UaO2cggAvWdc=";
  };

-  vendorHash = "sha256-3f7me/YG2lt7fhkgXO1+0SXO+1IK+Fdb3/gywWyaxVg=";
+  vendorHash = "sha256-QqG8+LMDrZz8CexmfDK18TWvdQCR9N7oJLjzcCQkzmA=";

  offlineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
--- a/pkgs/by-name/la/lazyhetzner/package.nix
+++ b/pkgs/by-name/la/lazyhetzner/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "lazyhetzner";
-  version = "1.2.0";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "grammeaway";
    repo = "lazyhetzner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G7IfB/tnhPKf/tG0b2HKUshc4x+AySiHlJZNSlOJr2I=";
+    hash = "sha256-yQgDegmwDD70mX38SInP2KhO3GdLpFY6Hr/JxP4RRoI=";

    leaveDotGit = true;
    postFetch = ''
--- a/pkgs/by-name/li/librechat/package.nix
+++ b/pkgs/by-name/li/librechat/package.nix
@@ -92,5 +92,9 @@ buildNpmPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ niklaskorz ];
    mainProgram = "librechat-server";
+    knownVulnerabilities = [
+      "CVE-2026-34371"
+      "CVE-2026-31949"
+    ];
  };
 }
--- a/pkgs/by-name/li/littlegptracker/package.nix
+++ b/pkgs/by-name/li/littlegptracker/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "littlegptracker";
-  version = "1.4.2";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "djdiskmachine";
    repo = "littlegptracker";
    tag = finalAttrs.version;
-    hash = "sha256-1uXC5nJ63YguQuNIkuK0yx9lmrMBqw0WdlmCV8o11cE=";
+    hash = "sha256-j6r2iFJ3YJ3XOHwn/ENQmpZyIdMAdrWXd+EO3EWIBCw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ma/matrix-continuwuity/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix
@@ -38,17 +38,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-continuwuity";
-  version = "0.5.7";
+  version = "0.5.8";

  src = fetchFromGitea {
    domain = "forgejo.ellis.link";
    owner = "continuwuation";
    repo = "continuwuity";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DrW31VesYipZlFpCoCv4Sj4BtKeAF9/UpWhZjBIrXH4=";
+    hash = "sha256-o7bZMSsdSt6VOrsuSMrS7fU9u/LrdD/579IMvsZH+ss=";
  };

-  cargoHash = "sha256-E4eqPTLTilqMdIJ9MHbMbu5zTpqEqNPPo3rMS+sA8uA=";
+  cargoHash = "sha256-QM4K5TmWWRTcrovAvvEbXEraI4C0vMSJ68Z/6kHhOr8=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,19 +14,19 @@

 python3Packages.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.151.0";
+  version = "1.152.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-Ha0GXVdOyAqBwC0iRX41kZSW9onutdsfkhn7z/fNai8=";
+    hash = "sha256-cjc9vC3sfsFaxcxEpXAAAza9/p3fk/2oCa4oB1fWAdA=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-bEAXUoyerS7KjP1f15Z+5nktX1H7Mx4wATJBRfbJW+4=";
+    hash = "sha256-RwUsiS6JM5dmqquKVtyaBp67DYZys6Uecy0V6AabTk4=";
  };

  build-system =
--- a/pkgs/by-name/nb/nbd/package.nix
+++ b/pkgs/by-name/nb/nbd/package.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/NetworkBlockDevice/nbd/commit/915444bc0b8a931d32dfb755542f4bd1d37f1449.patch";
      hash = "sha256-6z+c2cXhY92WPDqRO6AJ5BBf1N38yTgOE1foduIr5Dg=";
    })
+    # Update test certificate expiry dates
+    (fetchpatch {
+      url = "https://github.com/NetworkBlockDevice/nbd/commit/58b356bd19e63e39aae9a5d24a66c3f42bd17180.patch";
+      hash = "sha256-2P1C7X6dQogDBWrcR9D54QInbNzNbKKYLQp/dR8briQ=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/qb/qbz/package.nix
+++ b/pkgs/by-name/qb/qbz/package.nix
@@ -22,16 +22,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "qbz";
-  version = "1.2.8";
+  version = "1.2.10";

  src = fetchFromGitHub {
    owner = "vicrodh";
    repo = "qbz";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-I5j1rpcAT7NNG/KtHwUUwvHjLIJB/+PAfPZJUvTsZTE=";
+    hash = "sha256-cPe7J0KtcTQFfjhNL9giRPLx2VwHsUYRDV/ZM/2dFas=";
  };

-  cargoHash = "sha256-fPowLCj7+ZY6aNZ8UTMhVI4UFW+CM9Y6b7OXqJycYaw=";
+  cargoHash = "sha256-tmXcLNu8ejYTP13b+Ir1ExtRrsEXsUcULUgIX9gzltU=";
  cargoRoot = "src-tauri";
  buildAndTestSubdir = finalAttrs.cargoRoot;

