From af39f23d9858e09c2c0b59c4f69893a689386d5b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 4 Jun 2026 01:59:10 +0000 Subject: [PATCH 01/56] acli: 1.3.18-stable -> 1.3.19-stable (cherry picked from commit 117f4a6e31a83514c788532035b5985f4ee8de0b) --- pkgs/by-name/ac/acli/sources.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/by-name/ac/acli/sources.json b/pkgs/by-name/ac/acli/sources.json index d166f3b4524c..0a8aa45e4ab9 100644 --- a/pkgs/by-name/ac/acli/sources.json +++ b/pkgs/by-name/ac/acli/sources.json @@ -1,21 +1,21 @@ { - "version": "1.3.18-stable", + "version": "1.3.19-stable", "sources": { "aarch64-darwin": { - "url": "https://acli.atlassian.com/darwin/1.3.18-stable/acli_1.3.18-stable_darwin_arm64.tar.gz", - "sha256": "9e4890e441e2762adbb6bd94451fdea554177806a6044469ece7b14e603d2040" + "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_arm64.tar.gz", + "sha256": "c5f1b1f6db63972d126a2f8ac9aca9a199739c7b51ac9e352e8ae3ed2b27131c" }, "aarch64-linux": { - "url": "https://acli.atlassian.com/linux/1.3.18-stable/acli_1.3.18-stable_linux_arm64.tar.gz", - "sha256": "ac71711da43649854689ad0f74e44f18b0da3fd0ee776ceb4307ae7eb1e5da85" + "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_arm64.tar.gz", + "sha256": "72972e74fa9036c5b40175570234a2e79559776c06a3aa29f632a39c7d3674da" }, "x86_64-darwin": { - "url": "https://acli.atlassian.com/darwin/1.3.18-stable/acli_1.3.18-stable_darwin_amd64.tar.gz", - "sha256": "4078846601b2e222ecbbc6b314a1c58ca6c41c18d1b118833814c942be00befe" + "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_amd64.tar.gz", + "sha256": "394096ecd5a6082cbbbc8b2f3e1f1fbe694cdb340e25a4014eeb78461b869beb" }, "x86_64-linux": { - "url": "https://acli.atlassian.com/linux/1.3.18-stable/acli_1.3.18-stable_linux_amd64.tar.gz", - "sha256": "4ad4badc481ac1eff452f531c405a20422eb57513cc898d2a1f8ea945d6c24f6" + "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_amd64.tar.gz", + "sha256": "f29fa8b7f01710053c2f4e07723501ebfe448672b669d32d83e961686d383a6d" } } } From b0fdea5f9951bf86a784c61e0c8fad9faba615f0 Mon Sep 17 00:00:00 2001 From: Alex Epelde Date: Sat, 13 Jun 2026 08:55:01 -0400 Subject: [PATCH 02/56] python3Packages.low-index: add update script The default `nix-update-script { }` does not work. (cherry picked from commit 2a73bf3e84bb0db4c76da5420172a9a3512d4d36) --- pkgs/development/python-modules/low-index/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/development/python-modules/low-index/default.nix b/pkgs/development/python-modules/low-index/default.nix index c753e78d2ff5..0f0a48415c0e 100644 --- a/pkgs/development/python-modules/low-index/default.nix +++ b/pkgs/development/python-modules/low-index/default.nix @@ -4,6 +4,7 @@ buildPythonPackage, fetchFromGitHub, setuptools, + nix-update-script, }: buildPythonPackage rec { @@ -28,6 +29,13 @@ buildPythonPackage rec { runHook postCheck ''; + passthru.updateScript = nix-update-script { + extraArgs = [ + "--version-regex" + "v(.*)_as_released" + ]; + }; + meta = { description = "Enumerates low index subgroups of a finitely presented group"; changelog = "https://github.com/3-manifolds/low_index/releases/tag/${src.tag}"; From e367fdbde4f01d574ff1f46e07c7a7eea622a266 Mon Sep 17 00:00:00 2001 From: Alex Epelde Date: Sat, 13 Jun 2026 08:55:28 -0400 Subject: [PATCH 03/56] python3Packages.low-index: 1.2.1 -> 1.3 (cherry picked from commit 5d6d986a6466f2f0485de3ca04da3d0c8c945ee6) --- pkgs/development/python-modules/low-index/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/low-index/default.nix b/pkgs/development/python-modules/low-index/default.nix index 0f0a48415c0e..6bd1711c40ee 100644 --- a/pkgs/development/python-modules/low-index/default.nix +++ b/pkgs/development/python-modules/low-index/default.nix @@ -9,14 +9,14 @@ buildPythonPackage rec { pname = "low-index"; - version = "1.2.1"; + version = "1.3"; pyproject = true; src = fetchFromGitHub { owner = "3-manifolds"; repo = "low_index"; tag = "v${version}_as_released"; - hash = "sha256-T8hzC9ulikQ1pUdbXgjuKAX5oMJEycPvXWv74rCkQGY="; + hash = "sha256-m3p05bqu70pMOsb9drW1B6+N893eBSZBFTNNS23OY6w="; }; build-system = [ setuptools ]; From 4fb761dc507802f684c4e3110a7361f651087847 Mon Sep 17 00:00:00 2001 From: Maga Date: Fri, 24 Apr 2026 11:20:41 -0400 Subject: [PATCH 04/56] ankama-launcher: 3.14.8 -> 3.14.9 (cherry picked from commit 030e8fdbbd01db69aabda5014b49dbd6710a6a15) --- pkgs/by-name/an/ankama-launcher/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/an/ankama-launcher/package.nix b/pkgs/by-name/an/ankama-launcher/package.nix index 8b7510c8831e..39dc447a9d26 100644 --- a/pkgs/by-name/an/ankama-launcher/package.nix +++ b/pkgs/by-name/an/ankama-launcher/package.nix @@ -5,15 +5,15 @@ }: let pname = "ankama-launcher"; - version = "3.14.8"; + version = "3.14.9"; # The original URL for the launcher is: # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL. # To update the client, head to web.archive.org and create a new snapshot of the download page. src = fetchurl { - url = "https://web.archive.org/web/20260413125512/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage"; - hash = "sha256-wHLzF30ZeTgBG1TFlkSt0Tsm82cNb/C/eTUZjjYsgVE="; + url = "https://web.archive.org/web/20260424144939/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage"; + hash = "sha256-MkXOlMlBSVCgdxbtwlyO7XdCxY6ZSzuouLxbLelxrJ4="; }; appimageContents = appimageTools.extract { inherit pname version src; }; From 9069a02ad69268e499182d3c4eae938529f6f572 Mon Sep 17 00:00:00 2001 From: Maga Date: Thu, 4 Jun 2026 22:00:57 -0400 Subject: [PATCH 05/56] ankama-launcher: 3.14.9 -> 3.14.14 (cherry picked from commit b2dafe7ca437dad7b8ab30ea75afa5ca3177c310) --- pkgs/by-name/an/ankama-launcher/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/an/ankama-launcher/package.nix b/pkgs/by-name/an/ankama-launcher/package.nix index 39dc447a9d26..c0791db9e72e 100644 --- a/pkgs/by-name/an/ankama-launcher/package.nix +++ b/pkgs/by-name/an/ankama-launcher/package.nix @@ -5,15 +5,15 @@ }: let pname = "ankama-launcher"; - version = "3.14.9"; + version = "3.14.14"; # The original URL for the launcher is: # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL. # To update the client, head to web.archive.org and create a new snapshot of the download page. src = fetchurl { - url = "https://web.archive.org/web/20260424144939/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage"; - hash = "sha256-MkXOlMlBSVCgdxbtwlyO7XdCxY6ZSzuouLxbLelxrJ4="; + url = "https://web.archive.org/web/20260605015300/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage"; + hash = "sha256-9w1ho9DZvDHXQbXjpMY1wnWDwYlMKO1igrJcCahQkVQ="; }; appimageContents = appimageTools.extract { inherit pname version src; }; From e64ceeb7276d440d727ed3d5cf2b42f4cd8556a4 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 7 Jun 2026 01:21:52 +0000 Subject: [PATCH 06/56] inventree: 1.3.0 -> 1.3.3 (cherry picked from commit 1bde1ef100af9c5586ad3292b6328cb4be7e2a3b) --- pkgs/by-name/in/inventree/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/in/inventree/package.nix b/pkgs/by-name/in/inventree/package.nix index 8395a06f3d56..b40201deee1e 100644 --- a/pkgs/by-name/in/inventree/package.nix +++ b/pkgs/by-name/in/inventree/package.nix @@ -14,12 +14,12 @@ }: let - version = "1.3.0"; + version = "1.3.3"; src = fetchFromGitHub { owner = "inventree"; repo = "inventree"; tag = "${version}"; - hash = "sha256-nsGqfm7XTwHblvqHmsMo8yQgl7ZtbtPdjOfrpXSQbn0="; + hash = "sha256-Xh3YcVz5OLQ596uWUEac87CKi62xgr63dYiYb6U6qXQ="; postCheckout = '' git -C $out rev-parse HEAD > $out/commit_hash.txt git -C $out show -s --format=%cd --date=short HEAD > $out/commit_date.txt From 8c0926b4d2610f144dddfcdd122fce5dced3640a Mon Sep 17 00:00:00 2001 From: Mynacol Date: Sat, 23 May 2026 08:27:08 +0000 Subject: [PATCH 07/56] deno: 2.7.14 -> 2.8.0, rusty-v8: 147.4.0 -> 149.0.0 This also adapts the patches to work with LLVM 21, drops the adler/adler2 flags, but has to add a symlink in third_party/rust-toolchain, else rustc isn't found (and the gn rust_sysroot_absolute should stay as well to set internal gn args that this is a stable rust toolchain). (cherry picked from commit 2f37da318ed8a59f26b2c06adab89f7e18ff3e28) --- pkgs/by-name/de/deno/package.nix | 6 +- pkgs/by-name/de/deno/rusty-v8/default.nix | 25 ++--- .../de/deno/rusty-v8/gn_inputs_fix.patch | 105 ++++++++++++++++++ ...librusty_v8_revert_-fno-lifetime-dse.patch | 19 ---- pkgs/by-name/de/deno/rusty-v8/llvm22.patch | 60 ++++++++++ 5 files changed, 177 insertions(+), 38 deletions(-) create mode 100644 pkgs/by-name/de/deno/rusty-v8/gn_inputs_fix.patch delete mode 100644 pkgs/by-name/de/deno/rusty-v8/librusty_v8_revert_-fno-lifetime-dse.patch create mode 100644 pkgs/by-name/de/deno/rusty-v8/llvm22.patch diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix index 0efdeb47fcdc..a87145cb0ca0 100644 --- a/pkgs/by-name/de/deno/package.nix +++ b/pkgs/by-name/de/deno/package.nix @@ -32,17 +32,17 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "deno"; - version = "2.7.14"; + version = "2.8.0"; src = fetchFromGitHub { owner = "denoland"; repo = "deno"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; # required for tests - hash = "sha256-tkZc89JOhXCdMVSAOQYGR6HDe7KmCI5/haLH1RP2p7I="; + hash = "sha256-gcDQ2nkiLtnOJCneiHAWwvYxHUwQ/2n2lsmWAMgf/yc="; }; - cargoHash = "sha256-bFQLsAF4hFBRw04VaL+sxvxIZ9p7nXOLSr2BIZKcwiI="; + cargoHash = "sha256-1vHgkLWqwTt3tO4qSkfqwCj5KMfKCT3kscChf2FrkH8="; patches = [ ./patches/0002-tests-replace-hardcoded-paths.patch diff --git a/pkgs/by-name/de/deno/rusty-v8/default.nix b/pkgs/by-name/de/deno/rusty-v8/default.nix index b58fd23d14fc..ab09655bac5f 100644 --- a/pkgs/by-name/de/deno/rusty-v8/default.nix +++ b/pkgs/by-name/de/deno/rusty-v8/default.nix @@ -70,34 +70,26 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "rusty-v8"; - version = "147.4.0"; + version = "149.0.0"; src = fetchFromGitHub { owner = "denoland"; repo = "rusty_v8"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; - hash = "sha256-cS9oBDY2+9RtdqPuOadNl0Lce89ESpBb1qPiWSHPiCg="; + hash = "sha256-OdVz8d8hkBhXZnX9vKV51rlHAYN2PbVycmqrDWNLV5M="; }; patches = [ ./librusty_v8_no_downloads.patch - (fetchpatch { - name = "chromium-146-revert-Update-fsanitizer=array-bounds-config.patch"; - # https://chromium-review.googlesource.com/c/chromium/src/+/7539408 - url = "https://chromium.googlesource.com/chromium/src/+/acb47d9a6b56c4889a2ed4216e9968cfc740086c^!?format=TEXT"; - decode = "base64 -d"; - revert = true; - includes = [ "build/config/compiler/BUILD.gn" ]; - hash = "sha256-0yEK66IEyS8xABDHY4W8oIvl4Ga1JfL1wxQy8PhXyqI="; - }) - ./librusty_v8_revert_-fno-lifetime-dse.patch + ./llvm22.patch + ./gn_inputs_fix.patch ] ++ lib.optionals stdenv.targetPlatform.isDarwin [ ./librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch ]; - cargoHash = "sha256-e/G9AevaJwqYdr8022kmv05Mwzi4Cishj9imLproNB0="; + cargoHash = "sha256-uj1B3lkgbZG5emJgfsilJXdHbqg0JNAywaSVLe/LbWk="; nativeBuildInputs = [ llvmPackages.clang @@ -119,6 +111,10 @@ rustPlatform.buildRustPackage (finalAttrs: { apple-sdk_15 ]; + postPatch = '' + ln -sv ${rustToolchain} third_party/rust-toolchain + ''; + env = { V8_FROM_SOURCE = 1; PYTHON = "python3"; @@ -132,9 +128,6 @@ rustPlatform.buildRustPackage (finalAttrs: { "rustc_version=\"${rustc.version}\"" "rust_sysroot_absolute=\"${rustToolchain}\"" "rust_bindgen_root=\"${rustToolchain}\"" - # To accomodate our newer rustc compiler - "removed_rust_stdlib_libs=[\"adler\"]" - "added_rust_stdlib_libs=[\"adler2\"]" ] ++ lib.optional stdenv.targetPlatform.isDarwin "mac_deployment_target=\"${stdenv.targetPlatform.darwinMinVersion}\"" ); diff --git a/pkgs/by-name/de/deno/rusty-v8/gn_inputs_fix.patch b/pkgs/by-name/de/deno/rusty-v8/gn_inputs_fix.patch new file mode 100644 index 000000000000..19a8a7a86a0a --- /dev/null +++ b/pkgs/by-name/de/deno/rusty-v8/gn_inputs_fix.patch @@ -0,0 +1,105 @@ +Submodule build contains modified content +diff --git a/build/toolchain/gcc_toolchain.gni b/build/toolchain/gcc_toolchain.gni +index b9b5b0d76..4004f306e 100644 +--- a/build/toolchain/gcc_toolchain.gni ++++ b/build/toolchain/gcc_toolchain.gni +@@ -712,7 +712,6 @@ template("single_gcc_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $libname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_rlib") { +@@ -745,7 +744,6 @@ template("single_gcc_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $rlibname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_bin") { +@@ -767,7 +765,6 @@ template("single_gcc_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $exename -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_cdylib") { +@@ -790,7 +787,6 @@ template("single_gcc_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_dylib") { +@@ -815,7 +811,6 @@ template("single_gcc_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $dllname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_macro") { +@@ -838,7 +833,6 @@ template("single_gcc_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"${invoker.cxx}\" {{source}} LDFLAGS {{ldflags}} ${extra_ldflags} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + } + +diff --git a/build/toolchain/apple/toolchain.gni b/build/toolchain/apple/toolchain.gni +index 0aa4e736f..e3f59728d 100644 +--- a/build/toolchain/apple/toolchain.gni ++++ b/build/toolchain/apple/toolchain.gni +@@ -325,7 +325,6 @@ template("single_apple_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $libname -- -Clinker=\"$_cxx\" {{source}} LDFLAGS $bin_flag RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_rlib") { +@@ -359,7 +358,6 @@ template("single_apple_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $rlibname -- -Clinker=\"$_cxx\" {{source}} LDFLAGS RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_bin") { +@@ -392,7 +390,6 @@ template("single_apple_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$linker_driver_env $rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $exename -- -Clinker=\"$linker_driver\" {{source}} LDFLAGS $linker_driver_args $bin_flag {{ldflags}} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_cdylib") { +@@ -427,7 +424,6 @@ template("single_apple_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$linker_driver_env $rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"$linker_driver\" {{source}} LDFLAGS $linker_driver_args $bin_flag {{ldflags}} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_dylib") { +@@ -464,7 +460,6 @@ template("single_apple_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$linker_driver_env $rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link,metadata=$rmetaname -o $dllname -- -Clinker=\"$linker_driver\" {{source}} LDFLAGS $linker_driver_args {{ldflags}} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + + tool("rust_macro") { +@@ -499,7 +494,6 @@ template("single_apple_toolchain") { + "$rustc_common_args {{rustdeps}} {{externs}} SOURCES {{sources}}" + command = "$rustc_wrapper --depfile=$depfile --emit=dep-info=$depfile,link -o $dllname -- -Clinker=\"${_cxx}\" {{source}} LDFLAGS $bin_flag {{ldflags}} RUSTENV {{rustenv}}" + rust_sysroot = rust_sysroot_relative +- inputs = rustc_wrapper_inputs + } + } + diff --git a/pkgs/by-name/de/deno/rusty-v8/librusty_v8_revert_-fno-lifetime-dse.patch b/pkgs/by-name/de/deno/rusty-v8/librusty_v8_revert_-fno-lifetime-dse.patch deleted file mode 100644 index 6035fa552d00..000000000000 --- a/pkgs/by-name/de/deno/rusty-v8/librusty_v8_revert_-fno-lifetime-dse.patch +++ /dev/null @@ -1,19 +0,0 @@ -Submodule build contains modified content -diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn -index ff8022f04..59699e1d4 100644 ---- a/build/config/compiler/BUILD.gn -+++ b/build/config/compiler/BUILD.gn -@@ -625,13 +625,6 @@ config("compiler") { - ] - } - -- # The performance improvement does not seem worth the risk. See -- # https://crbug.com/484082200 for background and https://crrev.com/c/7593035 -- # for discussion. -- if (!is_wasm) { -- cflags += [ "-fno-lifetime-dse" ] -- } -- - # TODO(hans): Remove this once Clang generates better optimized debug info - # by default. https://crbug.com/765793 - cflags += [ diff --git a/pkgs/by-name/de/deno/rusty-v8/llvm22.patch b/pkgs/by-name/de/deno/rusty-v8/llvm22.patch new file mode 100644 index 000000000000..aafc7e322e63 --- /dev/null +++ b/pkgs/by-name/de/deno/rusty-v8/llvm22.patch @@ -0,0 +1,60 @@ +Submodule build contains modified content +diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn +index 1b53cb1d4..724f867f5 100644 +--- a/build/config/compiler/BUILD.gn ++++ b/build/config/compiler/BUILD.gn +@@ -1916,7 +1916,6 @@ ubsan_hardening("c_array_bounds") { + # the related warning about "unsafe-buffer-usage-in-static-sized-array", + # since we know that the array bounds sanitizing will catch any out-of- + # bounds accesses. +- cflags = [ "-Wno-unsafe-buffer-usage-in-static-sized-array" ] + } + + # Enable UBSan subset to ensure we always hit `return` statement in non-void +diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn +index 1b53cb1d4..51367ceb2 100644 +--- a/build/config/compiler/BUILD.gn ++++ b/build/config/compiler/BUILD.gn +@@ -601,7 +601,6 @@ config("compiler") { + # Flags for diagnostics. + cflags += [ "-fcolor-diagnostics" ] + if (!is_win) { +- cflags += [ "-fdiagnostics-show-inlining-chain" ] + } else { + # Combine after https://github.com/llvm/llvm-project/pull/192241 + cflags += [ "/clang:-fdiagnostics-show-inlining-chain" ] +diff --git a/build/config/sanitizers/sanitizers.gni b/build/config/sanitizers/sanitizers.gni +index 329a2fc8b..083b635e3 100644 +--- a/build/config/sanitizers/sanitizers.gni ++++ b/build/config/sanitizers/sanitizers.gni +@@ -535,12 +535,6 @@ template("ubsan_hardening") { + "-fsanitize=${invoker.sanitizer}", + "-fsanitize-trap=${invoker.sanitizer}", + +- # Prevents `__has_feature(undefined_behavior_sanitizer)` +- # from evaluating true. Configs defined here are intended to +- # be usable even in release builds, i.e. as widely as possible. +- # It's important not to have full-on UBSan workarounds activate +- # just because we built support for a specific sanitizer. +- "-fsanitize-ignore-for-ubsan-feature=${invoker.sanitizer}", + ] + if (defined(invoker.cflags)) { + cflags += invoker.cflags +diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn +index ff8022f04..59699e1d4 100644 +--- a/build/config/compiler/BUILD.gn ++++ b/build/config/compiler/BUILD.gn +@@ -625,13 +625,6 @@ config("compiler") { + ] + } + +- # The performance improvement does not seem worth the risk. See +- # https://crbug.com/484082200 for background and https://crrev.com/c/7593035 +- # for discussion. +- if (!is_wasm) { +- cflags += [ "-fno-lifetime-dse" ] +- } +- + # TODO(hans): Remove this once Clang generates better optimized debug info + # by default. https://crbug.com/765793 + cflags += [ From 8723b96fc2c931327c73d5459b3d361d988f66d6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 5 Jun 2026 16:52:44 +0000 Subject: [PATCH 08/56] deno: 2.8.0 -> 2.8.2 (cherry picked from commit 387d7f40cc6fd6d89eba4ae56504984fe9a07c92) --- pkgs/by-name/de/deno/package.nix | 6 +++--- pkgs/by-name/de/deno/rusty-v8/default.nix | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix index a87145cb0ca0..094428943ecc 100644 --- a/pkgs/by-name/de/deno/package.nix +++ b/pkgs/by-name/de/deno/package.nix @@ -32,17 +32,17 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "deno"; - version = "2.8.0"; + version = "2.8.2"; src = fetchFromGitHub { owner = "denoland"; repo = "deno"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; # required for tests - hash = "sha256-gcDQ2nkiLtnOJCneiHAWwvYxHUwQ/2n2lsmWAMgf/yc="; + hash = "sha256-WtACDLrC1c7KxkoQgYrNavykkm8+tZmF46UU1YrLwVs="; }; - cargoHash = "sha256-1vHgkLWqwTt3tO4qSkfqwCj5KMfKCT3kscChf2FrkH8="; + cargoHash = "sha256-Og+owcfHfdFJ08Xtiye2IEvKWd2Q/7f7QzQ/898IOcQ="; patches = [ ./patches/0002-tests-replace-hardcoded-paths.patch diff --git a/pkgs/by-name/de/deno/rusty-v8/default.nix b/pkgs/by-name/de/deno/rusty-v8/default.nix index ab09655bac5f..b9865c673fa4 100644 --- a/pkgs/by-name/de/deno/rusty-v8/default.nix +++ b/pkgs/by-name/de/deno/rusty-v8/default.nix @@ -70,14 +70,14 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "rusty-v8"; - version = "149.0.0"; + version = "149.2.0"; src = fetchFromGitHub { owner = "denoland"; repo = "rusty_v8"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; - hash = "sha256-OdVz8d8hkBhXZnX9vKV51rlHAYN2PbVycmqrDWNLV5M="; + hash = "sha256-OAwfrSU1bu80+qcseUHtScVLZCTe9mY3NEfq0+hmVMg="; }; patches = [ @@ -89,7 +89,7 @@ rustPlatform.buildRustPackage (finalAttrs: { ./librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch ]; - cargoHash = "sha256-uj1B3lkgbZG5emJgfsilJXdHbqg0JNAywaSVLe/LbWk="; + cargoHash = "sha256-dkuvWJaDPmsU25f3UGifWl2GvYku6+7Htk9tm5JVpLU="; nativeBuildInputs = [ llvmPackages.clang From eb18568edf6daba327fd5b074ebe4eca072490f2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 14 Jun 2026 15:34:54 +0000 Subject: [PATCH 09/56] deno: 2.8.2 -> 2.8.3 (cherry picked from commit a8ed87e8da9d17967322f9e73115d89ac3c78e72) --- pkgs/by-name/de/deno/package.nix | 6 +++--- pkgs/by-name/de/deno/rusty-v8/default.nix | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix index 094428943ecc..8274263ecb82 100644 --- a/pkgs/by-name/de/deno/package.nix +++ b/pkgs/by-name/de/deno/package.nix @@ -32,17 +32,17 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "deno"; - version = "2.8.2"; + version = "2.8.3"; src = fetchFromGitHub { owner = "denoland"; repo = "deno"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; # required for tests - hash = "sha256-WtACDLrC1c7KxkoQgYrNavykkm8+tZmF46UU1YrLwVs="; + hash = "sha256-jOcIrZj+830XMZJcgTm0C4yDvk96dbW7RYGgyhLHS4Y="; }; - cargoHash = "sha256-Og+owcfHfdFJ08Xtiye2IEvKWd2Q/7f7QzQ/898IOcQ="; + cargoHash = "sha256-QtCkmNXOrtl4T4NSESV7J3qiyKMwMOoa4oWfTZIJRMc="; patches = [ ./patches/0002-tests-replace-hardcoded-paths.patch diff --git a/pkgs/by-name/de/deno/rusty-v8/default.nix b/pkgs/by-name/de/deno/rusty-v8/default.nix index b9865c673fa4..49aa0314a3f6 100644 --- a/pkgs/by-name/de/deno/rusty-v8/default.nix +++ b/pkgs/by-name/de/deno/rusty-v8/default.nix @@ -70,14 +70,14 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "rusty-v8"; - version = "149.2.0"; + version = "149.3.0"; src = fetchFromGitHub { owner = "denoland"; repo = "rusty_v8"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; - hash = "sha256-OAwfrSU1bu80+qcseUHtScVLZCTe9mY3NEfq0+hmVMg="; + hash = "sha256-hQfSDpdQBeQrOerXi+fI6mGCXkFH2ro90eWZX7xcwjA="; }; patches = [ @@ -89,7 +89,7 @@ rustPlatform.buildRustPackage (finalAttrs: { ./librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch ]; - cargoHash = "sha256-dkuvWJaDPmsU25f3UGifWl2GvYku6+7Htk9tm5JVpLU="; + cargoHash = "sha256-ROz8f+o/OVNKSm4Hp1z4eCI2pmlNTUpBZ5447uvVXUk="; nativeBuildInputs = [ llvmPackages.clang From 72eed56b2f44eb7e7c3a1e27adece2967959596d Mon Sep 17 00:00:00 2001 From: FraioVeio Date: Sun, 10 May 2026 00:57:47 +0200 Subject: [PATCH 10/56] anydesk: fix broken updateScript, fix multi-arch hash update (cherry picked from commit 7adb433f357744311548fa36d158191539165628) --- pkgs/by-name/an/anydesk/package.nix | 21 ++-------------- pkgs/by-name/an/anydesk/update.sh | 39 +++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 19 deletions(-) create mode 100755 pkgs/by-name/an/anydesk/update.sh diff --git a/pkgs/by-name/an/anydesk/package.nix b/pkgs/by-name/an/anydesk/package.nix index 5e0d5804dbf2..28c2e9e83788 100644 --- a/pkgs/by-name/an/anydesk/package.nix +++ b/pkgs/by-name/an/anydesk/package.nix @@ -4,8 +4,8 @@ fetchurl, makeWrapper, makeDesktopItem, - genericUpdater, writeShellScript, + jq, atk, cairo, gdk-pixbuf, @@ -164,24 +164,7 @@ stdenv.mkDerivation (finalAttrs: { ''; passthru = { - updateScript = genericUpdater { - versionLister = - let - arch = - if system == "x86_64-linux" then - "amd64" - else if system == "aarch64-linux" then - "arm64" - else - throw "cannot update AnyDesk on ${system}"; - in - writeShellScript "anydesk-versionLister" '' - curl -s https://anydesk.com/en/downloads/linux \ - | grep "https://[a-z0-9._/-]*-${arch}.tar.gz" -o \ - | uniq \ - | sed 's,.*/anydesk-\(.*\)-${arch}.tar.gz,\1,g' - ''; - }; + updateScript = ./update.sh; }; meta = { diff --git a/pkgs/by-name/an/anydesk/update.sh b/pkgs/by-name/an/anydesk/update.sh new file mode 100755 index 000000000000..166540cf7b8b --- /dev/null +++ b/pkgs/by-name/an/anydesk/update.sh @@ -0,0 +1,39 @@ +#!/usr/bin/env -S nix shell nixpkgs#curl nixpkgs#jq nixpkgs#nix --command bash + +set -euo pipefail + +directory="$(dirname $0 | xargs realpath)" + +new_version=$( + curl -s https://rpm.anydesk.com/rhel/x86_64/Packages/ \ + | grep -oP 'anydesk_\K[0-9]+\.[0-9]+\.[0-9]+(?=-[0-9]+_x86_64\.rpm)' \ + | sort -V \ + | tail -1 +) + +old_version=$(jq -r '.version' "$directory/pin.json") + +if [[ "$new_version" == "$old_version" ]]; then + echo "anydesk is already up to date ($old_version)" + exit 0 +fi + +echo "Updating anydesk: $old_version -> $new_version" + +hash_amd64=$(nix hash to-sri --type sha256 \ + "$(nix-prefetch-url --type sha256 \ + "https://download.anydesk.com/linux/anydesk-${new_version}-amd64.tar.gz")") + +hash_arm64=$(nix hash to-sri --type sha256 \ + "$(nix-prefetch-url --type sha256 \ + "https://download.anydesk.com/rpi/anydesk-${new_version}-arm64.tar.gz")") + +cat > "$directory/pin.json" << EOF +{ + "version": "$new_version", + "x86_64-linux": "$hash_amd64", + "aarch64-linux": "$hash_arm64" +} +EOF + +cat "$directory/pin.json" From 2e3599accfcf5c8a82254d28b19a62358d8528b7 Mon Sep 17 00:00:00 2001 From: FraioVeio Date: Wed, 24 Jun 2026 18:51:53 +0200 Subject: [PATCH 11/56] anydesk: 8.0.2 -> 8.0.3 (cherry picked from commit 86bfc8e04be8f8dac6374e123c340e1dfcfa513d) --- pkgs/by-name/an/anydesk/pin.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/an/anydesk/pin.json b/pkgs/by-name/an/anydesk/pin.json index be59d275a145..5c5c41eb883e 100644 --- a/pkgs/by-name/an/anydesk/pin.json +++ b/pkgs/by-name/an/anydesk/pin.json @@ -1,5 +1,5 @@ { - "version": "8.0.2", - "x86_64-linux": "sha256-6noMPfe0x6kx/whyd66qcmk7WhEivx3xK5q58Se9Ij0=", - "aarch64-linux": "sha256-wfY+OCx9OyLCmiA29RjnYzcg/pApMIXWT5UrcdcyRYM=" + "version": "8.0.3", + "x86_64-linux": "sha256-Mjl17hh5A/pwRAi7giL1SJYlQ61O0SXX+KeH8STZ4bs=", + "aarch64-linux": "sha256-MhAj5cy81uBMoNeFPvOyhBOlJzBgNRHXyCXrpdvF8nE=" } From a8cce4204321f6667ed329ffc69a0bc457a99ff7 Mon Sep 17 00:00:00 2001 From: kaynetik Date: Sun, 31 May 2026 07:14:01 +0200 Subject: [PATCH 12/56] podman-desktop: switch pnpm pin back to `pnpm_10` The hard pin to pnpm_10_29_2 worked around a lockfile regression in pnpm 10.29.3+ that broke electron-builder. electron-builder fixed it in 26.8.2, which podman-desktop has shipped since 1.26.0, so pnpm_10 builds cleanly on the current 1.27.2 tree. Switch the pin back to pnpm_10 and re-enable the pnpm bump in the update script. Signed-off-by: kaynetik (cherry picked from commit b0d72a85e98ecf114192e21125be4a301d4e1ea2) --- pkgs/by-name/po/podman-desktop/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix index 9b3d0a55e9f2..e7319fd46b4a 100644 --- a/pkgs/by-name/po/podman-desktop/package.nix +++ b/pkgs/by-name/po/podman-desktop/package.nix @@ -6,7 +6,7 @@ copyDesktopItems, electron_41, nodejs-slim_24, - pnpm_10_29_2, + pnpm_10, fetchPnpmDeps, pnpmConfigHook, makeDesktopItem, @@ -22,7 +22,7 @@ let nodejs-slim = nodejs-slim_24; - pnpm = pnpm_10_29_2.override { inherit nodejs-slim; }; + pnpm = pnpm_10.override { inherit nodejs-slim; }; electron = electron_41; appName = "Podman Desktop"; in From de81290d48cf293a2ae634136f5d532b3f8e2b6e Mon Sep 17 00:00:00 2001 From: kaynetik Date: Sun, 31 May 2026 07:24:41 +0200 Subject: [PATCH 13/56] podman-desktop: derive .desktop entry from upstream .flatpak.desktop Install the upstream .flatpak.desktop directly instead of hand-maintaining a makeDesktopItem, rewriting only the launcher command and icon name and dropping the X-Flatpak key. This keeps Categories and Keywords aligned with upstream and prevents them from regressing. The --replace-fail patterns fail the build if upstream renames those lines. Signed-off-by: kaynetik (cherry picked from commit 7a77089c8fc2908a856d64727017f1b74cab8126) --- pkgs/by-name/po/podman-desktop/package.nix | 26 ++++++---------------- 1 file changed, 7 insertions(+), 19 deletions(-) diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix index e7319fd46b4a..04cb9eb6812d 100644 --- a/pkgs/by-name/po/podman-desktop/package.nix +++ b/pkgs/by-name/po/podman-desktop/package.nix @@ -3,13 +3,11 @@ stdenv, fetchFromGitHub, makeBinaryWrapper, - copyDesktopItems, electron_41, nodejs-slim_24, pnpm_10, fetchPnpmDeps, pnpmConfigHook, - makeDesktopItem, darwin, nix-update-script, _experimental-update-script-combinators, @@ -96,9 +94,6 @@ stdenv.mkDerivation (finalAttrs: { pnpm pnpmConfigHook ] - ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ - copyDesktopItems - ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.autoSignDarwinBinariesHook ]; @@ -147,6 +142,13 @@ stdenv.mkDerivation (finalAttrs: { install -Dm644 buildResources/icon.svg "$out/share/icons/hicolor/scalable/apps/podman-desktop.svg" + # Derive the .desktop entry from upstream to keep it aligned and avoid regressions. + install -Dm644 .flatpak.desktop "$out/share/applications/podman-desktop.desktop" + substituteInPlace "$out/share/applications/podman-desktop.desktop" \ + --replace-fail 'Exec=run.sh %U' 'Exec=podman-desktop %U' \ + --replace-fail 'Icon=io.podman_desktop.PodmanDesktop' 'Icon=podman-desktop' + sed -i '/^X-Flatpak=/d' "$out/share/applications/podman-desktop.desktop" + makeWrapper '${electron}/bin/electron' "$out/bin/podman-desktop" \ --add-flags "$out/share/lib/podman-desktop/resources/app.asar" \ --set XDG_SESSION_TYPE 'x11' \ @@ -159,20 +161,6 @@ stdenv.mkDerivation (finalAttrs: { '' ); - # see: https://github.com/podman-desktop/podman-desktop/blob/main/.flatpak.desktop - desktopItems = [ - (makeDesktopItem { - name = "podman-desktop"; - exec = "podman-desktop %U"; - icon = "podman-desktop"; - desktopName = appName; - genericName = "Desktop client for podman"; - comment = finalAttrs.meta.description; - categories = [ "Utility" ]; - startupWMClass = appName; - }) - ]; - meta = { description = "Graphical tool for developing on containers and Kubernetes"; homepage = "https://podman-desktop.io"; From cec6beb1d57b5a0bd0113c11d26d3b3c3b6abe6f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 30 Jun 2026 09:58:45 +0000 Subject: [PATCH 14/56] trivy: 0.71.2 -> 0.72.0 (cherry picked from commit 6e6deb39262ffd8aac1afb363b7a4ded93f7cab0) --- pkgs/by-name/tr/trivy/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/tr/trivy/package.nix b/pkgs/by-name/tr/trivy/package.nix index 73950a4d7382..dce19339476e 100644 --- a/pkgs/by-name/tr/trivy/package.nix +++ b/pkgs/by-name/tr/trivy/package.nix @@ -10,19 +10,19 @@ buildGoModule (finalAttrs: { pname = "trivy"; - version = "0.71.2"; + version = "0.72.0"; src = fetchFromGitHub { owner = "aquasecurity"; repo = "trivy"; tag = "v${finalAttrs.version}"; - hash = "sha256-GC9WiGp2Cn0SmErRxAdjpDJvoF0giKrj+NJAC5CaXV8="; + hash = "sha256-BfYgHa5Qv5rwJSRLdaDeCU4pz1jrUG72QzsJ98F5Is8="; }; # Hash mismatch on across Linux and Darwin proxyVendor = true; - vendorHash = "sha256-Xr24mc1nDevpeACKciw1g1bTfLtCEwxfOuwPNxVhGxo="; + vendorHash = "sha256-IeX4c34/AUt9MZCFHVs43+9lmDX2gYJhPAi7/lUeWgI="; subPackages = [ "cmd/trivy" ]; From 3d698d7f17b7fccce7d1ecc3c720cc3f5740ecb1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Mon, 29 Jun 2026 15:51:32 -0700 Subject: [PATCH 15/56] pnpm: don't require knownVulnerabilities to be set (cherry picked from commit 4a5f675c7890b4e8c44f669e061d2131acc9bbbe) --- pkgs/development/tools/pnpm/default.nix | 13 +++++++------ pkgs/development/tools/pnpm/generic.nix | 2 +- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix index 4339c86d09cb..49ab2f14ee5e 100644 --- a/pkgs/development/tools/pnpm/default.nix +++ b/pkgs/development/tools/pnpm/default.nix @@ -42,12 +42,13 @@ let callPnpm = variant: - callPackage ./generic.nix { - inherit (variant) version hash; - knownVulnerabilities = variant.knownVulnerabilities or [ ]; - #FIXME: remove this hack in a future version. - nodejs = null; # Passing null to detect out-of-tree overrides - }; + callPackage ./generic.nix ( + variant + // { + #FIXME: remove this hack in a future version. + nodejs = null; # Passing null to detect out-of-tree overrides + } + ); mkPnpm = versionSuffix: variant: nameValuePair "pnpm_${versionSuffix}" (callPnpm variant); in diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix index f3cdc920f26d..9de5e0ab6bef 100644 --- a/pkgs/development/tools/pnpm/generic.nix +++ b/pkgs/development/tools/pnpm/generic.nix @@ -17,7 +17,7 @@ withNode ? true, version, hash, - knownVulnerabilities, + knownVulnerabilities ? [ ], }: let majorVersion = lib.versions.major version; From 2f5116ae730e5b793a3670713e0a34385ae7ca19 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:11:13 +0200 Subject: [PATCH 16/56] electron-source.electron_40: 40.10.3 -> 40.10.5 - Changelog: https://github.com/electron/electron/releases/tag/v40.10.5 - Diff: https://github.com/electron/electron/compare/refs/tags/v40.10.3...v40.10.5 (cherry picked from commit adf90c573bc67e9c8904c62467fcbd52a706ea9d) --- pkgs/development/tools/electron/info.