From 64b70c3a1de59cfdd9fde9ed65764fbf2d3576ee Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 03:11:17 +0200
Subject: [PATCH] discourse: 2026.1.3 -> 2026.1.4

https://releases.discourse.org/changelog/v2026.1.4/

Fixes:

- CVE-2026-44779
  Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44782
  GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44783
  Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44786
  Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-45085
  Chat misauthorization and information disclosure
- CVE-2026-44784
  Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44785
  Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-45775
  Cross-site backup access via path traversal in multisite local backups
- (CVE Pending)
  Don't leak restricted tag group names via tag info
- CVE-2026-34154
  Subscription access bypass in discourse-subscriptions plugin
- CVE-2026-33514
  Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-44780
  Category queue reviewers can read raw incoming emails from queued posts
- (CVE Pending)
  Prevent webhook payload disclosure on event redelivery
- CVE-2026-32244
  Cached outdated summaries can leak removed content

(cherry picked from commit bf49b3336792dc353ad9b2acb04c5847f18c1e1c)
---
 pkgs/servers/web-apps/discourse/default.nix          | 4 ++--
 pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock | 4 ++--
 pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index a2cbfb0aec14..e56a11cea8a2 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -53,13 +53,13 @@
 }:
 
 let
-  version = "2026.1.3";
+  version = "2026.1.4";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-0jbO1rJQ0AISo7h+SZfovubReCjR2zT6KWX9LxBeFtE=";
+    sha256 = "sha256-kQYDKZIMsWByuCZQfUlwhoIew5QykVylRMh6xvrHIBY=";
   };
 
   ruby = ruby_3_3;
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index 01df10a128c3..2183789763f8 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -304,7 +304,7 @@ GEM
     mini_sql (1.6.0)
     mini_suffix (0.3.3)
       ffi (~> 1.9)
-    minio_runner (1.0.0)
+    minio_runner (1.0.1)
     minitest (5.26.2)
     mocha (2.8.2)
       ruby2_keywords (>= 0.0.5)
@@ -1082,7 +1082,7 @@ CHECKSUMS
   mini_scheduler (0.18.0) sha256=d2f084f38da8d76c5844a92f0d6bd01fc9982a8b5e6c7679b6cf44c82da33503
   mini_sql (1.6.0) sha256=5296637f6a4af5bb43e06788037e9a2968ff9c8eb65928befcba8cb41f42d6ee
   mini_suffix (0.3.3) sha256=8d1d33f92f69a2247c9b7d27173235da90479d955cdb863b63a7f53843b722e7
-  minio_runner (1.0.0) sha256=ca0fc56a90c63b65a26cda632938c9075046835d41f4b9d1e165b0550eae0538
+  minio_runner (1.0.1) sha256=3675ad7abd79177b3fdd9f37e20fe46f7d4dcbb41f3f30a53db2207277241795
   minitest (5.26.2) sha256=f021118a6185b9ba9f5af71f2ba103ad770c75afde9f2ab8da512677c550cde3
   mocha (2.8.2) sha256=1f77e729db47e72b4ef776461ce20caeec2572ffdf23365b0a03608fee8f4eee
   msgpack (1.8.0) sha256=e64ce0212000d016809f5048b48eb3a65ffb169db22238fb4b72472fecb2d732
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
index 2d77c94cb35b..ab25c69fbcb2 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -1781,10 +1781,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f05mq75bc35w78vkx21bn1lcl07r4w2jqysdji6afy6j1mca3ya";
+      sha256 = "158p4ivp485j7njk0gqznk5lszbgwh7y4dwzvlzpn5vrpmxasx9n";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
   };
   minitest = {
     groups = [