@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  npmDeps = fetchNpmDeps {
    name = "qbz-${finalAttrs.version}-npm-deps";
    inherit (finalAttrs) src;
-    hash = "sha256-0J86UrIoTL735I/7plyCfU2WxBcFXBt6g1tLXO+6JMI=";
+    hash = "sha256-MYBxnLGSz4MyrpdNKUIBtnA6HFimPwrcEOYOGSbS5AY=";
  };

  env.LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
--- a/pkgs/by-name/rg/rgx/package.nix
+++ b/pkgs/by-name/rg/rgx/package.nix
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rgx";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "brevity1swos";
    repo = "rgx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JLFJGMwKQqkrVwck6gd79AzSVL0fRHJ8jo73+EEdYlA=";
+    hash = "sha256-05WEJ3gefPjBHuMXWhr135VtYnbteZapiAtNKwm4wxU=";
  };

-  cargoHash = "sha256-D609cDiJ+L/iGtC9dKwU5dgz4+X3//6qiFjWixBBqhg=";
+  cargoHash = "sha256-CSGuf2jOjyLBfD0Fv3G01FioiyiXX8Bx/IiCkIBWbsQ=";

  buildInputs = [ pcre2 ];

--- a/pkgs/by-name/sh/shogihome/package.nix
+++ b/pkgs/by-name/sh/shogihome/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "shogihome";
-  version = "1.27.0";
+  version = "1.27.1";

  src = fetchFromGitHub {
    owner = "sunfish-shogi";
    repo = "shogihome";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T1MgcqCi9rwN86vgCAshokznMXh+masFLcO43sz2bo0=";
+    hash = "sha256-Uns66oj5TGlIgOTayRqFa8wGntbgm9Molerzn5yJWDE=";
  };

-  npmDepsHash = "sha256-5tZQCxql6jZAEU+e/hkQYnaHy1l5dWaH/p2rbGDAX14=";
+  npmDepsHash = "sha256-xl4B77luiMTT1L7E4FXP3q2lZT2WhUhH9zDu1HYAjQ0=";

  postPatch = ''
    substituteInPlace package.json \
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -275,8 +275,9 @@ stdenv.mkDerivation (finalAttrs: {
      --add-flags ${lib.escapeShellArg commandLineArgs}
  ''
  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    mkdir -p $out/share
+    mkdir -p $out/share/polkit-1/actions
    cp -r dist/*-unpacked/resources $out/share/signal-desktop
+    mv $out/share/signal-desktop/*.policy $out/share/polkit-1/actions/

    for icon in build/icons/png/*
    do
--- a/pkgs/by-name/wa/wasm-pack/package.nix
+++ b/pkgs/by-name/wa/wasm-pack/package.nix
@@ -7,18 +7,18 @@
  zstd,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wasm-pack";
-  version = "0.13.1";
+  version = "0.14.0";

  src = fetchFromGitHub {
-    owner = "rustwasm";
+    owner = "wasm-bindgen";
    repo = "wasm-pack";
-    tag = "v${version}";
-    hash = "sha256-CN1LcLX7ag+in9sosT2NYVKfhDLGv2m3zHOk2T4MFYc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ik6AJUKuT3GCDTZbHWcplcB7cS0CIcZwFNa6SvGzsIQ=";
  };

-  cargoHash = "sha256-nYWvk2v+4IAk/y7fg+Z/nMH+Ml+J5k5ER8uudCQOMB8=";
+  cargoHash = "sha256-n9xuwlj8+3fDTHMS2XobqWFc6mNHQcmmvebRDc82oSo=";

  nativeBuildInputs = [
    cmake
@@ -32,13 +32,17 @@ rustPlatform.buildRustPackage rec {
  doCheck = false;

  meta = {
+    changelog = "https://github.com/wasm-bindgen/wasm-pack/blob/v${finalAttrs.version}/CHANGELOG.md";
    description = "Utility that builds rust-generated WebAssembly package";
    mainProgram = "wasm-pack";
-    homepage = "https://github.com/rustwasm/wasm-pack";
+    homepage = "https://github.com/wasm-bindgen/wasm-pack";
    license = with lib.licenses; [
      asl20 # or
      mit
    ];
-    maintainers = [ lib.maintainers.dhkl ];
+    maintainers = with lib.maintainers; [
+      dhkl
+      hythera
+    ];
  };
-}
+})
--- a/pkgs/by-name/wi/wireshark/package.nix
+++ b/pkgs/by-name/wi/wireshark/package.nix
@@ -59,7 +59,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.6.4";
+  version = "4.6.5";