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json index 1d3ef8120563..38d24090d1dd 100644 --- a/pkgs/development/tools/electron/info.json +++ b/pkgs/development/tools/electron/info.json @@ -56,10 +56,10 @@ }, "src/electron": { "args": { - "hash": "sha256-fLk+Vs7u/mZFb4mLmytRPez4Fur5e0QugmuD58fulIs=", + "hash": "sha256-egb/uS76XrADbEtnzEVzym47qrNYwIOby1/3J537Vuw=", "owner": "electron", "repo": "electron", - "tag": "v40.10.3" + "tag": "v40.10.5" }, "fetcher": "fetchFromGitHub" }, @@ -1343,7 +1343,7 @@ } }, "electron_yarn_data": { - "hash": "sha256-GPTl9cT6CLfwQx5u7egDiSCGG6hikRDinPuijp97dHE=", + "hash": "sha256-JYMafgdlxleQS+kvWs6CGo8y+yGGPBtxw1AK5jklejU=", "missing_hashes": { "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba", "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a", @@ -1387,7 +1387,7 @@ }, "modules": "143", "node": "24.15.0", - "version": "40.10.3" + "version": "40.10.5" }, "41": { "chrome": "146.0.7680.216", From fbc13d021459486cbc8f19ba4a569011dff309d7 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:12:27 +0200 Subject: [PATCH 17/56] electron-source.electron_41: 41.7.2 -> 41.9.1 - Changelog: https://github.com/electron/electron/releases/tag/v41.9.1 - Diff: https://github.com/electron/electron/compare/refs/tags/v41.7.2...v41.9.1 (cherry picked from commit 1f079da317cf85481def1e8596829b4bcddac275) --- pkgs/development/tools/electron/info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json index 38d24090d1dd..1477d8ff2b02 100644 --- a/pkgs/development/tools/electron/info.json +++ b/pkgs/development/tools/electron/info.json @@ -1446,10 +1446,10 @@ }, "src/electron": { "args": { - "hash": "sha256-Bvm6S7otVUmGjRWOA53ua/7EdyIImHJMbDtVH3Xa4wo=", + "hash": "sha256-n7Ev30z9CSqMUifcjrInlk66WH0sfb1jFPcA0/vJOd4=", "owner": "electron", "repo": "electron", - "tag": "v41.7.2" + "tag": "v41.9.1" }, "fetcher": "fetchFromGitHub" }, @@ -1783,10 +1783,10 @@ }, "src/third_party/electron_node": { "args": { - "hash": "sha256-Y4FP+AstENp1uTYBo8HeTRDwvKClTdrZ4RztLeHNP3k=", + "hash": "sha256-LUV3ieY+bQ6qhft+xeTSxPuTlnmpbxkRIcIVBz86Aco=", "owner": "nodejs", "repo": "node", - "tag": "v24.15.0" + "tag": "v24.17.0" }, "fetcher": "fetchFromGitHub" }, @@ -2749,7 +2749,7 @@ } }, "electron_yarn_data": { - "hash": "sha256-Ry8gzsdaR61djEgF+MpXAYGK00lRD5ZLq3cLUV1prFs=", + "hash": "sha256-KNbWANdqpF3rypdyGKgj9ykGXQ/+VtkE5L/XR1lqbps=", "missing_hashes": { "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba", "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a", @@ -2792,8 +2792,8 @@ } }, "modules": "145", - "node": "24.15.0", - "version": "41.7.2" + "node": "24.17.0", + "version": "41.9.1" }, "42": { "chrome": "148.0.7778.254", From 8ccfe0c0c99222dbb4e964099a3e6b285aabdbfc Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:27:43 +0200 Subject: [PATCH 18/56] electron-source.electron_42: 42.4.0 -> 42.5.1 - Changelog: https://github.com/electron/electron/releases/tag/v42.5.1 - Diff: https://github.com/electron/electron/compare/refs/tags/v42.4.0...v42.5.1 (cherry picked from commit 78c762173355178b6ba682c3db53e1dd2c6f2ba6) --- pkgs/development/tools/electron/info.json | 54 +++++++++++------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json index 1477d8ff2b02..275cd4b88df1 100644 --- a/pkgs/development/tools/electron/info.json +++ b/pkgs/development/tools/electron/info.json @@ -2796,7 +2796,7 @@ "version": "41.9.1" }, "42": { - "chrome": "148.0.7778.254", + "chrome": "148.0.7778.271", "chromium": { "deps": { "gn": { @@ -2805,15 +2805,15 @@ "version": "0-unstable-2026-04-01" } }, - "version": "148.0.7778.254" + "version": "148.0.7778.271" }, "chromium_npm_hash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8=", "deps": { "src": { "args": { - "hash": "sha256-anHfDRQGlmW1CsH4T1KSLoGdoYvSBJBNBXebMxdXMHE=", + "hash": "sha256-RdJGQjP6IxEdtPMfF7HdmreurRoah7G90pjF8RSOyNg=", "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ", - "tag": "148.0.7778.254", + "tag": "148.0.7778.271", "url": "https://chromium.googlesource.com/chromium/src.git" }, "fetcher": "fetchFromGitiles" @@ -2852,10 +2852,10 @@ }, "src/electron": { "args": { - "hash": "sha256-ce/7NTD85RlZtuuYNiuvECxtcLyPHNXAzWwHVdJEqP8=", + "hash": "sha256-OI1/fMv5PTfph7n01dcX3zGYcg6Uov2J2TQBSskqZ4I=", "owner": "electron", "repo": "electron", - "tag": "v42.4.0" + "tag": "v42.5.1" }, "fetcher": "fetchFromGitHub" }, @@ -2885,8 +2885,8 @@ }, "src/third_party/angle": { "args": { - "hash": "sha256-P5KpTB/jaUR8MjrEccc1di5u9dvD/YiVw8/QlkdKZcE=", - "rev": "007b92d82773d7a868a6dce85359232921903959", + "hash": "sha256-UC8XJES8ObArvvKZ55KVvKlgUTjqM9Znx5u5BMQXekA=", + "rev": "03e01c80b2176b32bdd2b2181cdd583410242e1c", "url": "https://chromium.googlesource.com/angle/angle.git" }, "fetcher": "fetchFromGitiles" @@ -3085,8 +3085,8 @@ }, "src/third_party/dawn": { "args": { - "hash": "sha256-LM5Z57mbH1u7XFnHF/p4fN/D9mO6504S0k8gqO6z3HI=", - "rev": "c7de5291f0edba5398383d5592adcc78ba745bff", + "hash": "sha256-vZHlPC5rlk1ii98M9ALn2qqa/M6ItbqjaAILjJOIAO8=", + "rev": "5fdf5521a2f59e5794fef5085eeef711b760de4f", "url": "https://dawn.googlesource.com/dawn.git" }, "fetcher": "fetchFromGitiles" @@ -3205,10 +3205,10 @@ }, "src/third_party/electron_node": { "args": { - "hash": "sha256-LE2x6lkDk2r977zRRApdTTWId/vXql2uOob7aEsnncI=", + "hash": "sha256-LUV3ieY+bQ6qhft+xeTSxPuTlnmpbxkRIcIVBz86Aco=", "owner": "nodejs", "repo": "node", - "tag": "v24.16.0" + "tag": "v24.17.0" }, "fetcher": "fetchFromGitHub" }, @@ -3263,8 +3263,8 @@ }, "src/third_party/ffmpeg": { "args": { - "hash": "sha256-JHAicFKBvtkwmZPRBKYPT6JVqYqF8hyXxU0H7kfgCBs=", - "rev": "b5e18fb9da84e26ceef30d4e4886696bf59337c0", + "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk=", + "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0", "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git" }, "fetcher": "fetchFromGitiles" @@ -3583,8 +3583,8 @@ }, "src/third_party/libvpx/source/libvpx": { "args": { - "hash": "sha256-RyYnkLYafiS6kQKeOmzohtxFRXudDzgEmQkG+qKHozc=", - "rev": "47ac1ec7f3de7d7cb3d070844c427c8f1fa9d6fc", + "hash": "sha256-WpvbgyCocBm7BCL46kr+Mo7lZIOKSbLK6bog1T+HhQY=", + "rev": "286281b987e08757b9d0e6e23f38f8b0f1b601ce", "url": "https://chromium.googlesource.com/webm/libvpx.git" }, "fetcher": "fetchFromGitiles" @@ -3607,8 +3607,8 @@ }, "src/third_party/libyuv": { "args": { - "hash": "sha256-ZONwYhTD5/tPk5cm9Dmz59QB+rVxv1l/7lOhBOCMCf4=", - "rev": "957f295ea946cbbd13fcfc46e7066f2efa801233", + "hash": "sha256-DW7PuRqA1x0K8/uJbxBJ4Cn9YEPFhZ9vhuGVVyGKK98=", + "rev": "30809ff64a9ca5e45f86439c0d474c2d3eef3d05", "url": "https://chromium.googlesource.com/libyuv/libyuv.git" }, "fetcher": "fetchFromGitiles" @@ -3840,8 +3840,8 @@ }, "src/third_party/skia": { "args": { - "hash": "sha256-3yGenYm9OO63FP53odWv6vfy0fOKsXNpygb4vT8HRQM=", - "rev": "2ac66cfda097720cd8d3e481c45b68b4ba096ef7", + "hash": "sha256-2Xu45E9seJ0KfX5cmP07ZFAk8ffZp5RmuUscIqZlwJg=", + "rev": "3a90f6662a2c30a7d270c7738cc70e5980974b02", "url": "https://skia.googlesource.com/skia.git" }, "fetcher": "fetchFromGitiles" @@ -4115,8 +4115,8 @@ }, "src/third_party/webrtc": { "args": { - "hash": "sha256-n39HENOXmatsZLF6jdYRsb+wl2cM0i6ngT4Zbyu5ayE=", - "rev": "e3ee86921c57b9f8921045e77f098604803cb66c", + "hash": "sha256-GZU7eUSMuWUDswEDlEUNgjpQU5lWRJBmn3mw0Aunefo=", + "rev": "419855526c87360c0352e28ebacc4bf0905b9d3f", "url": "https://webrtc.googlesource.com/src.git" }, "fetcher": "fetchFromGitiles" @@ -4155,15 +4155,15 @@ }, "src/v8": { "args": { - "hash": "sha256-5wkfQsD5pWMAgsXSGTzMYwBADqJpWqSoJEfIyGYkAno=", - "rev": "0b1a7b33935f88a225ca32de62a13478f329b625", + "hash": "sha256-4FU9K9EHtkeK9FLkYRHF7jiJcwS69jcGgpnrRXIhM5o=", + "rev": "30ffa551746d451373b9869d658251b2c21343e9", "url": "https://chromium.googlesource.com/v8/v8.git" }, "fetcher": "fetchFromGitiles" } }, "electron_yarn_data": { - "hash": "sha256-EIVoXfA3O0v+NgBap129bOm2yl9zFuDx78OLYj0Q/o8=", + "hash": "sha256-hBJkcohC8tvCIjQgZYeH9tTY6zxa+HCiLQJsgX1HCe4=", "missing_hashes": { "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba", "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a", @@ -4206,7 +4206,7 @@ } }, "modules": "146", - "node": "24.16.0", - "version": "42.4.0" + "node": "24.17.0", + "version": "42.5.1" } } From f11cd960943a0d65b9aeeffe3f1ccef2f47e7f68 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 17:02:07 +0200 Subject: [PATCH 19/56] electron_40-bin: 40.10.3 -> 40.10.5 - Changelog: https://github.com/electron/electron/releases/tag/v40.10.5 - Diff: https://github.com/electron/electron/compare/refs/tags/v40.10.3...v40.10.5 (cherry picked from commit 831469dedc6e21f7a04052a2b7aa1ba0607b8bb1) --- pkgs/development/tools/electron/binary/info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json index 47836dad8176..acd00ecbf478 100644 --- a/pkgs/development/tools/electron/binary/info.json +++ b/pkgs/development/tools/electron/binary/info.json @@ -23,14 +23,14 @@ }, "40": { "hashes": { - "aarch64-darwin": "dfb6a853acdc547b6eedc97fa4a30693dba0bd310ab673e436b08b890772b529", - "aarch64-linux": "7a53169a16775f2b62f9434058c2c0e1cdf3f1718800b80712856f4766cf6043", - "armv7l-linux": "ef6ba9eb2e79721f7b1b9957fa71e55fcdbb9b6d1793daf61cd839f48cd1e86b", - "headers": "0f9c09vk9kn3c7phw3dm8k1iaf8gw3g2s37r3qdycf9akirprpf2", - "x86_64-darwin": "27a4e372ca19394fefedabbf4da0341cfb87c1fa9f5b9cf9b22e8cd8deb4f566", - "x86_64-linux": "d2593a23cc1c080b7333381579a65ecaf9628a70efbc466ddb545141257105a3" + "aarch64-darwin": "5f84fae97bdf54457e074617acf0d362adb7d0b298311d18bea6efe97b6b301f", + "aarch64-linux": "1c6566cf63bed400a2b17b223c4657f199477a7389b2e540a76497d754cb2e78", + "armv7l-linux": "be9dd6389e49aeb237647ccb3c7683059e98fbcc33b61ae0dc26f61d29f56a35", + "headers": "1rq2wn46l7svsprzhs61h9c26nldacyhhwyawa863kkw68b8r5bd", + "x86_64-darwin": "8f3ba9bdfa2e4a2f0681b74befe8ee40f916c590b8ee303f86d48932fe7c9f29", + "x86_64-linux": "4664bf23f722c6580ba77af5beb5a2c2db31da83bedb9d402f4277d99fa57639" }, - "version": "40.10.3" + "version": "40.10.5" }, "41": { "hashes": { From 8f0ff10171ec5c67a15ee25c30e6475e677312b0 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 17:03:12 +0200 Subject: [PATCH 20/56] electron-chromedriver_40: 40.10.3 -> 40.10.5 - Changelog: https://github.com/electron/electron/releases/tag/v40.10.5 - Diff: https://github.com/electron/electron/compare/refs/tags/v40.10.3...v40.10.5 (cherry picked from commit 4978c71e9ac6c6859205aec9e8c299d1d5cc5dd1) --- .../tools/electron/chromedriver/info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json index 08852cf6d17e..73129b64b424 100644 --- a/pkgs/development/tools/electron/chromedriver/info.json +++ b/pkgs/development/tools/electron/chromedriver/info.json @@ -23,14 +23,14 @@ }, "40": { "hashes": { - "aarch64-darwin": "8f19ad2223292532b90e1ee4aa0f6f59e1cf0343055610bac3c0b0bdebc0dc1c", - "aarch64-linux": "6ce2b44eb560e5d305bef4c5886844ccd025d1edf0b7fe758a4fdf46beb8a0e3", - "armv7l-linux": "d2493fa2a16c3dddaccd7b846645ef5b3acd740fb0a206e5b54f9cbc8b288a31", - "headers": "0f9c09vk9kn3c7phw3dm8k1iaf8gw3g2s37r3qdycf9akirprpf2", - "x86_64-darwin": "9eb305ea485e72bd01d8d9d45e258a3b6708bb480caad048819141f420373c20", - "x86_64-linux": "494cd1ddfc0745032223a4995360ed5ab65ea1e2fe88612e1ae32398d13b3470" + "aarch64-darwin": "cdcf197edb1d07453b7543b48303f5562284816488f8d615adeff61db0b04664", + "aarch64-linux": "1d9c9a5252ea3db9229ded8968ffe2c01a41e676cc18c5a4c87818de029c1442", + "armv7l-linux": "5f893df0d9e16ad06ceb53df5ac833298da0ce03d7e63608fcb7f64bf95ec817", + "headers": "1rq2wn46l7svsprzhs61h9c26nldacyhhwyawa863kkw68b8r5bd", + "x86_64-darwin": "5f461d11062eb20dde58eab29c0c9d7ab293ead00129e365e8f1e45ead533ac8", + "x86_64-linux": "6c3476f46d4a7581d74093fcb4c6a24a1b45a26a562443068b91063ba0a098dc" }, - "version": "40.10.3" + "version": "40.10.5" }, "41": { "hashes": { From 523149d5de28ed0c9ea5d30ed6948861374a54e4 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 17:04:15 +0200 Subject: [PATCH 21/56] electron_41-bin: 41.7.2 -> 41.9.1 - Changelog: https://github.com/electron/electron/releases/tag/v41.9.1 - Diff: https://github.com/electron/electron/compare/refs/tags/v41.7.2...v41.9.1 (cherry picked from commit b3bdd23ef96c41de32bd2af8929177f42231ad5e) --- pkgs/development/tools/electron/binary/info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json index acd00ecbf478..f535f5445c6d 100644 --- a/pkgs/development/tools/electron/binary/info.json +++ b/pkgs/development/tools/electron/binary/info.json @@ -34,14 +34,14 @@ }, "41": { "hashes": { - "aarch64-darwin": "f48986fa0d60b88eee78fd95c1a36e7fac9ab606c63fdabc28adec916b8f12d1", - "aarch64-linux": "d94b0231b05063e5cd959cda2bdb8ec7c94ab86f59698bfba4522343eb48d50e", - "armv7l-linux": "e3d04ffa4e020857a2a2554f7f5e41e746fa692c91c51575199473ddb264e551", - "headers": "0j9gvjjq9qdvjj33h2xh6qdxxr29aj96y2qs3p0xvy1bc3li9hzn", - "x86_64-darwin": "6b561462a94fd02837a525d0bca786a0b4345b61e2e3109c4bf13792235db90d", - "x86_64-linux": "a04bb66fd83c516c8b3adc5fb47f8307fe54704f5b1cd7c8ec9be8285d2989b3" + "aarch64-darwin": "7d61175263f7aef8957b05966808ca58d3f0db86ba5a59aafc780ddd340135f6", + "aarch64-linux": "a77dc2804fda466e704907befa6facd8e7c9d0342db319c742ebb58ebe99a9c5", + "armv7l-linux": "b7ff0470b1efc424b96b81ecc3e7f353551bd1694bfbc75b307f319133f26258", + "headers": "115rlwjj5yyn4ic9acih1q5x29k5q7fz8q82c0ab7prfi01f9y6h", + "x86_64-darwin": "719ad75b073bc34ff3c03694703a896c6ffdc40976c76efd959dfde108798150", + "x86_64-linux": "4b8eca04c7f96828e297d8b3b4d303727db9123ae69b86c6041418651b6c227f" }, - "version": "41.7.2" + "version": "41.9.1" }, "42": { "hashes": { From 182f14bf4471c1b68493e46cdae4029814671e3f Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 17:05:19 +0200 Subject: [PATCH 22/56] electron-chromedriver_41: 41.7.2 -> 41.9.1 - Changelog: https://github.com/electron/electron/releases/tag/v41.9.1 - Diff: https://github.com/electron/electron/compare/refs/tags/v41.7.2...v41.9.1 (cherry picked from commit e7426a3efabb3b5619d1d8f490c2cb780a624df7) --- .../tools/electron/chromedriver/info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json index 73129b64b424..c89b512243d7 100644 --- a/pkgs/development/tools/electron/chromedriver/info.json +++ b/pkgs/development/tools/electron/chromedriver/info.json @@ -34,14 +34,14 @@ }, "41": { "hashes": { - "aarch64-darwin": "3b820eba3a2ec3805fa437e1d1557cd57634f22960a3232cdfdbadb197df0926", - "aarch64-linux": "187c6bd8dd6339c9f3558bd4f0dab5a71713da6fe7146e18160481045124d39e", - "armv7l-linux": "187df82834a49211c6cdf55f95c6eacfa94c83a95e84965a4cce8ba04075cd0b", - "headers": "0j9gvjjq9qdvjj33h2xh6qdxxr29aj96y2qs3p0xvy1bc3li9hzn", - "x86_64-darwin": "24a7018009ea46cc466f09504824379c430f8b4eb8f5cfc7f5235b81e1fa6def", - "x86_64-linux": "2af603975c4ee6bbd5332d49ec5bf2ded27db818db398b10a620f5ce0e719af7" + "aarch64-darwin": "d270db29c9bd72cb796600510283ff3ba3a57b454a3565508492fa590eec2df5", + "aarch64-linux": "bf33e3258036e2fff74795be213060858fdf37f2c61ddfe551289697d7d8b528", + "armv7l-linux": "0e65fd875ce97a9bc9241bd7c3476bcdccd22b90da2bc9d5bff6282372c55efe", + "headers": "115rlwjj5yyn4ic9acih1q5x29k5q7fz8q82c0ab7prfi01f9y6h", + "x86_64-darwin": "d9b5d5c960caf575cdc26dd35edfbd8078198d8b9ba5dfd9653c3753187b5485", + "x86_64-linux": "6060783bb08fc89cececf9731290b3f22b6ff847b2577f5cbd768ee8bb3fdee3" }, - "version": "41.7.2" + "version": "41.9.1" }, "42": { "hashes": { From a7a1b3445f9216a946cede60cdd161fbbc14c5c7 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 17:06:23 +0200 Subject: [PATCH 23/56] electron_42-bin: 42.4.0 -> 42.5.1 - Changelog: https://github.com/electron/electron/releases/tag/v42.5.1 - Diff: https://github.com/electron/electron/compare/refs/tags/v42.4.0...v42.5.1 (cherry picked from commit f614e907b485bf0ea684552d626f2cc569313fe2) --- pkgs/development/tools/electron/binary/info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json index f535f5445c6d..896922954a0a 100644 --- a/pkgs/development/tools/electron/binary/info.json +++ b/pkgs/development/tools/electron/binary/info.json @@ -45,13 +45,13 @@ }, "42": { "hashes": { - "aarch64-darwin": "3ce55988c9998bcd1e9c69478dd26887b90e8f8010441172e520e94ba575e520", - "aarch64-linux": "d3bf612de0b651302fb46e50ed3282b609ea9d4d99bb296f7c9bb8ffd92fd69b", - "armv7l-linux": "83f9017f9a77bfdc8628b05237336c319da45f75974c37c68c82687a18106a92", - "headers": "1jim5dw909wzczdlcrajn03j4v8gsvq6zpk85nl3713b3rx0pjyz", - "x86_64-darwin": "0f141809eebe3f3f8c8f8377c10c93f21a39433f71526598de5e989f452cae29", - "x86_64-linux": "9a8194635548490a56099cc4c2b116738ae56834dee4472506d5a8b262bcbda4" + "aarch64-darwin": "e019b54b8b63dcc851adc871e011c45bf1510854266bb960dcff3781b24b6f96", + "aarch64-linux": "1575fa5cc64b3bf502d03632a915cdca4934e85d2b14fbf900752e8febfadd5c", + "armv7l-linux": "861d1ad6e41f395aac18deb6c2b36dd203c6364b7d2f358d5241a1ffeabd96d5", + "headers": "1ibm3ds3k2ih6bpmynics2dzhi437l73l8b3bmhx7gh4ghflaln0", + "x86_64-darwin": "608f68cc8c5db54b7b3d853e3672a447bd7ad06d5b2caa9bc0a83d56479374fd", + "x86_64-linux": "3a729b020acb04aefac2c9b4b29c65b37dd7126a14a04d1ef29acb256d3edbd1" }, - "version": "42.4.0" + "version": "42.5.1" } } From 9a74acb18f3b84b88c42c2411dd06ab8e3fa24ed Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 29 Jun 2026 17:07:27 +0200 Subject: [PATCH 24/56] electron-chromedriver_42: 42.4.0 -> 42.5.1 - Changelog: https://github.com/electron/electron/releases/tag/v42.5.1 - Diff: https://github.com/electron/electron/compare/refs/tags/v42.4.0...v42.5.1 (cherry picked from commit f07c9f3fd3bb16729def50c9e4ec07a21e680d07) --- .../tools/electron/chromedriver/info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json index c89b512243d7..4577a69901ed 100644 --- a/pkgs/development/tools/electron/chromedriver/info.json +++ b/pkgs/development/tools/electron/chromedriver/info.json @@ -45,13 +45,13 @@ }, "42": { "hashes": { - "aarch64-darwin": "0ad0294171f61678036771f0a9e9de84b79a063d6781f166991d52d21d41a31f", - "aarch64-linux": "22fc9f5566d3a701965ae2cc77b0625644e827d67a80dfa86fbfd8076354a447", - "armv7l-linux": "b1ec1b8aec371b3b13303074739ddcd006a08060150f10a6c7a364c4b1bfd40c", - "headers": "1jim5dw909wzczdlcrajn03j4v8gsvq6zpk85nl3713b3rx0pjyz", - "x86_64-darwin": "2a736793968997a9f312156a7cb6575b23479ae4f23539d2b0fd1774589576eb", - "x86_64-linux": "09b69da1569f2d0bbf2015a976a314cefa212243cbfcfb32dcb82ef263c52942" + "aarch64-darwin": "6bc1ce38660096ac4e669e0acf79abd9de22d180fd9f018babaa5da76668a80f", + "aarch64-linux": "859700b9cb1e98f70208baa92e431eb1d102bd27621a5a695aa7a75327e072e6", + "armv7l-linux": "308bd2664d9797512e93f9b2ed17bf62fae9e12cd12ff6812b4493d388cd0904", + "headers": "1ibm3ds3k2ih6bpmynics2dzhi437l73l8b3bmhx7gh4ghflaln0", + "x86_64-darwin": "21db8529629a1a69fc5e2b6475d99c44985a78d49b7cc7aa314465d7568d78a6", + "x86_64-linux": "e0db56b8781035a48aae7fefdac311abb8993a7f6e72009e7adfb70926565bf0" }, - "version": "42.4.0" + "version": "42.5.1" } } From 6a152828e37a177ca524bd348cba98642618c1ca Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 29 Jun 2026 22:31:53 +0000 Subject: [PATCH 25/56] gnucash: 5.15 -> 5.16 (cherry picked from commit 1526bf1eae70a6fecb5a429739ab0bfc79ebf5c2) --- pkgs/by-name/gn/gnucash/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/gn/gnucash/package.nix b/pkgs/by-name/gn/gnucash/package.nix index 97a0ed3a40c1..6c5f3669e0dd 100644 --- a/pkgs/by-name/gn/gnucash/package.nix +++ b/pkgs/by-name/gn/gnucash/package.nix @@ -37,12 +37,12 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "gnucash"; - version = "5.15"; + version = "5.16"; # raw source code doesn't work out of box; fetchFromGitHub not usable src = fetchurl { url = "https://github.com/Gnucash/gnucash/releases/download/${finalAttrs.version}/gnucash-${finalAttrs.version}.tar.bz2"; - hash = "sha256-sL1K9Dtr3jRUIn1LOY6ex6Db1RQ0acE3P8gkw8qrCQk="; + hash = "sha256-u5tsZ+u2o+Btn/T04EF6l77wFZ0mkSvpsOdaMpAf1JM="; }; nativeBuildInputs = [ @@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "Gnucash"; repo = "gnucash-docs"; tag = finalAttrs.version; - hash = "sha256-EI/By0Ek3qDCmi6svX96Wg78UnmsDZzQLRSqErPUuxA="; + hash = "sha256-KC2POdwKma2CWpom3kN4X4MAItJFeWHl4SIV7sb+KCo="; }; nativeBuildInputs = [ cmake ]; From 04ce966ad0416e1a94d6a3f23eefdbfd94bbbc12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Mon, 29 Jun 2026 22:15:45 +0200 Subject: [PATCH 26/56] openrgb: 1.0rc2 -> 1.0rc3 Diff: https://codeberg.org/OpenRGB/OpenRGB/compare/release_candidate_1.0rc2...release_candidate_1.0rc3 (cherry picked from commit 7f9f51b33e9b2aed7dfbc3e7d6d41b501246d9c3) --- pkgs/by-name/op/openrgb/package.nix | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/pkgs/by-name/op/openrgb/package.nix b/pkgs/by-name/op/openrgb/package.nix index d4f91908405a..4e0fe4002e6a 100644 --- a/pkgs/by-name/op/openrgb/package.nix +++ b/pkgs/by-name/op/openrgb/package.nix @@ -1,8 +1,7 @@ { lib, stdenv, - fetchFromGitLab, - fetchpatch, + fetchFromCodeberg, libusb1, hidapi, pkg-config, @@ -16,22 +15,17 @@ stdenv.mkDerivation (finalAttrs: { pname = "openrgb"; - version = "1.0rc2"; + version = "1.0rc3"; - src = fetchFromGitLab { - owner = "CalcProgrammer1"; + src = fetchFromCodeberg { + owner = "OpenRGB"; repo = "OpenRGB"; tag = "release_candidate_${finalAttrs.version}"; - hash = "sha256-vdIA9i1ewcrfX5U7FkcRR+ISdH5uRi9fz9YU5IkPKJQ="; + hash = "sha256-x7B3Ht9+JM+w/3qL5Ku08r05BBLrbuO5JBqP4fnJ0nc="; }; patches = [ ./system-plugins-env.patch - (fetchpatch { - name = "Install-systemd-service-under-PREFIX.patch"; - url = "https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/b58b3c0402131918b3b988631f42617020df9346.patch"; - hash = "sha256-q5i5BNjaLbsXSYEXKQOR/cMm5ExckmW1n2r9H0j09T0="; - }) ]; nativeBuildInputs = [ @@ -116,7 +110,8 @@ stdenv.mkDerivation (finalAttrs: { meta = { description = "Open source RGB lighting control"; - homepage = "https://gitlab.com/CalcProgrammer1/OpenRGB"; + changelog = "https://codeberg.org/OpenRGB/OpenRGB/releases/tag/${finalAttrs.src.tag}"; + homepage = "https://openrgb.org"; maintainers = with lib.maintainers; [ johnrtitor ]; license = lib.licenses.gpl2Plus; platforms = lib.platforms.linux; From 92979777d80a302eb77d6baddcae993b25dc0954 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Wed, 1 Jul 2026 00:48:51 +0200 Subject: [PATCH 27/56] batman-adv: 2026.1 -> 2026.2 Changelog: https://www.open-mesh.org/news/128 (cherry picked from commit eb9d0efb6ed3e67ff1fc8e8284fb8cbeb9e00aeb) --- pkgs/os-specific/linux/batman-adv/version.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix index e12da2673ae4..8f05cf345198 100644 --- a/pkgs/os-specific/linux/batman-adv/version.nix +++ b/pkgs/os-specific/linux/batman-adv/version.nix @@ -1,14 +1,14 @@ { - version = "2026.1"; + version = "2026.2"; # To get these, run: # # ``` - # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2026.1/$tool-2026.1.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done + # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2026.2/$tool-2026.2.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done # ``` sha256 = { - alfred = "sha256-Rd+8uKfLuq7j4SYHpGYB3YbOUiUHJTXptJ2kC78CtIk="; - batctl = "sha256-hEQWhsHUTtV6Vg8qC+n4brksMQ8iqqSgCTPrbIk2CHo="; - batman-adv = "sha256-ZIfdO0rQ+FUQ3tu6M1/nexuHfQ53OTxR3coHp0Ubj0U="; + alfred = "sha256-2ZV0i+X2KkIJFSXMwQLfWsZCGG6bkBRpipVaRGm2m5Y="; + batctl = "sha256-wdWAr7Bm0xZcI5tnQwuUxpkyYZwGqQsSlegoy1CBsSI="; + batman-adv = "sha256-Thf87SyAlF4iYJvodTRIFzP/G10XBQ3k5PMjwXFBgTU="; }; } From c91d1f72d585529d1dad7b23290d245d43f0e205 Mon Sep 17 00:00:00 2001 From: Daniel Schaefer Date: Tue, 30 Jun 2026 13:19:35 +0800 Subject: [PATCH 28/56] libfprint: Add patches to support more hardware libfprint does not release very often, so include some already merged patches to add support for new hardware until the next official release. Low risk, since it just adds new IDs. Signed-off-by: Daniel Schaefer (cherry picked from commit 33b5e7c400ee9ed77b4f3102be79ec82aee9bfb4) --- pkgs/by-name/li/libfprint-tod/package.nix | 4 +++ pkgs/by-name/li/libfprint/package.nix | 30 +++++++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/pkgs/by-name/li/libfprint-tod/package.nix b/pkgs/by-name/li/libfprint-tod/package.nix index 9abebbb42b25..120082b2029e 100644 --- a/pkgs/by-name/li/libfprint-tod/package.nix +++ b/pkgs/by-name/li/libfprint-tod/package.nix @@ -27,6 +27,10 @@ libfprint.overrideAttrs ( hash = "sha256-xkywuFbt8EFJOlIsSN2hhZfMUhywdgJ/uT17uiO3YV4="; }; + # Different source than libfprint, so override any patches, because they + # would only apply to the original source tree + patches = [ ]; + mesonFlags = [ # Include virtual drivers for fprintd tests "-Ddrivers=all" diff --git a/pkgs/by-name/li/libfprint/package.nix b/pkgs/by-name/li/libfprint/package.nix index 160cec4aa0f9..edfc4aa8ea74 100644 --- a/pkgs/by-name/li/libfprint/package.nix +++ b/pkgs/by-name/li/libfprint/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitLab, + fetchpatch, pkg-config, meson, python3, @@ -35,6 +36,35 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-aNBUIKY3PP5A07UNg3N0qq+2cwb6Fk67oKQcXgr2G/4="; }; + patches = [ + # New hardware support since 1.94.10, just new USB Product IDs + (fetchpatch { + name = "realtek-3274-9003.patch"; + url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/a25f71cf97820c51edc4c32f84686fcdc608d9d1.patch"; + sha256 = "sha256-T9rvT53Ij+5gtiVOp+xfzQwiVkyF0m6lZAUCXWmaugg="; + }) + (fetchpatch { + name = "elan-0c58.patch"; + url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/4610f2285e6373c2fe4ead0dff4ebf8dabe4e532.patch"; + sha256 = "sha256-VR96V+7FvSa8sE6JpcCx/slZ0MaK9HLuNuAay2P9C6M="; + }) + (fetchpatch { + name = "elan-04F3-0C9C.patch"; + url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2bdc2b7ca6d8bedc675054934fbc8f8b6a21deac.patch"; + sha256 = "sha256-LFMip9Mq55uDRgHkW+XeI+j0mILOb7DIHscHjyKe4yE="; + }) + (fetchpatch { + name = "focal-077a-079a.patch"; + url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2c7842c905147a2d127c1b168b2e9d432b8c91a4.patch"; + sha256 = "sha256-PuISGITn0/6AWY0WVUfViZtdcQFh+0s+4OLIszqdLUs="; + }) + (fetchpatch { + name = "focal-a97a.patch"; + url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/0dc384b90ed8cd78b3e8d7c0d30a953bd088b98c.patch"; + sha256 = "sha256-X/wl4MpxfQ7sLlFTkkiDQGyRFQ6lC9pdcy3XPrSeOZw="; + }) + ]; + postPatch = '' patchShebangs \ tests/test-runner.sh \ From 7b383c071ec981b3c8dcdb1598af462170dde90c Mon Sep 17 00:00:00 2001 From: fsagbuya Date: Tue, 30 Jun 2026 16:10:17 +0800 Subject: [PATCH 29/56] nixos/tests/flarum: init (cherry picked from commit 0198fc88ea4dd98d56fc0db23e15f9e3f37646e8) --- nixos/tests/all-tests.nix | 1 + nixos/tests/flarum.nix | 52 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+) create mode 100644 nixos/tests/flarum.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index c66a5b062439..26030f3f2b6c 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -598,6 +598,7 @@ in flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix; flap-alerted = runTest ./flap-alerted.nix; flaresolverr = runTest ./flaresolverr.nix; + flarum = runTest ./flarum.nix; flood = runTest ./flood.nix; fluent-bit = runTest ./fluent-bit.nix; fluentd = runTest ./fluentd.nix; diff --git a/nixos/tests/flarum.nix b/nixos/tests/flarum.nix new file mode 100644 index 000000000000..17c7df02f44c --- /dev/null +++ b/nixos/tests/flarum.nix @@ -0,0 +1,52 @@ +{ lib, ... }: +{ + name = "flarum"; + + meta = { + maintainers = with lib.maintainers; [ + fsagbuya + jasonodoom + ]; + }; + + nodes.machine = + { ... }: + { + # Flarum installs and migrates the database on first boot and runs a + # MariaDB server alongside PHP-FPM and nginx, so give the VM some headroom. + virtualisation.memorySize = 2048; + + services.flarum = { + enable = true; + forumTitle = "NixOS Flarum Test Forum"; + domain = "localhost"; + baseUrl = "http://localhost"; + + # Run `flarum install` against the locally provisioned MariaDB. Safe here + # because the VM always starts from a fresh, empty database. + createDatabaseLocally = true; + + adminUser = "admin"; + adminEmail = "admin@example.com"; + # Flarum rejects admin passwords shorter than 8 characters. + initialAdminPassword = "flarum-admin-password"; + }; + }; + + testScript = '' + start_all() + + # PHP-FPM is ordered after the oneshot installer (Type=oneshot, no + # RemainAfterExit), so waiting on it implies the install/migrate finished. + machine.wait_for_unit("phpfpm-flarum.service") + machine.wait_for_unit("nginx.service") + machine.wait_for_open_port(80) + + # The forum front page is server-rendered and embeds the configured title. + machine.wait_until_succeeds("curl -sf http://localhost/ -o /dev/null") + machine.succeed("curl -sf http://localhost/ | grep -F 'NixOS Flarum Test Forum'") + + # The admin API endpoint should respond, confirming the app booted cleanly. + machine.succeed("curl -sf http://localhost/api -o /dev/null") + ''; +} From 792ee117f68a94377b97ae69ceb4524d27598e9c Mon Sep 17 00:00:00 2001 From: fsagbuya Date: Tue, 30 Jun 2026 16:18:30 +0800 Subject: [PATCH 30/56] flarum: add passthru test (cherry picked from commit 440f2226c78e78ad07eede75f050e98a6065f758) --- pkgs/by-name/fl/flarum/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/fl/flarum/package.nix b/pkgs/by-name/fl/flarum/package.nix index 227eb5b395fe..d79a26a5bb34 100644 --- a/pkgs/by-name/fl/flarum/package.nix +++ b/pkgs/by-name/fl/flarum/package.nix @@ -2,6 +2,7 @@ lib, php, fetchFromGitHub, + nixosTests, }: php.buildComposerProject2 (finalAttrs: { @@ -19,6 +20,8 @@ php.buildComposerProject2 (finalAttrs: { composerStrictValidation = false; vendorHash = "sha256-EHl+Mr6y5A51EpLPAWUGtiPkLOky6KvsSY4JWHeyO28="; + passthru.tests.module = nixosTests.flarum; + meta = { changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md"; description = "Delightfully simple discussion platform for your website"; From d16743ebb257e422c1942ba2f1092c2a7434b45a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 1 Jul 2026 02:51:32 +0000 Subject: [PATCH 31/56] mailpit: 1.30.2 -> 1.30.3 (cherry picked from commit acaf38af9430780124226dfe00710b5e52df77c9) --- pkgs/by-name/ma/mailpit/source.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix index 163ac2f273cb..16256eccff09 100644 --- a/pkgs/by-name/ma/mailpit/source.nix +++ b/pkgs/by-name/ma/mailpit/source.nix @@ -1,6 +1,6 @@ { - version = "1.30.2"; - hash = "sha256-37nJRJL1mxvUdD7L9/yO/Lzyjvn09Tu9xHTEt4pxu2s="; - npmDepsHash = "sha256-AApRrIIYC4NtKIFyGQ3lnKIOk7LZNDK8wvUUbSczTrA="; - vendorHash = "sha256-em0317Q1u5sl8gws4/qqM8e9H5F4vfBiM7tLCyufgEk="; + version = "1.30.3"; + hash = "sha256-6Vt1GpGWHfaYaORBFa/cB+AxYQxAdkGtGTsrvL08dsA="; + npmDepsHash = "sha256-vXAXuvKqLWbwCjSLNS8mLDA9AmaGSRsB67iKQMi+/No="; + vendorHash = "sha256-A/kef2PgrA0Jpb/o+f1nUeiwSibOgsnyYLOzJ/HB1Fo="; } From 4ceb173a6f67b8131bf271cc88212c0a5937a7df Mon Sep 17 00:00:00 2001 From: "Alexander A. Klimov" Date: Wed, 1 Jul 2026 12:09:15 +0200 Subject: [PATCH 32/56] icinga2: 2.15.1 -> 2.15.5 Release notes (latest first): - https://github.com/Icinga/icinga2/releases/tag/v2.15.5 - https://github.com/Icinga/icinga2/releases/tag/v2.15.4 - https://github.com/Icinga/icinga2/releases/tag/v2.15.3 - https://github.com/Icinga/icinga2/releases/tag/v2.15.2 GitHub security advisories (worse first): - https://github.com/Icinga/icinga2/security/advisories/GHSA-vj39-ww8j-vvx5 - https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm - https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g Not-cherry-picked-because: unstable already has a higher Icinga 2 version --- pkgs/by-name/ic/icinga2/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ic/icinga2/package.nix b/pkgs/by-name/ic/icinga2/package.nix index 69aff4ef2cc5..8d5272aa93d2 100644 --- a/pkgs/by-name/ic/icinga2/package.nix +++ b/pkgs/by-name/ic/icinga2/package.nix @@ -30,13 +30,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "icinga2${nameSuffix}"; - version = "2.15.1"; + version = "2.15.5"; src = fetchFromGitHub { owner = "icinga"; repo = "icinga2"; rev = "v${finalAttrs.version}"; - hash = "sha256-w/eD07yzBm3x4G74OuGwkmpBzj63UoklmcKxVi5lx8E="; + hash = "sha256-39yGo0pwq+hkpc9re7hOb7HXyWTwsdEMTRWYzZxjAvo="; }; patches = [ From ab0b3a22a78aa213ff36bf6471ee9b4f73a0fe99 Mon Sep 17 00:00:00 2001 From: zimward Date: Tue, 30 Jun 2026 19:57:55 +0200 Subject: [PATCH 33/56] run0-sudo-shim: 1.3.1 -> 1.4.2 Co-authored-by: Grimmauld (cherry picked from commit fffd6bc64699c3b94d051203c74b8b6c5a1f2781) --- pkgs/by-name/ru/run0-sudo-shim/package.nix | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ru/run0-sudo-shim/package.nix b/pkgs/by-name/ru/run0-sudo-shim/package.nix index 937d0da8bfae..e9e8eb0ff4c4 100644 --- a/pkgs/by-name/ru/run0-sudo-shim/package.nix +++ b/pkgs/by-name/ru/run0-sudo-shim/package.nix @@ -5,22 +5,31 @@ nix-update-script, coreutils, polkit-stdin-agent, + installShellFiles, + versionCheckHook, }: rustPlatform.buildRustPackage (finalAttrs: { pname = "run0-sudo-shim"; - version = "1.3.1"; + version = "1.4.2"; src = fetchFromGitHub { owner = "LordGrimmauld"; repo = "run0-sudo-shim"; tag = finalAttrs.version; - hash = "sha256-QkDoEBgcWh/eKX8jxctMNEy08Sf8kpxXFhWbsygTWz8="; + hash = "sha256-J/I7VPXpOwNtEk9H+lbZVT+xJYBsSKgnMlwzlVIJSWk="; }; - cargoHash = "sha256-ly2e2x1Z1XEXblGqWi+/r5q2FmvpekVfzGVGm+S1xio="; + cargoHash = "sha256-JfxMmYgYLKxVqj8H0/qRGn9z8XNoNpPK3RcIhb/RKOc="; __structuredAttrs = true; + nativeBuildInputs = [ + installShellFiles + versionCheckHook + ]; + + doInstallCheck = true; + env = { POLKIT_STDIN_AGENT = lib.getExe polkit-stdin-agent; TRUE = lib.getExe' coreutils "true"; @@ -28,6 +37,10 @@ rustPlatform.buildRustPackage (finalAttrs: { postInstall = '' ln -s $out/bin/run0-sudo-shim $out/bin/sudo + installManPage target/tmp/run0-sudo-shim/manpage/* + installShellCompletion \ + target/tmp/run0-sudo-shim/completion/sudo.{bash,fish} \ + --zsh target/tmp/run0-sudo-shim/completion/_sudo ''; passthru.updateScript = nix-update-script { }; From d3df9187159552c3aa1287e4fa017c2bf479855b Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Mon, 29 Jun 2026 16:24:19 +0200 Subject: [PATCH 34/56] linux/common-config: update for 7.2-rc1 (cherry picked from commit 8c1c48baf88ac745fb9a91818cc05d844446ba39) --- pkgs/os-specific/linux/kernel/common-config.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 84cf7322c046..92bb741c7e02 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -844,13 +844,15 @@ let # enable temporary caching of the last request_key() result KEYS_REQUEST_CACHE = yes; # randomized slab caches - RANDOM_KMALLOC_CACHES = whenAtLeast "6.6" yes; + RANDOM_KMALLOC_CACHES = whenBetween "6.6" "7.2" yes; + KMALLOC_PARTITION_CACHES = whenAtLeast "7.2" yes; + KMALLOC_PARTITION_RANDOM = whenAtLeast "7.2" yes; # NIST SP800-90A DRBG modes - enabled by most distributions # and required by some out-of-tree modules (ShuffleCake) # This does not include the NSA-backdoored Dual-EC mode from the same NIST publication. - CRYPTO_DRBG_HASH = yes; - CRYPTO_DRBG_CTR = yes; + CRYPTO_DRBG_HASH = whenOlder "7.2" yes; + CRYPTO_DRBG_CTR = whenOlder "7.2" yes; # Enable KFENCE # See: https://docs.kernel.org/dev-tools/kfence.html From 5981c4881c84074e3bc8b1f4659e88b707d164a1 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Mon, 29 Jun 2026 16:04:37 +0200 Subject: [PATCH 35/56] linux_testing: 7.1-rc7 -> 7.2-rc1 (cherry picked from commit 853901a31bddc8bdc9edde693f649f0e50edcfc5) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 1850e03a312b..b1bbd932a1ee 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,7 +1,7 @@ { "testing": { - "version": "7.1-rc7", - "hash": "sha256:1jncfqvbiwsvvhiqs23paiy7xvsbmqcpxj02jwvy0albp16kfxd7", + "version": "7.2-rc1", + "hash": "sha256:1gpwr6n3cc2hqg36gy9g9w4rxawpz3y126j752z4zyls6h80b43v", "lts": false }, "6.1": { From b525f22445474297c0f2377617c5f74bd6c39df8 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Tue, 30 Jun 2026 16:20:59 +0300 Subject: [PATCH 36/56] dumpifs: use finalAttrs.src.name instead of hardcoding `source` (cherry picked from commit 5b082362503e7ce9c1b123e0ea0e8c2ab6f324df) --- pkgs/by-name/du/dumpifs/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/du/dumpifs/package.nix b/pkgs/by-name/du/dumpifs/package.nix index 6966e375bd7c..c01a80115082 100644 --- a/pkgs/by-name/du/dumpifs/package.nix +++ b/pkgs/by-name/du/dumpifs/package.nix @@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: { ]; postUnpack = '' - rm source/{dumpifs,exMifsLzo,uuu,zzz} + rm ${finalAttrs.src.name}/{dumpifs,exMifsLzo,uuu,zzz} ''; patches = [ ./package.patch ]; From 516065fc8804c084ca480dc88ba678678a6f0ab7 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Tue, 30 Jun 2026 16:22:40 +0300 Subject: [PATCH 37/56] sleuthkit: use finalAttrs.src.name instead of hardcoding `source` (cherry picked from commit c0baf70601ae9de91ff7433d69ccff209587a504) --- pkgs/by-name/sl/sleuthkit/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/sl/sleuthkit/package.nix b/pkgs/by-name/sl/sleuthkit/package.nix index d91930eaa07f..85e26a31d01f 100644 --- a/pkgs/by-name/sl/sleuthkit/package.nix +++ b/pkgs/by-name/sl/sleuthkit/package.nix @@ -67,11 +67,11 @@ stdenv.mkDerivation (finalAttrs: { export ANT_ARGS="-Doffline=true -Ddefault-jar-location=$IVY_HOME/lib" # pre-positioning these jar files allows -Doffline=true to work - mkdir -p source/{bindings,case-uco}/java $IVY_HOME - cp -r ${finalAttrs.rdeps}/bindings/java/lib source/bindings/java - chmod -R 755 source/bindings/java - cp -r ${finalAttrs.rdeps}/case-uco/java/lib source/case-uco/java - chmod -R 755 source/case-uco/java + mkdir -p ${finalAttrs.src.name}/{bindings,case-uco}/java $IVY_HOME + cp -r ${finalAttrs.rdeps}/bindings/java/lib ${finalAttrs.src.name}/bindings/java + chmod -R 755 ${finalAttrs.src.name}/bindings/java + cp -r ${finalAttrs.rdeps}/case-uco/java/lib ${finalAttrs.src.name}/case-uco/java + chmod -R 755 ${finalAttrs.src.name}/case-uco/java cp -r ${finalAttrs.rdeps}/lib $IVY_HOME chmod -R 755 $IVY_HOME ''; From d6c3fed5f6c02ebeb29d4a21daca706d48148ddc Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 1 Jul 2026 13:26:29 +0200 Subject: [PATCH 38/56] zigbee2mqtt: 2.12.0 -> 2.12.1 https://github.com/Koenkk/zigbee2mqtt/releases/tag/2.12.1 (cherry picked from commit 6b1e245992ccc541c720965418eec727f703fa6b) --- pkgs/by-name/zi/zigbee2mqtt/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/zi/zigbee2mqtt/package.nix b/pkgs/by-name/zi/zigbee2mqtt/package.nix index 8311c4f3ba47..ddf527f7b93e 100644 --- a/pkgs/by-name/zi/zigbee2mqtt/package.nix +++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix @@ -14,20 +14,20 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "zigbee2mqtt"; - version = "2.12.0"; + version = "2.12.1"; src = fetchFromGitHub { owner = "Koenkk"; repo = "zigbee2mqtt"; tag = finalAttrs.version; - hash = "sha256-R5r8aJmIF3FLc4+wESLoNw+xeE6ixSYy2xcg1gIX2YA="; + hash = "sha256-DTL27AcPmAI5XEEHb2S74LYWm4f6kUASsTmQeGftDzM="; }; pnpmDeps = fetchPnpmDeps { inherit (finalAttrs) pname version src; pnpm = pnpm_10; fetcherVersion = 4; - hash = "sha256-/cNV0PHxoR8P7JXSArPq2hziQnwH5n858SzQhktvXus="; + hash = "sha256-RI6tz8pyqYg/L6wSc0Rt5ZqHT8aktReyVjNgISPqKRQ="; }; nativeBuildInputs = [ From 5e35bc8c1bab3d13d3dcc44a4587bbed93e13c3f Mon Sep 17 00:00:00 2001 From: yaya Date: Wed, 1 Jul 2026 13:36:17 +0200 Subject: [PATCH 39/56] .github/workflows: Remove 25.11 workflows NixOS 25.11 is end-of-life. (cherry picked from commit 976c1f007e4589f4850994a00d04a0f706a1d416) --- .github/workflows/periodic-merge-24h.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml index 3aac3ccf8b73..d14c482df755 100644 --- a/.github/workflows/periodic-merge-24h.yml +++ b/.github/workflows/periodic-merge-24h.yml @@ -31,12 +31,6 @@ jobs: max-parallel: 1 matrix: pairs: - - from: release-25.11 - into: staging-next-25.11 - - from: staging-next-25.11 - into: staging-25.11 - - from: release-25.11 - into: staging-nixos-25.11 - from: release-26.05 into: staging-next-26.05 - from: staging-next-26.05 From f58c1e0012d4d0d30f9f5ea44b15259e4143652e Mon Sep 17 00:00:00 2001 From: yaya Date: Wed, 1 Jul 2026 13:55:42 +0200 Subject: [PATCH 40/56] .github/labeler-no-sync: Remove `backport release-25.11` NixOS 25.11 is end-of-life. (cherry picked from commit fd782901e5c4c00431c8cb423c411784fcebea77) --- .github/labeler-no-sync.yml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/.github/labeler-no-sync.yml b/.github/labeler-no-sync.yml index 77d09a0ef8c0..88a2b267484a 100644 --- a/.github/labeler-no-sync.yml +++ b/.github/labeler-no-sync.yml @@ -22,17 +22,6 @@ - doc/**/* - nixos/doc/**/* -"backport release-25.11": - - all: - - changed-files: - - any-glob-to-any-file: - - .github/actions/**/* - - .github/workflows/* - - .github/labeler*.yml - - ci/**/*.* - - maintainers/github-teams.json - - base-branch: ['master'] - "backport release-26.05": - all: - changed-files: From 4573a3a2509302b2f935d1847abd33f3887bf5a9 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 1 Jul 2026 16:04:18 +0200 Subject: [PATCH 41/56] pretix: 2026.4.4 -> 2026.4.5 https://pretix.eu/about/en/blog/20260701-release-2026-5-3/ https://github.com/pretix/pretix/compare/v2026.4.4...v2026.4.5 Fixes: CVE-2026-13602, CVE-2026-13603 --- pkgs/by-name/pr/pretix/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix index 103f13593b2a..1bf5b113e64c 100644 --- a/pkgs/by-name/pr/pretix/package.nix +++ b/pkgs/by-name/pr/pretix/package.nix @@ -51,13 +51,13 @@ let }; pname = "pretix"; - version = "2026.4.4"; + version = "2026.4.5"; src = fetchFromGitHub { owner = "pretix"; repo = "pretix"; tag = "v${version}"; - hash = "sha256-aDOI2XZF0n653ZgTtgEOb+JL/R0zDsdHOFvBsQdbwRw="; + hash = "sha256-Tj9/fqCjRbjVlH32toSl8XKc1nmIj0gmR0+xRBlvHpY="; }; npmDeps = buildNpmPackage { From 436e569ef97c7542c9e1fc3441396849180ac48b Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 1 Jul 2026 16:03:54 +0200 Subject: [PATCH 42/56] pretix.plugins.mollie: 2.5.6 -> 2.5.7 https://github.com/pretix/pretix-mollie/compare/v2.5.6...v2.5.7 Fixes: CVE-2026-13602 (cherry picked from commit c87a47c86b0733e59e50d15cce4a09f277ee07c1) --- pkgs/by-name/pr/pretix/plugins/mollie/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix index b17d5d52a534..1b3aa88c3a92 100644 --- a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix +++ b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix @@ -8,14 +8,14 @@ buildPythonPackage rec { pname = "pretix-mollie"; - version = "2.5.6"; + version = "2.5.7"; pyproject = true; src = fetchFromGitHub { owner = "pretix"; repo = "pretix-mollie"; tag = "v${version}"; - hash = "sha256-XInwUecuC3sEcRpuS+xa7Gb2Isb18SexbZ2+CcUF7/E="; + hash = "sha256-LApnvohrNiyqRmBIysxR5ZAMy5nZhPts0znirOUsxq0="; }; build-system = [ From 2c2fce71f9e383b52a9215436265c95c26a5848c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 1 Jul 2026 16:04:37 +0200 Subject: [PATCH 43/56] pretix.plugins.payone: 1.4.2 -> 1.4.3 https://github.com/pretix/pretix-payone/compare/v1.4.2...v1.4.3 Fixes: CVE-2026-13602 (cherry picked from commit ddcda767a17acec0e9d3c16dc1eb341dd314da4b) --- pkgs/by-name/pr/pretix/plugins/payone/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pr/pretix/plugins/payone/package.nix b/pkgs/by-name/pr/pretix/plugins/payone/package.nix index 1d38c6c820b5..60bff54203cd 100644 --- a/pkgs/by-name/pr/pretix/plugins/payone/package.nix +++ b/pkgs/by-name/pr/pretix/plugins/payone/package.nix @@ -9,14 +9,14 @@ buildPythonPackage (finalAttrs: { pname = "pretix-payone"; - version = "1.4.2"; + version = "1.4.3"; pyproject = true; src = fetchFromGitHub { owner = "pretix"; repo = "pretix-payone"; rev = "v${finalAttrs.version}"; - hash = "sha256-y1BO8Hz/pGKalURCbF3QJ49xn+L/sd8SWTGdCIl43yw="; + hash = "sha256-ru944WkeNBYq5XkIMoAFLgGcU2gGxClEYVhCwuZGioI="; }; build-system = [ From 23addc14c1687bd4c52e70e69e2de7f4e655858d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 1 Jul 2026 07:48:45 +0000 Subject: [PATCH 44/56] ghostfolio: 3.13.0 -> 3.18.0 (cherry picked from commit 8816ce5bdbe18665069e993c5451c74606334934) --- pkgs/by-name/gh/ghostfolio/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix index 5ee10e29eb8f..11b14a9bcb6d 100644 --- a/pkgs/by-name/gh/ghostfolio/package.nix +++ b/pkgs/by-name/gh/ghostfolio/package.nix @@ -12,13 +12,13 @@ buildNpmPackage (finalAttrs: { pname = "ghostfolio"; - version = "3.13.0"; + version = "3.18.0"; src = fetchFromGitHub { owner = "ghostfolio"; repo = "ghostfolio"; tag = finalAttrs.version; - hash = "sha256-tPVGMAP45x/4NTL8px9jEbW6hQyhiOYiZp0tuDdfYL8="; + hash = "sha256-BSH7NQV2iTmfGE6dHQEeObQQ5CkKZxsgHAbrjElHHHE="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. leaveDotGit = true; @@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: { ''; }; - npmDepsHash = "sha256-0/tHzfJrotlCxhiiVC6yddlj62Ef6IAeaZf/xufFiWU="; + npmDepsHash = "sha256-0Si+3zHyGoMbgEpNWdZVp+obNE0oqM8ghYDZvloJU5g="; postPatch = '' substituteInPlace replace.build.mjs \ From 598fee4e1aad4e9277cb556cd1022716c9dc0b74 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 1 Jul 2026 14:04:20 +0000 Subject: [PATCH 45/56] lockbook-desktop: 26.6.16 -> 26.6.22 (cherry picked from commit f9595d61c87575539b2431b91e68112ed9796f1d) --- pkgs/by-name/lo/lockbook-desktop/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix index 3425e2bbdfc1..7a553d786a10 100644 --- a/pkgs/by-name/lo/lockbook-desktop/package.nix +++ b/pkgs/by-name/lo/lockbook-desktop/package.nix @@ -18,16 +18,16 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "lockbook-desktop"; - version = "26.6.16"; + version = "26.6.22"; src = fetchFromGitHub { owner = "lockbook"; repo = "lockbook"; tag = finalAttrs.version; - hash = "sha256-HtmuFN7iNNwuQ0CXzqnEJN4PNh0D7weHniegtF4EuqQ="; + hash = "sha256-OgNscshw445uf2PtiYVlyCfx/l2BNZyZK5QwQSunCQ0="; }; - cargoHash = "sha256-PUfXwtxuaheoyZA2fAyoc9CyD/oBAjkUsVrP6U7qvA0="; + cargoHash = "sha256-USdDHcWexjAllH/kOZVc4XMehESoIozkvvOw47ZeBD8="; nativeBuildInputs = [ pkg-config From 5090b88d5bee4d0f2df275ff658d0283f843323b Mon Sep 17 00:00:00 2001 From: Johannes Kirschbauer Date: Fri, 26 Jun 2026 17:07:39 +0200 Subject: [PATCH 46/56] ci: use nixos-render-docs from tree This adds the small cost of building 'nixos-render-docs', a small python package. For the benefit of improved iteration speed during refinement of the docs rendering See: https://github.com/NixOS/nixpkgs/pull/535662 for motivation (cherry picked from commit 77ea5f7ed3d3ec1480f57a7f10a10bfc2a0a6308) --- ci/default.nix | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/ci/default.nix b/ci/default.nix index 6ade8164d503..eb7b45e4bbb5 100644 --- a/ci/default.nix +++ b/ci/default.nix @@ -38,6 +38,17 @@ let check = treefmt.check nixFilesSrc; }; + # nixos-render-docs and nixos-render-docs-redirects + # Should be used from tree to build the matching in-tree documentation + docPkgs = pkgs.extend ( + final: prev: { + nixos-render-docs = final.callPackage ../pkgs/by-name/ni/nixos-render-docs/package.nix { }; + nixos-render-docs-redirects = + final.callPackage ../pkgs/by-name/ni/nixos-render-docs-redirects/package.nix + { }; + } + ); + in rec { inherit pkgs fmt; @@ -53,7 +64,7 @@ rec { # CI jobs lib-tests = import ../lib/tests/release.nix { inherit pkgs; }; manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null; - manual-nixpkgs = (import ../doc { inherit pkgs; }); + manual-nixpkgs = (import ../doc { pkgs = docPkgs; }); nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix { nix = pkgs.nixVersions.latest; }; From 77d22d9c963b4201c73576edd2fe8a89c6e1edb1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 1 Jul 2026 13:42:07 +0000 Subject: [PATCH 47/56] mdns-scanner: 0.27.2 -> 0.27.3 (cherry picked from commit 89f275a25385953c755aabc67d3cfe90e07fc8a7) --- pkgs/by-name/md/mdns-scanner/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/md/mdns-scanner/package.nix b/pkgs/by-name/md/mdns-scanner/package.nix index 886ee73438fe..34ab0e9b72ab 100644 --- a/pkgs/by-name/md/mdns-scanner/package.nix +++ b/pkgs/by-name/md/mdns-scanner/package.nix @@ -7,7 +7,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "mdns-scanner"; - version = "0.27.2"; + version = "0.27.3"; __structuredAttrs = true; @@ -15,10 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: { owner = "CramBL"; repo = "mdns-scanner"; tag = "v${finalAttrs.version}"; - hash = "sha256-oqU7lpDD2umCBAcPYKjo+5kdsCu3gjBiP5MPNvH2fhs="; + hash = "sha256-daJEiYOF1N2m4zVbsBuRl8KGrDs62GGDP9lCok9r/3w="; }; - cargoHash = "sha256-TqTN9qXnfvP067kh+bfdXlU1lKaZistIvq1qJsgmJ8o="; + cargoHash = "sha256-eCB5nVEucMFX/wz9zrAKO9d3yI7BK/URpjlU39Y4g4I="; passthru.updateScript = nix-update-script { }; From 2dba4298f79c048e956d31c30475cdf12d66b96a Mon Sep 17 00:00:00 2001 From: Hythera <87016780+Hythera@users.noreply.github.com> Date: Tue, 30 Jun 2026 23:03:53 +0200 Subject: [PATCH 48/56] librewolf-unwrapped: 152.0.2-1 -> 152.0.4-1 diff: https://codeberg.org/librewolf/source/compare/152.0.2-1...152.0.4-1 mfsa: https://www.mozilla.org/en-US/security/advisories/mfsa2026-62 (cherry picked from commit 3b962d6ca741648c6dc43b0de6f374d5fed907c7) --- pkgs/by-name/li/librewolf-unwrapped/src.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json index 7995f6b699ea..9c6e1baf5b1f 100644 --- a/pkgs/by-name/li/librewolf-unwrapped/src.json +++ b/pkgs/by-name/li/librewolf-unwrapped/src.json @@ -1,11 +1,11 @@ { - "packageVersion": "152.0.2-1", + "packageVersion": "152.0.4-1", "source": { - "rev": "152.0.2-1", - "hash": "sha256-CgH0HOtNbdoHMZ/MJL/zPK0Gn+e+qqtZjqPDSq63gX8=" + "rev": "152.0.4-1", + "hash": "sha256-sbL3lZyYaewS84Yhb9HOHgV3xPvzbu+IcjdAW1hdlAY=" }, "firefox": { - "version": "152.0.2", - "hash": "sha512-5OVM///P1XUerFgXp7dLDvCqQ/wA7yk5fMnfmqUlcrInK5bmA3OnDXEr5NyEkXDY1cG0SfPql4tKso3uGQVrAw==" + "version": "152.0.4", + "hash": "sha512-DFZiq6j7iXkCr5Xbsv2YixltnPmui5h66J4KZJKsdTuNS4u3sydJCcLrIAqwmN81biPNYIRVZGf1XmkScxfzmg==" } } From 8a1b3516cfe4d0c63afb70d912ae035311ad6de0 Mon Sep 17 00:00:00 2001 From: emilylange Date: Wed, 1 Jul 2026 13:23:25 +0200 Subject: [PATCH 49/56] chromium,chromedriver: 149.0.7827.200 -> 150.0.7871.46 https://developer.chrome.com/blog/new-in-chrome-150 https://developer.chrome.com/release_notes/150 https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html This update includes 382 security fixes. CVEs: CVE-2026-13774 CVE-2026-13775 CVE-2026-13776 CVE-2026-13777 CVE-2026-13778 CVE-2026-13779 CVE-2026-13780 CVE-2026-13781 CVE-2026-13782 CVE-2026-13783 CVE-2026-13784 CVE-2026-13785 CVE-2026-13786 CVE-2026-13787 CVE-2026-13788 CVE-2026-13789 CVE-2026-13790 CVE-2026-13791 CVE-2026-13792 CVE-2026-13793 CVE-2026-13794 CVE-2026-13795 CVE-2026-13796 CVE-2026-13797 CVE-2026-13798 CVE-2026-13799 CVE-2026-13800 CVE-2026-13801 CVE-2026-13802 CVE-2026-13803 CVE-2026-13804 CVE-2026-13805 CVE-2026-13806 CVE-2026-13807 CVE-2026-13808 CVE-2026-13809 CVE-2026-13810 CVE-2026-13811 CVE-2026-13812 CVE-2026-13813 CVE-2026-13814 CVE-2026-13815 CVE-2026-13816 CVE-2026-13817 CVE-2026-13818 CVE-2026-13819 CVE-2026-13820 CVE-2026-13821 CVE-2026-13822 CVE-2026-13823 CVE-2026-13824 CVE-2026-13825 CVE-2026-13826 CVE-2026-13827 CVE-2026-13828 CVE-2026-13829 CVE-2026-13830 CVE-2026-13831 CVE-2026-13832 CVE-2026-13833 CVE-2026-13834 CVE-2026-13835 CVE-2026-13836 CVE-2026-13837 CVE-2026-13838 CVE-2026-13839 CVE-2026-13840 CVE-2026-13841 CVE-2026-13842 CVE-2026-13843 CVE-2026-13844 CVE-2026-13845 CVE-2026-13846 CVE-2026-13847 CVE-2026-13848 CVE-2026-13849 CVE-2026-13850 CVE-2026-13851 CVE-2026-13852 CVE-2026-13853 CVE-2026-13854 CVE-2026-13855 CVE-2026-13856 CVE-2026-13857 CVE-2026-13858 CVE-2026-13859 CVE-2026-13860 CVE-2026-13861 CVE-2026-13862 CVE-2026-13863 CVE-2026-13864 CVE-2026-13865 CVE-2026-13866 CVE-2026-13867 CVE-2026-13868 CVE-2026-13869 CVE-2026-13870 CVE-2026-13871 CVE-2026-13872 CVE-2026-13873 CVE-2026-13874 CVE-2026-13875 CVE-2026-13876 CVE-2026-13877 CVE-2026-13878 CVE-2026-13879 CVE-2026-13880 CVE-2026-13881 CVE-2026-13882 CVE-2026-13883 CVE-2026-13884 CVE-2026-13885 CVE-2026-13886 CVE-2026-13887 CVE-2026-13888 CVE-2026-13889 CVE-2026-13890 CVE-2026-13891 CVE-2026-13892 CVE-2026-13893 CVE-2026-13894 CVE-2026-13895 CVE-2026-13896 CVE-2026-13897 CVE-2026-13898 CVE-2026-13899 CVE-2026-13900 CVE-2026-13901 CVE-2026-13902 CVE-2026-13903 CVE-2026-13904 CVE-2026-13905 CVE-2026-13906 CVE-2026-13907 CVE-2026-13908 CVE-2026-13909 CVE-2026-13910 CVE-2026-13911 CVE-2026-13912 CVE-2026-13913 CVE-2026-13914 CVE-2026-13915 CVE-2026-13916 CVE-2026-13917 CVE-2026-13918 CVE-2026-13919 CVE-2026-13920 CVE-2026-13921 CVE-2026-13922 CVE-2026-13923 CVE-2026-13924 CVE-2026-13925 CVE-2026-13926 CVE-2026-13927 CVE-2026-13928 CVE-2026-13929 CVE-2026-13930 CVE-2026-13931 CVE-2026-13932 CVE-2026-13933 CVE-2026-13934 CVE-2026-13935 CVE-2026-13936 CVE-2026-13937 CVE-2026-13938 CVE-2026-13939 CVE-2026-13940 CVE-2026-13941 CVE-2026-13942 CVE-2026-13943 CVE-2026-13944 CVE-2026-13945 CVE-2026-13946 CVE-2026-13947 CVE-2026-13948 CVE-2026-13949 CVE-2026-13950 CVE-2026-13951 CVE-2026-13952 CVE-2026-13953 CVE-2026-13954 CVE-2026-13955 CVE-2026-13956 CVE-2026-13957 CVE-2026-13958 CVE-2026-13959 CVE-2026-13960 CVE-2026-13961 CVE-2026-13962 CVE-2026-13963 CVE-2026-13964 CVE-2026-13965 CVE-2026-13966 CVE-2026-13967 CVE-2026-13968 CVE-2026-13969 CVE-2026-13970 CVE-2026-13971 CVE-2026-13972 CVE-2026-13973 CVE-2026-13974 CVE-2026-13975 CVE-2026-13976 CVE-2026-13977 CVE-2026-13978 CVE-2026-13979 CVE-2026-13980 CVE-2026-13981 CVE-2026-13982 CVE-2026-13983 CVE-2026-13984 CVE-2026-13985 CVE-2026-13986 CVE-2026-13987 CVE-2026-13988 CVE-2026-13989 CVE-2026-13990 CVE-2026-13991 CVE-2026-13992 CVE-2026-13993 CVE-2026-13994 CVE-2026-13995 CVE-2026-13996 CVE-2026-13997 CVE-2026-13998 CVE-2026-13999 CVE-2026-14000 CVE-2026-14001 CVE-2026-14002 CVE-2026-14003 CVE-2026-14004 CVE-2026-14005 CVE-2026-14006 CVE-2026-14007 CVE-2026-14008 CVE-2026-14009 CVE-2026-14010 CVE-2026-14011 CVE-2026-14012 CVE-2026-14013 CVE-2026-14014 CVE-2026-14015 CVE-2026-14016 CVE-2026-14017 CVE-2026-14018 CVE-2026-14019 CVE-2026-14020 CVE-2026-14021 CVE-2026-14022 CVE-2026-14023 CVE-2026-14024 CVE-2026-14025 CVE-2026-14026 CVE-2026-14027 CVE-2026-14028 CVE-2026-14030 CVE-2026-14031 CVE-2026-14032 CVE-2026-14033 CVE-2026-14034 CVE-2026-14035 CVE-2026-14036 CVE-2026-14037 CVE-2026-14038 CVE-2026-14039 CVE-2026-14040 CVE-2026-14041 CVE-2026-14042 CVE-2026-14043 CVE-2026-14044 CVE-2026-14045 CVE-2026-14046 CVE-2026-14047 CVE-2026-14048 CVE-2026-14049 CVE-2026-14050 CVE-2026-14051 CVE-2026-14052 CVE-2026-14053 CVE-2026-14054 CVE-2026-14055 CVE-2026-14056 CVE-2026-14057 CVE-2026-14058 CVE-2026-14059 CVE-2026-14060 CVE-2026-14061 CVE-2026-14062 CVE-2026-14063 CVE-2026-14064 CVE-2026-14065 CVE-2026-14066 CVE-2026-14067 CVE-2026-14068 CVE-2026-14069 CVE-2026-14070 CVE-2026-14071 CVE-2026-14072 CVE-2026-14073 CVE-2026-14074 CVE-2026-14075 CVE-2026-14076 CVE-2026-14077 CVE-2026-14078 CVE-2026-14079 CVE-2026-14080 CVE-2026-14081 CVE-2026-14082 CVE-2026-14083 CVE-2026-14084 CVE-2026-14085 CVE-2026-14086 CVE-2026-14087 CVE-2026-14088 CVE-2026-14089 CVE-2026-14090 CVE-2026-14091 CVE-2026-14092 CVE-2026-14093 CVE-2026-14094 CVE-2026-14095 CVE-2026-14096 CVE-2026-14097 CVE-2026-14098 CVE-2026-14099 CVE-2026-14100 CVE-2026-14101 CVE-2026-14102 CVE-2026-14103 CVE-2026-14104 CVE-2026-14105 CVE-2026-14106 CVE-2026-14107 CVE-2026-14108 CVE-2026-14109 CVE-2026-14110 CVE-2026-14111 CVE-2026-14112 CVE-2026-14113 CVE-2026-14114 CVE-2026-14115 CVE-2026-14116 CVE-2026-14117 CVE-2026-14118 CVE-2026-14119 CVE-2026-14120 CVE-2026-14121 CVE-2026-14122 CVE-2026-14123 CVE-2026-14124 CVE-2026-14125 CVE-2026-14126 CVE-2026-14127 CVE-2026-14128 CVE-2026-14129 CVE-2026-14130 CVE-2026-14131 CVE-2026-14132 CVE-2026-14133 CVE-2026-14134 CVE-2026-14135 CVE-2026-14136 CVE-2026-14137 CVE-2026-14138 CVE-2026-14139 CVE-2026-14140 CVE-2026-14141 CVE-2026-14142 CVE-2026-14143 CVE-2026-14144 CVE-2026-14145 CVE-2026-14146 CVE-2026-14147 CVE-2026-14148 CVE-2026-14149 CVE-2026-14150 CVE-2026-14151 CVE-2026-14152 CVE-2026-14153 CVE-2026-14154 CVE-2026-14155 CVE-2026-14156 (cherry picked from commit 7cbda565f86eb363f71768a874962fe94731b2bc) --- .../networking/browsers/chromium/common.nix | 76 +++-- .../browsers/chromium/depot_tools.py | 9 +- .../networking/browsers/chromium/info.json | 321 +++++++++--------- .../chromium/patches/chromium-150-rust.patch | 21 ++ ...e-disable-auto-download-allow-bundle.patch | 27 ++ 5 files changed, 279 insertions(+), 175 deletions(-) create mode 100644 pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch create mode 100644 pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix index 3d4138570f74..dd4df835a93c 100644 --- a/pkgs/applications/networking/browsers/chromium/common.nix +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -480,13 +480,15 @@ let # BUNDLE_WIDEVINE_CDM build flag does work in the way we want though. # We also need enable_widevine_cdm_component to be false. Unfortunately it isn't exposed as gn # flag (declare_args) so we simply hardcode it to false. - ./patches/widevine-disable-auto-download-allow-bundle.patch + ./patches/${lib.optionalString (chromiumVersionAtLeast "150") "chromium-150-"}widevine-disable-auto-download-allow-bundle.patch ] - ++ [ + ++ lib.optionals (!chromiumVersionAtLeast "150") [ # Required to fix the build with a more recent wayland-protocols version # (we currently package 1.26 in Nixpkgs while Chromium bundles 1.21): # Source: https://bugs.chromium.org/p/angleproject/issues/detail?id=7582#c1 ./patches/angle-wayland-include-protocol.patch + ] + ++ [ # Chromium reads initial_preferences from its own executable directory # This patch modifies it to read /etc/chromium/initial_preferences ./patches/chromium-initial-prefs.patch @@ -504,11 +506,16 @@ let # allowing us to use our rustc and our clang. ./patches/chromium-140-rust.patch ] - ++ lib.optionals (chromiumVersionAtLeast "141") [ + ++ lib.optionals (versionRange "141" "150") [ # Rebased variant of the patch above due to # https://chromium-review.googlesource.com/c/chromium/src/+/6897026 ./patches/chromium-141-rust.patch ] + ++ lib.optionals (chromiumVersionAtLeast "150") [ + # Rebased variant of the patch above due to + # https://chromium-review.googlesource.com/c/chromium/src/+/7858711 + ./patches/chromium-150-rust.patch + ] ++ lib.optionals (!chromiumVersionAtLeast "145" && stdenv.hostPlatform.isAarch64) [ # Reverts decommit pooled pages which causes random crashes of tabs on systems # with page sizes different than 4k. It 'supports' runtime page sizes, but has @@ -676,6 +683,17 @@ let revert = true; hash = "sha256-7xg8IZ2gO+Wtnv7lWLVE3lLpcmMgvtDtcWwUuMBzkrE="; }) + ] + ++ lib.optionals (versionRange "150" "151") [ + # ninja: Entering directory `out/Release' + # ninja: error: 'ar', needed by 'default_for_rust_host_build_tools/obj/build/rust/allocator/liballoc_error_handler_impl.a', missing and no known rule to make it + (fetchpatch { + name = "chromium-150-backport-build--Omit-ar-from-inputs-when-resolved-via--PATH.patch"; + # https://chromium-review.googlesource.com/c/chromium/src/+/7904982 + url = "https://chromium.googlesource.com/chromium/src/+/60f987d8d5f7272793a40290d060b8f50933f825^!?format=TEXT"; + decode = "base64 -d"; + hash = "sha256-MryWxSwBxSIONhl3X1cDxTWwNWy8a4yt/sqkrueSUNs="; + }) ]; postPatch = @@ -910,6 +928,12 @@ let # TODO: remove opt-out of https://chromium.googlesource.com/chromium/src/+/main/docs/modules.md use_clang_modules = false; } + // lib.optionalAttrs (chromiumVersionAtLeast "150") { + # ERROR at //build/modules/BUILD.gn:80:23: Directory does not exist: /usr/include/ + # system_headers += expand_directory("${sysroot}/${root_include_dir}", true) + # ^------------------------------------------------------ + use_unified_system_module = false; + } // { use_qt5 = false; use_qt6 = false; @@ -986,24 +1010,34 @@ let runHook postConfigure ''; - # Chromium expects nightly/bleeding edge rustc features to be available. - # Our rustc in nixpkgs follows stable, but since bootstrapping rustc requires - # nightly features too, we can (ab-)use RUSTC_BOOTSTRAP here as well to - # enable those features in our stable builds. - env.RUSTC_BOOTSTRAP = 1; - # Mute some warnings that are enabled by default. This is useful because - # our Clang is always older than Chromium's and the build logs have a size - # of approx. 25 MB without this option (and this saves e.g. 66 %). - env.NIX_CFLAGS_COMPILE = - "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow" - # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined] - # because of hardeningDisable = [ "strictflexarrays1" ]; - + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined"; - env.BUILD_CC = "$CC_FOR_BUILD"; - env.BUILD_CXX = "$CXX_FOR_BUILD"; - env.BUILD_AR = "$AR_FOR_BUILD"; - env.BUILD_NM = "$NM_FOR_BUILD"; - env.BUILD_READELF = "$READELF_FOR_BUILD"; + env = { + # Chromium expects nightly/bleeding edge rustc features to be available. + # Our rustc in nixpkgs follows stable, but since bootstrapping rustc requires + # nightly features too, we can (ab-)use RUSTC_BOOTSTRAP here as well to + # enable those features in our stable builds. + RUSTC_BOOTSTRAP = 1; + + # Mute some warnings that are enabled by default. This is useful because + # our Clang is always older than Chromium's and the build logs have a size + # of approx. 