  outputs = [
    "out"
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
    repo = "wireshark";
    owner = "wireshark";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-h254dXxloBC5xQYcpeaLlAj2Ip4eQWHYSPPJLkIwQZw=";
+    hash = "sha256-Zvrwxjp4LK2J3QnxmPxKKrU01YHQvPyp54UWzeGNCjA=";
  };

  patches = [
@@ -226,7 +226,7 @@ stdenv.mkDerivation (finalAttrs: {
      experts. It runs on UNIX, macOS and Windows.
    '';
    homepage = "https://www.wireshark.org";
-    changelog = "https://www.wireshark.org/docs/relnotes/wireshark-${finalAttrs.src.tag}.html";
+    changelog = "https://www.wireshark.org/docs/relnotes/wireshark-${finalAttrs.version}.html";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    maintainers = with lib.maintainers; [
--- a/pkgs/desktops/lomiri/applications/lomiri-mediaplayer-app/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri-mediaplayer-app/default.nix
@@ -116,8 +116,8 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Media Player application for Ubuntu Touch devices";
-    homepage = "https://gitlab.com/ubports/development/apps/lomiri-mediaplayer-app";
-    changelog = "https://gitlab.com/ubports/development/apps/lomiri-mediaplayer-app/-/blob/${
+    homepage = "https://gitlab.com/ubports/development/core/lomiri-mediaplayer-app";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-mediaplayer-app/-/blob/${
      if (!isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
    }/ChangeLog";
    license = with lib.licenses; [
--- a/pkgs/development/python-modules/requests-hardened/default.nix
+++ b/pkgs/development/python-modules/requests-hardened/default.nix
@@ -14,14 +14,14 @@
 }:
 buildPythonPackage rec {
  pname = "requests-hardened";
-  version = "1.2.0";
+  version = "1.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "saleor";
    repo = "requests-hardened";
    tag = "v${version}";
-    hash = "sha256-J4xQY2W5upJQ3hrA2hjkw8voLpxNPpekNwmyMKKAVAo=";
+    hash = "sha256-tvSS3z1fhQdcxvsj5vK//mr5xYeIrLl+6/gtnWsiETk=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/kde/frameworks/kcoreaddons/default.nix
+++ b/pkgs/kde/frameworks/kcoreaddons/default.nix
@@ -1,5 +1,6 @@
 {
  mkKdeDerivation,
+  fetchpatch,
  qttools,
  shared-mime-info,
  qtdeclarative,
@@ -7,6 +8,14 @@
 mkKdeDerivation {
  pname = "kcoreaddons";

+  patches = [
+    # https://kde.org/info/security/advisory-20260427-1.txt
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/kcoreaddons/-/commit/6153c9ae025fa570174bb4a143df38fa2f46606b.diff";
+      hash = "sha256-eFHEW7wEuOXClCAoBeo3lpmNcDg1YMwhBcr24pE6Urk=";
+    })
+  ];
+
  hasPythonBindings = true;

  extraNativeBuildInputs = [
--- a/pkgs/kde/gear/dolphin/default.nix
+++ b/pkgs/kde/gear/dolphin/default.nix
@@ -1,10 +1,16 @@
 {
  mkKdeDerivation,
+  fetchpatch,
  qtmultimedia,
 }:
 mkKdeDerivation {
  pname = "dolphin";
  patches = [
+    # https://kde.org/info/security/advisory-20260427-2.txt
+    (fetchpatch {
+      url = "https://invent.kde.org/system/dolphin/-/commit/42f099a5ba10e8948cae8f7e364c94129131326c.diff";
+      hash = "sha256-DethSnRpjD2rado9/Isdod6fl4hfH3rvL7Pfr+mZ5QU=";
+    })
    # backported fix for https://bugs.kde.org/show_bug.cgi?id=451050
    ./dolphin-samba-crash-fix.patch
  ];
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
  args
  // rec {
-    version = "6.19.9";
+    version = "7.0.3";
    pname = "linux-zen";
    modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
    isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
      owner = "zen-kernel";
      repo = "zen-kernel";
      rev = "v${version}-${suffix}";
-      sha256 = "09wlnd8ndm4r75ywk2sanmkc0v788rz9faa61hcfschw5pq5yzx6";
+      sha256 = "16qbgrqq8wkp5gyy60n6rabpbyv47imaw9pnndg2mzisbb3cb808";
    };

    # This is based on the following source:
@@ -45,7 +45,6 @@ buildLinux (

      # Preempt (low-latency)
      PREEMPT = mkKernelOverride yes;
-      PREEMPT_VOLUNTARY = mkKernelOverride no;
      PREEMPT_LAZY = mkKernelOverride no;

      # Preemptible tree-based hierarchical RCU