25 MB without this option (and this saves e.g. 66 %). + NIX_CFLAGS_COMPILE = + "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow" + # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined] + # because of hardeningDisable = [ "strictflexarrays1" ]; + + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined"; + + BUILD_CC = "$CC_FOR_BUILD"; + BUILD_CXX = "$CXX_FOR_BUILD"; + BUILD_AR = "$AR_FOR_BUILD"; + BUILD_NM = "$NM_FOR_BUILD"; + BUILD_READELF = "$READELF_FOR_BUILD"; + } + // lib.optionalAttrs (chromiumVersionAtLeast "150") { + # [56385/56385] LINK ./chrome + # FAILED: [code=1] chrome + # /nix/store/[...]/bin/ld.lld: line 288: /nix/store/[...]/bin/ld.lld: Argument list too long + NIX_LD_USE_RESPONSE_FILE = 1; + }; buildPhase = let diff --git a/pkgs/applications/networking/browsers/chromium/depot_tools.py b/pkgs/applications/networking/browsers/chromium/depot_tools.py index ab8007a4e910..45f18098ff61 100755 --- a/pkgs/applications/networking/browsers/chromium/depot_tools.py +++ b/pkgs/applications/networking/browsers/chromium/depot_tools.py @@ -43,7 +43,14 @@ class Repo: ) deps_file = self.get_file("DEPS") - evaluated = gclient_eval.Parse(deps_file, vars_override=repo_vars, filename="DEPS") + evaluated = gclient_eval.Parse( + deps_file, + filename="DEPS", + vars_override=repo_vars, + # KeyError: "host_cpu was used as a variable, but was not declared in the vars dict (file 'DEPS', line 114)" + # https://chromium.googlesource.com/webpagereplay.git/+/b2b856131e36c99e9de9c419fe8ca02f857082ba/DEPS#114 + builtin_vars= {"host_cpu": "*host_cpu_placeholder*"} if path == "src/third_party/webpagereplay" else None, + ) repo_vars = dict(evaluated.get("vars", {})) | repo_vars diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json index c87e4a647a90..6e075e7f9b3b 100644 --- a/pkgs/applications/networking/browsers/chromium/info.json +++ b/pkgs/applications/networking/browsers/chromium/info.json @@ -1,6 +1,6 @@ { "chromium": { - "version": "149.0.7827.200", + "version": "150.0.7871.46", "chromedriver": { "version": "149.0.7827.201", "hash_darwin": "sha256-MHCcid+7wdYm8uIdrUIlXrk8ADHNUUXzPyMPFGP98WY=", @@ -8,21 +8,21 @@ }, "deps": { "depot_tools": { - "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90", - "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4=" + "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583", + "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY=" }, "gn": { - "version": "0-unstable-2026-05-01", - "rev": "1740f5c25bcac5a650ee3d1c1ec22bfa25fcd756", - "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04=" + "version": "0-unstable-2026-05-27", + "rev": "3357c4f51b1a9e676378c695dd9c7e9911c35ee6", + "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8=" }, "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg=" }, "DEPS": { "src": { "url": "https://chromium.googlesource.com/chromium/src.git", - "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a", - "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=", + "rev": "5b586c06e0d27582900f17e2d59c5370d8d6e0bb", + "hash": "sha256-OAZNyZtR5WFWW42r74RSy9fT7Eb7CNZwzoIHhuoqR28=", "recompress": true }, "src/third_party/clang-format/script": { @@ -32,13 +32,13 @@ }, "src/third_party/compiler-rt/src": { "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git", - "rev": "0408cce08083f3d81379ed7d9f5bd26c03e1495b", - "hash": "sha256-kR5osTmp2girvNRVHzEKMZDCelgux9RrRuMoXMCRSGM=" + "rev": "03641f7a5b05e48e318d64369057db577cafc594", + "hash": "sha256-KnWESGG6aI0S+fkJ3/T1x4QSiIYaOOvWUAm6l6l9iME=" }, "src/third_party/libc++/src": { "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git", - "rev": "be1c391acca009d8d80535ce924e3d285451cdfa", - "hash": "sha256-zKb9PUiiBvhVhWnbQwR8uOFJ9gt3uYmfJ4M9ijpgKRc=" + "rev": "5abc7f839700f0f17338434e1c1c6a8c87c00c11", + "hash": "sha256-vT1km7JgVpotDoNK+ae1gplSHcwrVNLsv/QAFUrDsIM=" }, "src/third_party/libc++abi/src": { "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git", @@ -47,13 +47,13 @@ }, "src/third_party/libunwind/src": { "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git", - "rev": "71192be150bbe04d87bb5298512d464e38d2f654", - "hash": "sha256-PxXemxdWZoEavKDOovi67IVWEr2YW8YK2F0LXM3LZPw=" + "rev": "d6c7a21e978f0adaa43accaad53bc64f0b64f6ec", + "hash": "sha256-EuaVSYiR7qrlYqBR0UqdWCvwdzJSn0RS2wC/lnP19AE=" }, "src/third_party/llvm-libc/src": { "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git", - "rev": "deb95b5e48e875920a2eaae799c8dbcd76a6a4db", - "hash": "sha256-oAgIT3+vjBrX86jgi/Pb0SCyco0lozjBjXlrKm6i56M=" + "rev": "6e5ec6f78d8b9f2e8a50fcc5692d1fc8b2964bde", + "hash": "sha256-qrkx8Z1fc088Ja32obIUPxDwklI7i1wdEw051UZ08u8=" }, "src/chrome/test/data/perf/canvas_bench": { "url": "https://chromium.googlesource.com/chromium/canvas_bench.git", @@ -72,8 +72,8 @@ }, "src/docs/website": { "url": "https://chromium.googlesource.com/website.git", - "rev": "c9a9ad55e9ec9934244e58a5a8cab9a295526010", - "hash": "sha256-2GKWEnlExrTzoIYMxeP4n2klLLT/phB5ZVJ5Nj3/aoY=" + "rev": "3da515a67f412be05ea1ea6b39832a69aef8f54e", + "hash": "sha256-wrkFsPX7jrsjD/Ow1gna/xLvk0E49m5GVxP1G7Vx7HM=" }, "src/media/cdm/api": { "url": "https://chromium.googlesource.com/chromium/cdm.git", @@ -82,8 +82,8 @@ }, "src/net/third_party/quiche/src": { "url": "https://quiche.googlesource.com/quiche.git", - "rev": "fafc2fe9efc9f2e28a0815229fc14ca30c266ba8", - "hash": "sha256-4UmjE41MOFCBa3APDMyyJwkeV6LhHl5UsMxZpPRDsRY=" + "rev": "997d654308b6a1a17435e472ef5190aecb12e3eb", + "hash": "sha256-xgDgW2foZZEWpr0ibSG21kf028FN07/1ecOqFCkNj/I=" }, "src/testing/libfuzzer/fuzzers/wasm_corpus": { "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git", @@ -92,8 +92,8 @@ }, "src/third_party/angle": { "url": "https://chromium.googlesource.com/angle/angle.git", - "rev": "355cc61af2aadd8f0494800325b2bf9908138108", - "hash": "sha256-fgaCyO0oaz90aTaWMHH8ocySA0hXDHsPEl6vtMj4BY0=" + "rev": "bbf3d8a4755268f016087be2f56099fa5a5f3f6e", + "hash": "sha256-8iuHtNgHumlMXeXj2k0ZPcvnTeJ00di298+789OjScs=" }, "src/third_party/angle/third_party/glmark2/src": { "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2", @@ -107,13 +107,18 @@ }, "src/third_party/angle/third_party/VK-GL-CTS/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS", - "rev": "3fe33a325af90c1c820b1e8109f11ea0f4b60c9b", - "hash": "sha256-JgOdlwtjC5HiCWBAaeM+Ffp9KlbI7+erT0ZRZBlWxXI=" + "rev": "01471f4b3846c97eceb5b16b8acad950808791b2", + "hash": "sha256-SrL+G3osTtJGQslfCBEYbslb2kWtHRrwO87PHi+5o6E=" }, "src/third_party/anonymous_tokens/src": { "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git", - "rev": "208ea23596884f6d86476ea88b64e7931cdec08a", - "hash": "sha256-HLUX0mUzA3xcXbw71sIxFBNEkL8x86urcdJH2Yuuy04=" + "rev": "92d1fdf881a932e7aa2a9b20e006136a659c7a20", + "hash": "sha256-llPt+UR8hY0yaJkYmq+A3ZfRRReuaXN09qpap6C28jc=" + }, + "src/third_party/aria-practices/src": { + "url": "https://chromium.googlesource.com/external/github.com/w3c/aria-practices.git", + "rev": "7b134ce6d19497cce8a67db4a9f59980baf853dc", + "hash": "sha256-POnvoO1KfzJj4CbcMPI0pUTRk5EtHLTOyKKmJCZdXOc=" }, "src/third_party/readability/src": { "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git", @@ -127,13 +132,13 @@ }, "src/third_party/dav1d/libdav1d": { "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git", - "rev": "5cfc3832687e3229117203905faf5425ac6bc0d7", - "hash": "sha256-MWDDrb8P5AIFszY0u5gCrK+kZlbYffIt9Y1b/thXL7I=" + "rev": "62501cc7db378532d7e85ea434b70d57e1ba2cb0", + "hash": "sha256-5cpKTUnhR+QzQJR4KbAvdvqsWnT1fpH0g9MObv8Nx0c=" }, "src/third_party/dawn": { "url": "https://dawn.googlesource.com/dawn.git", - "rev": "54b4153cfef88e048f365f99b962478f0087dfe8", - "hash": "sha256-Bv30zz/pCNVzUl+mKCpusWc94poytv9ZFelZIcs+2B8=" + "rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5", + "hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM=" }, "src/third_party/dawn/third_party/glfw3/src": { "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw", @@ -142,8 +147,8 @@ }, "src/third_party/dawn/third_party/directx-shader-compiler/src": { "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler", - "rev": "d73829d4e677ef00931e8e57de6d544396ab46cb", - "hash": "sha256-BIXNgVeF5x3BZWFWZ1Gz+zpNSOEl+hZWB0GgMEaNS2w=" + "rev": "35c1b99e9e552267da5efaea07c003e322d65777", + "hash": "sha256-pzBk+jUp/FUV8ahHquE0942Qw/DjAUemSM9fxdFJ0JA=" }, "src/third_party/dawn/third_party/directx-headers/src": { "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers", @@ -152,8 +157,8 @@ }, "src/third_party/dawn/third_party/OpenGL-Registry/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry", - "rev": "9cb90ca4902d588bef3c830fbb1da484893bd5fb", - "hash": "sha256-mWVORjrbNFINr5WKAIDVnPs2T+96vkxWqZdJwp8oT9I=" + "rev": "a30033d3e812c9bf10094f1010374a6b15e192eb", + "hash": "sha256-xLacUOSy783bCtv+wUnjVnNLwTQ3eLwUJtYXmELqekY=" }, "src/third_party/dawn/third_party/EGL-Registry/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry", @@ -162,8 +167,8 @@ }, "src/third_party/dawn/third_party/webgpu-cts": { "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts", - "rev": "5c6b119c4fa0d9059c45f7637df1fe26fc80a6e4", - "hash": "sha256-9DAdS2u2YtrCFJu0KTuwRJjTUNexFxdmnn7LkwQ+KiQ=" + "rev": "f08551b0fc4d6cfa5ba582a0235b571aa363102d", + "hash": "sha256-f5kWMnaod/Ved1Fz/vTkdL0ihSUnNM8XN5Ht3Vs1YpU=" }, "src/third_party/dawn/third_party/webgpu-headers/src": { "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers", @@ -187,8 +192,8 @@ }, "src/third_party/boringssl/src": { "url": "https://boringssl.googlesource.com/boringssl.git", - "rev": "65818adf16411ca394625f5747a1af28faf95d2c", - "hash": "sha256-tcTTzQnBp8Od1jdDMrFoCr9bnW0OCjGqUjH3QMnusmo=" + "rev": "3a9254f16eda7a4c5d2260039ff23456a0a34de4", + "hash": "sha256-JuMnNppWhIFHYfk6ANIZLC7ABhqMseoV5LYV7slevBE=" }, "src/third_party/breakpad/breakpad": { "url": "https://chromium.googlesource.com/breakpad/breakpad.git", @@ -202,13 +207,8 @@ }, "src/third_party/catapult": { "url": "https://chromium.googlesource.com/catapult.git", - "rev": "6e4188cabb4f37314ea41e9adfcb2cf9b64e2641", - "hash": "sha256-/kleYYllR22KjxHT2gTMGf6LEUZ1Ud7j593fIIAgqAA=" - }, - "src/third_party/catapult/third_party/webpagereplay": { - "url": "https://chromium.googlesource.com/webpagereplay.git", - "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4", - "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE=" + "rev": "2852bb7e91e4995502ffb72b7ed21412ee157914", + "hash": "sha256-XYufVvzOXD4voZUWUvumQQqLNsx9sy0QmQzNzrgNEWg=" }, "src/third_party/ced/src": { "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git", @@ -227,13 +227,13 @@ }, "src/third_party/cpu_features/src": { "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git", - "rev": "d3b2440fcfc25fe8e6d0d4a85f06d68e98312f5b", - "hash": "sha256-IBJc1sHHh4G3oTzQm1RAHHahsEECC+BDl14DHJ8M1Ys=" + "rev": "81d13c49649f0714dd41fb56bb246398b6584085", + "hash": "sha256-TrC1WMLAhko57rAyDCiAC/IJ0unAqVhyjkh7gKibyi4=" }, "src/third_party/cpuinfo/src": { "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git", - "rev": "3681f0ce1446167d01dfe125d6db96ba2ac31c3c", - "hash": "sha256-PhWbzQgZSUb3eVyx+JTSnxVOAC2WzL2Dw1I9/6LEIsw=" + "rev": "ea6b9f1bb6e1001d8b21574d5bc78ddef62e499d", + "hash": "sha256-/QsOjDik0TnH3FnK7LOwsJkvX+O+2DRFX4eF3MxD3fc=" }, "src/third_party/crc32c/src": { "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git", @@ -242,28 +242,28 @@ }, "src/third_party/cros_system_api": { "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git", - "rev": "7ecd2b41460516ecd7b7d6e5c298db25e1436b6f", - "hash": "sha256-ehbAXv4DZStWDMC3iOjmWkAc4PhAamyI4C9bdXO7FfA=" + "rev": "1c69e700a01a7fd3dd331f526c8a31ac1e5e49d0", + "hash": "sha256-qIwUs0KVU9xYFLN3UUayPLfz0ObA+EN6owKPW61J/5w=" }, "src/third_party/crossbench": { "url": "https://chromium.googlesource.com/crossbench.git", - "rev": "cecd70a5f49f777f603d38d11ac1f66c03c3e8af", - "hash": "sha256-zLwIY8fQVebkfN4KFMbitZODhmiN65JK2s9IG/5Cd+o=" + "rev": "7d52b4ffbc319a7d5a0e0a0ebff744e5281d60c5", + "hash": "sha256-iwwvvIOuRMo/ZEu8Gk0lZaS4P5uGt8zpnYMChpZPcUo=" }, "src/third_party/crossbench-web-tests": { "url": "https://chromium.googlesource.com/chromium/web-tests.git", - "rev": "baf176aadedccc44329231d5dd40346874c2a63e", - "hash": "sha256-oY1/uGB6ykePIklWe35rmJWsnpu/wjkER4TJeP4TTdw=" + "rev": "7b3de17542cc613aaddbfc72c6e12be37eed7b73", + "hash": "sha256-7ly4vaK+Pj4y91t6Q+igQ0890CqKyu9jNBhJnxbNGjI=" }, "src/third_party/depot_tools": { "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git", - "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90", - "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4=" + "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583", + "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY=" }, "src/third_party/devtools-frontend/src": { "url": "https://chromium.googlesource.com/devtools/devtools-frontend", - "rev": "33c2f401a9c8ddad2159eb0ab83aa244a5247361", - "hash": "sha256-M9aULI+HECgA0ptAG47OPK0QuB+xzmb29iOtJ3whpB0=" + "rev": "1d67dc0dafa344bbd6ca75c124e2d6d9d53074d8", + "hash": "sha256-VBXch2YwnKm+lMcZ5L0SlW+vAYeaSwgZvcOhg1TE5/A=" }, "src/third_party/dom_distiller_js/dist": { "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git", @@ -277,8 +277,8 @@ }, "src/third_party/eigen3/src": { "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git", - "rev": "2cf9891537250255f50df5109ffe9e700e2a73de", - "hash": "sha256-1bu1Y9itHIKcwY5J0sF08DSyfElLHiZ6SRsNZkFjz8o=" + "rev": "662ba79d796a2851b10cdafc6668e45b65b1120f", + "hash": "sha256-6bZFDeo7TqWNunkkQv8OJ+7/hfKwoIUtqZoXaeLp6M8=" }, "src/third_party/farmhash/src": { "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git", @@ -287,18 +287,18 @@ }, "src/third_party/fast_float/src": { "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git", - "rev": "05087a303dad9c98768b33c829d398223a649bc6", - "hash": "sha256-ZQm8kDMYdwjKugc2vBG5mwTqXa01u6hODQc/Tai2I9A=" + "rev": "cfd12ebcf1f82c4fd44a950b1815dd0549bc8d89", + "hash": "sha256-hzoB+Mmok3oe6B494uLc5ReWpUcB89zCGPYw4gvanK0=" }, "src/third_party/federated_compute/src": { "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git", - "rev": "3112513bf1a80872311e7718c5385f535a819b89", - "hash": "sha256-jnG3PCxjaYcClRgzOfIkHbbD3xU9TDLyQR3VZUwHIgU=" + "rev": "8de5837b817f28abc54a387a9417631b905ba90a", + "hash": "sha256-GZYo0FjgW8XCplAi6jzzruwDlIzsWjNEVQuCwXBCPz8=" }, "src/third_party/ffmpeg": { "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git", - "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0", - "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk=" + "rev": "ad41607c61898cf7150e0fb20fe4bbabd44922a3", + "hash": "sha256-41qpsOTedB51WMzzHXDiXA19OIzA7wG/Qgbz6IkmWpk=" }, "src/third_party/flac": { "url": "https://chromium.googlesource.com/chromium/deps/flac.git", @@ -327,8 +327,8 @@ }, "src/third_party/freetype/src": { "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git", - "rev": "b6bcd2177f72bb4842c7701d7b7f633bb3fc951a", - "hash": "sha256-TUz3yUD9HxqUMCOpLk74rEf8J0tMTh4ZCuD94AD4+q4=" + "rev": "b08a2eb0dd37f4a6c886fa5b0ecf5b3e1d27aac7", + "hash": "sha256-xnYeUAJx5n8LSg04AknfiudonfmlUdlj8nzHzSZi65I=" }, "src/third_party/fxdiv/src": { "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git", @@ -337,13 +337,13 @@ }, "src/third_party/harfbuzz/src": { "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git", - "rev": "e6741e2205309752839da60ff075b7fa2e7cddd3", - "hash": "sha256-XjUuY17fcZi+dIZFojq+eDsDVrBxtAWRydPdudt56+8=" + "rev": "d639197ed529b05c27f38ebaab365a621d5edad5", + "hash": "sha256-uT4zK2hwHzEH6Nrd2rAeyzpQA1TmwtrdcujKYEUbLsY=" }, "src/third_party/ink/src": { "url": "https://chromium.googlesource.com/external/github.com/google/ink.git", - "rev": "a988417b6d0b1ea03fb0b40269fbc42313acc6fd", - "hash": "sha256-6O+N/ULn8sqsdgFw7VZ7TMjWvCAZbYo398PruPScU/k=" + "rev": "0f9c6172b2ccc6b830ae313d522caf09e6933e06", + "hash": "sha256-LF+OcqNeg+KRuYmGuMZb4tmnr53sZHn/ZW1jg9ArPfc=" }, "src/third_party/instrumented_libs": { "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git", @@ -367,8 +367,8 @@ }, "src/third_party/libgav1/src": { "url": "https://chromium.googlesource.com/codecs/libgav1.git", - "rev": "40f58ed32ff39071c3f2a51056dbc49a070af0dc", - "hash": "sha256-gisU0p0HDL7Po/ZXIIZVOTnxnOuVvSE/FYo9DaEUFfo=" + "rev": "66ac17620652635392f6ab24065c77b035e281c9", + "hash": "sha256-6/zMaX2DPSKpsaqirhrgi3nL/88Qr2VXacmyL5IyJ3U=" }, "src/third_party/googletest/src": { "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git", @@ -392,8 +392,8 @@ }, "src/third_party/jsoncpp/source": { "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git", - "rev": "42e892d96e47b1f6e29844cc705e148ec4856448", - "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q=" + "rev": "d4d072177213b117fb81d4cfda140de090616161", + "hash": "sha256-q+DOwkjRlHacgfWf5UVY02aqfnKK9M/1YRBX6aMce9g=" }, "src/third_party/leveldatabase/src": { "url": "https://chromium.googlesource.com/external/leveldb.git", @@ -407,8 +407,8 @@ }, "src/third_party/fuzztest/src": { "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git", - "rev": "e24a91020ab19c3d6f590bd0911b7acb492f81be", - "hash": "sha256-wFjuvJzGEaal+pIo5UtkdLHYTpoWxRE6Vf5OGLObGQk=" + "rev": "da27bcae1a8902af1ae6a5c55d3674f22709bbf5", + "hash": "sha256-317zRhJPc0D9A58W8fdCGFmpNZ5vACfd/tlZOsp/Cvw=" }, "src/third_party/domato/src": { "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git", @@ -417,18 +417,18 @@ }, "src/third_party/libaddressinput/src": { "url": "https://chromium.googlesource.com/external/libaddressinput.git", - "rev": "e20690c8d5178bb282641d5eb06ef0298ff4cbc5", - "hash": "sha256-rX7LQNUgk5ZljUrayD1a/SUrBrvpomW0Cs0KBw3lYu4=" + "rev": "81eb9628382b07d371d8ea0b11badf7de3857fd5", + "hash": "sha256-6yDZpZ+CwxGqNO4+lZLFB6ESREeVku1BoOMtR+hKQ3I=" }, "src/third_party/libaom/source/libaom": { "url": "https://aomedia.googlesource.com/aom.git", - "rev": "33dba9e12a9f12e737eaa7c2624e8c580950a89a", - "hash": "sha256-01DbV0kQFg1yyFpVeo82KBoZHhizA7xnZ1qOuu4HTcs=" + "rev": "137bcff61e73fdd2836dc04e8258bfb49cef595e", + "hash": "sha256-oDubKvgqMk3w0luM//rR3NnCOk1h/WVTyRkuCmYASrw=" }, "src/third_party/crabbyavif/src": { "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git", - "rev": "c433c9a32320aed983e4106931596fbbae3f77ee", - "hash": "sha256-yw1cXB6s6biD2vj2K/3sVbKiaNK7bt+NkbQovbYlJ2Q=" + "rev": "5e140b5abb9a91eb25b5ef66d29f6ee784ab7eab", + "hash": "sha256-tN+2YH2O9FTV50o4OVhKcKdwRwTI8NuNA0WqljUcrmo=" }, "src/third_party/nearby/src": { "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git", @@ -442,8 +442,8 @@ }, "src/third_party/jetstream/main": { "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git", - "rev": "de88e36ae91d5bd13126fa4cc4b0e0346d779842", - "hash": "sha256-ZpU0ONqIVmY2VR0MxqtYj8KPNlK0L21gLJuT/Ff7KI8=" + "rev": "b7babdf323e64e69bd2f6c376189c15825f5c73a", + "hash": "sha256-s6UMdUYWZqk/MbhyCi2zdQNgni98gGsYxcuUh/5AUy0=" }, "src/third_party/jetstream/v2.2": { "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git", @@ -482,8 +482,8 @@ }, "src/third_party/cros-components/src": { "url": "https://chromium.googlesource.com/external/google3/cros_components.git", - "rev": "e580888fcc1c108e25c218ccf8b7a4372de18d57", - "hash": "sha256-p0Wfvhg/j8v9xL9Pueo7xPVHBKowOLI00AeIZXPQw4k=" + "rev": "0abb2efaa3d16db861c9710b193c39e657ac3bdf", + "hash": "sha256-viuntf6umyLZwDR9BXG+ZOakp9f8rvpZYDBYAUkKzL4=" }, "src/third_party/libdrm/src": { "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git", @@ -492,8 +492,8 @@ }, "src/third_party/expat/src": { "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git", - "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a", - "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc=" + "rev": "9bdfbc77e3355405ceefbe59420abed953a5657e", + "hash": "sha256-veGg5/QjtBSmxYa8IyHF0NxEdJzlcJSZfzw8ay3ASVU=" }, "src/third_party/libipp/libipp": { "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git", @@ -502,8 +502,8 @@ }, "src/third_party/libjpeg_turbo": { "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git", - "rev": "d1f5f2393e0d51f840207342ae86e55a86443288", - "hash": "sha256-KGeB/lTjhm8DQBDZVSPENvZEGSHeLTkviJrYsFh5vEM=" + "rev": "640f254ad0fa03f6b1f29f89b7dd9366f2f6e533", + "hash": "sha256-wor4RTF3/5BFL9EWcGEofY+M4HN2+/KJUaOY+u86K5Q=" }, "src/third_party/liblouis/src": { "url": "https://chromium.googlesource.com/external/liblouis-github.git", @@ -512,8 +512,8 @@ }, "src/third_party/libphonenumber/src": { "url": "https://chromium.googlesource.com/external/libphonenumber.git", - "rev": "ade546d8856475d0493863ee270eb3be9628106b", - "hash": "sha256-cLtsM35Ir3iG3j8+Cy2McL1ysRB0Y1PXealAKl05Twg=" + "rev": "c25558e39e2bcc9f26f7a2a1ef804324169eaf8f", + "hash": "sha256-Lr/gB5Em+TE092McPwJdOU0Ab4zyP4/2ZxlavMZMm+s=" }, "src/third_party/libprotobuf-mutator/src": { "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git", @@ -537,8 +537,8 @@ }, "src/third_party/libvpx/source/libvpx": { "url": "https://chromium.googlesource.com/webm/libvpx.git", - "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd", - "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4=" + "rev": "5f00413667d19ad683674524a9d03543d86d188b", + "hash": "sha256-uTteQ+z7t5KOtPuBoZazmonRHd8jGS1/YZAq+RAvhX4=" }, "src/third_party/libwebm/source": { "url": "https://chromium.googlesource.com/webm/libwebm.git", @@ -552,8 +552,8 @@ }, "src/third_party/libyuv": { "url": "https://chromium.googlesource.com/libyuv/libyuv.git", - "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8", - "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4=" + "rev": "3c5fa6ef272f6077d76816ee3d6a697ef1d6d272", + "hash": "sha256-FXFSC9dRb/KhSQdhJUqKEUpZbzU8ZpVnoSXtF/HPiJI=" }, "src/third_party/lss": { "url": "https://chromium.googlesource.com/linux-syscall-support.git", @@ -572,8 +572,8 @@ }, "src/third_party/nasm": { "url": "https://chromium.googlesource.com/chromium/deps/nasm.git", - "rev": "358842b6b7dd69b2ed635bef17f941e030a05e5f", - "hash": "sha256-YwjwubijMZ9OvYeMUVMSunWZ2VCuqUFEOyv/MK/oojc=" + "rev": "525a09a813be0f75b646ee93fc2a31c27b87d722", + "hash": "sha256-uC6bGxSdz1V2SXIQjMsDd6555b3gAPN1Y0ZQtWoqDww=" }, "src/third_party/neon_2_sse/src": { "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git", @@ -587,8 +587,8 @@ }, "src/third_party/openscreen/src": { "url": "https://chromium.googlesource.com/openscreen", - "rev": "684bcd767271a21f3e5d475b17a0fd862f16c65e", - "hash": "sha256-Yjz2E1/h+zp7L2x0zE0l+ktQIiSrJ4ZknXOhaVPKQVE=" + "rev": "37ff938a93cb04c6b77e019b52328c8e9b320317", + "hash": "sha256-M57un/TVQPfTnKScVHS1VK1cUs8F/YPT3TwMVdo+mhM=" }, "src/third_party/openscreen/src/buildtools": { "url": "https://chromium.googlesource.com/chromium/src/buildtools", @@ -602,13 +602,13 @@ }, "src/third_party/pdfium": { "url": "https://pdfium.googlesource.com/pdfium.git", - "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c", - "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU=" + "rev": "c052afb72a08d79a26bcf3103d11f344981b09f1", + "hash": "sha256-zqfErp0pDXHXIvRpZ1TJu2UGXNZjATRbPgQWTniKTJs=" }, "src/third_party/perfetto": { "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git", - "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f", - "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38=" + "rev": "9ede949f025303868fa0c42418f122ac47312539", + "hash": "sha256-IRzEqgunO4Nfz+FkYir8G/Ht+Zsn6wpzncgkEFpsC+k=" }, "src/third_party/protobuf-javascript/src": { "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript", @@ -617,8 +617,8 @@ }, "src/third_party/pthreadpool/src": { "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git", - "rev": "a56dcd79c699366e7ac6466792c3025883ff7704", - "hash": "sha256-WfyuPfII4eSmLskZV0TAcu4K6OyW38TjkDHm+VUx5eY=" + "rev": "02460584c6092e527c8b89f7df4de143d70e801f", + "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw=" }, "src/third_party/pyelftools": { "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git", @@ -647,13 +647,18 @@ }, "src/third_party/search_engines_data/resources": { "url": "https://chromium.googlesource.com/external/search_engines_data.git", - "rev": "2345fee6ce4ae24d9c365d5c0884ece593c55c67", - "hash": "sha256-5qkra6FURaMvEOk+ZKMRH1hc8ixEnk3u4rxNm0G8tuQ=" + "rev": "1aab872af8d44dcf59362d7ba8255922f74fafde", + "hash": "sha256-5/XnNx6Pyk4KBb9krVo9u6i7LWNrsLLOIi4qhEY2PZc=" + }, + "src/third_party/sframe/src": { + "url": "https://chromium.googlesource.com/external/github.com/cisco/sframe", + "rev": "b14090904433bed0d4ec3f875b9b39f3e0555930", + "hash": "sha256-bw+6ycUpnFZJhtXFUzr7XTOljNrs+7oFdVY+LN0Rqek=" }, "src/third_party/skia": { "url": "https://skia.googlesource.com/skia.git", - "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923", - "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM=" + "rev": "14d05ec761901b6e9e9193af8b347ab3a7f6fed0", + "hash": "sha256-KZGrztOKaT368KSCxiJAqnsgINpNODUlaXnH/maQNIA=" }, "src/third_party/smhasher/src": { "url": "https://chromium.googlesource.com/external/smhasher.git", @@ -667,13 +672,13 @@ }, "src/third_party/sqlite/src": { "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git", - "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239", - "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg=" + "rev": "fc121d7d03cd6cbf499ec06a5112b263471b1181", + "hash": "sha256-hf9PxQhXEKT49GbkFYCvRPBT0Qu+hDnDpebI92yO1Oo=" }, "src/third_party/swiftshader": { "url": "https://swiftshader.googlesource.com/SwiftShader.git", - "rev": "f9d5d49a3c599a315e3493dc1e9b5309cffb3305", - "hash": "sha256-kBfqgXXJeEPT80mu6CJ2Bwmdv/y8jVzM6TedMXbzo4o=" + "rev": "fce27a96526f54c6d31fdccf57629788e3712220", + "hash": "sha256-bmXZLpz3wv7eQWoqTjZmjwnnILWSIjZ8iqo8CeLk5fw=" }, "src/third_party/text-fragments-polyfill/src": { "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git", @@ -682,23 +687,23 @@ }, "src/third_party/tflite/src": { "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git", - "rev": "2216f531fb72119745382c62f232acf9790f4b6e", - "hash": "sha256-zySLNPmug5HS5pwJ/lEMAWjjZSOuxdTgup7Y90k7NZI=" + "rev": "999d49c10046e240cd5366d349d3a5f6af16a0d4", + "hash": "sha256-eSqaWXtzZ4Bi9ilaJYGdZamzUjmo+AtDZ9KeZhsc/fY=" }, "src/third_party/litert/src": { "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git", - "rev": "9b5418dd7a1a318eed20395743dcc868df17d8b0", - "hash": "sha256-80amwDPF3RrcoTaTQsunNmlvBGs6KCv369FW3J/Xcts=" + "rev": "09b4b05203fd7a9402ffcce9cc736d887ff7e3fc", + "hash": "sha256-skMOzpsn67mmOAp7Mf6UrJdi2lbiQQ8b6kBy4Ik2ED8=" }, "src/third_party/vulkan-deps": { "url": "https://chromium.googlesource.com/vulkan-deps", - "rev": "d234b7b29748c07ef389279dd24f533ebd04cadc", - "hash": "sha256-w49HOjPixSI/C5IGlxQMj/Ol9f/Lr2zI2oMhQzzu1zk=" + "rev": "669a28b1f31f89bfc46b74791f127bcc5e5b2f06", + "hash": "sha256-lsR+sh+XQP/wKgkBbie6Gp+kQNFnnC8TeNWpiWTdevw=" }, "src/third_party/glslang/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang", - "rev": "458ff50a67cb69371850068a62b78f1990a1ff9a", - "hash": "sha256-2WauVjAEeZn16b4fE4ImKPX3wjDmeN92mqWi3NMiXSw=" + "rev": "f6d9303ddaf2e879b9155f7186cd234f5a79079c", + "hash": "sha256-ru3QVyyyqxZRcvSpy9pYhHHhkjuLVhQbgOT/vQJ/oIw=" }, "src/third_party/spirv-cross/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross", @@ -707,43 +712,43 @@ }, "src/third_party/spirv-headers/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers", - "rev": "126038020c2bd47efaa942ccc364ca5353ffccde", - "hash": "sha256-QBX2M+ZSWgVvCx58NeDIdf6mIkdJbecDktBfUWGPvNc=" + "rev": "1e770e7de8373a8dd49f23416cf7ca4001d01040", + "hash": "sha256-t8Shkoa90TJt1MbTOefnLaguW4eYKsRFO1Jd0AUc70Y=" }, "src/third_party/spirv-tools/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools", - "rev": "2ec8457ab33d539b6f1fecc998360c0b8b05ed4f", - "hash": "sha256-9TBb/gnDXgZRZXhF27KEQ0XQI5itRHKJQjLrkFDQq7Q=" + "rev": "b38c4f83024546d4000b2db8e2294cf81b7f26e0", + "hash": "sha256-q5G4B75xBIXl1aG/vzbIDrc3Hs/MFoQ4nwh4ozb8hys=" }, "src/third_party/vulkan-headers/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers", - "rev": "f6a6f7ab165cedbfa2a7d0c93fe27a2d01ce09c8", - "hash": "sha256-ZbjmxbRUiVJADNRWziCH0UIM09qKf+lm9PRnWOhZFhQ=" + "rev": "015e25c3c91b70eb1a754d36fb14c4ba6ad9b0b9", + "hash": "sha256-pUxPwFGbOzP8ymTooeA1slFWEFsRoqUROSnndVtLiY8=" }, "src/third_party/vulkan-loader/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader", - "rev": "15a84652b94e465e9a7b25eb507193929863bc2f", - "hash": "sha256-pdC3YCM0Nzeabi5TPD+qR5PVdsxmWMnf2L9HsOcbv84=" + "rev": "cf0cf82ea16c0ff0be75940f282540d6085b2d3b", + "hash": "sha256-uyoysS7lSBNDRfvcwPT+gQqhE20UxiYUEw1UXnYS3fY=" }, "src/third_party/vulkan-tools/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools", - "rev": "7c46da2b39036a80ce088576d5794bf39e667f56", - "hash": "sha256-nAyNVveeGg9sA0E37YiEPm+UdKsy48nAOjnUYHQnuqw=" + "rev": "e3d18f90c0b8ef1f52539e0674a42f0adfe30381", + "hash": "sha256-Hs9N0FM3eWWjLm4BrDJoZIrsPDVFx0iRAJeQ4gHTM7o=" }, "src/third_party/vulkan-utility-libraries/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries", - "rev": "2c909c1ab6f9c6caba39a84a4887186b3fafdead", - "hash": "sha256-k3xeKHQbd2rTQJsOZKXEMPrYjcHwoCC1N12F6AIP6Ho=" + "rev": "8383c46b129c2b3a5f3833e602d946d2fcc57e39", + "hash": "sha256-ZBie5uDTVEehxRQW1GZY5Ki/bnp82LoW3jfMUFL0O9A=" }, "src/third_party/vulkan-validation-layers/src": { "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers", - "rev": "b105d8ea361af258abed65efb5a1565c031dcf1c", - "hash": "sha256-GgznBGYgnCFMNaqAOQ15dlw2dOFfSp3mAV2KokVLzgk=" + "rev": "044eaba8a34a6e3bfb1d6aafac7c01068813a2b6", + "hash": "sha256-i3hochkK0LZPg8CsZMFkAL+8tf8QuuwtApAc4FDd0RM=" }, "src/third_party/vulkan_memory_allocator": { "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git", - "rev": "cb0597213b0fcb999caa9ed08c2f88dc45eb7d50", - "hash": "sha256-yBCs3zfqs/60htsZAOscjcyKhVbAWE6znweuXcs1oKo=" + "rev": "7e55b011e16182fc349149abbd3aaf3b1db46421", + "hash": "sha256-fOnFkcQDEGIe5yB507qnP9nA1LBBPFblncNiJ8JxAwI=" }, "src/third_party/wayland/src": { "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git", @@ -777,18 +782,23 @@ }, "src/third_party/webgpu-cts/src": { "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git", - "rev": "3b327ebc44f11212fd3872972a6dd394634fb9e3", - "hash": "sha256-RSZVKv2Z0pg2cGa3Elr2r5VZqdxlRJ+6mzm1Au1qg1I=" + "rev": "b507bd117e53db86f2fb52d0d858d3ae7d684a85", + "hash": "sha256-6Y5Z0ErtsZdbuWTHa+PEiOxcZSbjBcnuOHbgtI1/+80=" }, "src/third_party/webpagereplay": { "url": "https://chromium.googlesource.com/webpagereplay.git", - "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4", - "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE=" + "rev": "b2b856131e36c99e9de9c419fe8ca02f857082ba", + "hash": "sha256-+hcaP7C5Eh3SLl5B8mRgOVdM/tvnFnb/oqUIWPoe0NA=" + }, + "src/third_party/webpagereplay/third_party/clang-format/script": { + "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git", + "rev": "6eddfb5ec5f92127a531eda66c568d3a11e7ec11", + "hash": "sha256-Cm6BOOlEyD0kdYxMSmk6Fj1Dnfs3zCzXsm+BOXgBme0=" }, "src/third_party/webrtc": { "url": "https://webrtc.googlesource.com/src.git", - "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793", - "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw=" + "rev": "1f975dfd761af6e5d76d28333191973b258d82a8", + "hash": "sha256-ucH+9HBkFyOKEItAWVoYmEzyU7h/UgWIvp/eC/JqGWU=" }, "src/third_party/wuffs/src": { "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git", @@ -802,8 +812,8 @@ }, "src/third_party/xnnpack/src": { "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git", - "rev": "2ad25fc09167df69c6c02eb8082a0b9658dd5e80", - "hash": "sha256-vBMGBXzJPCcsc2kMyGecjti68oZHWUwJKd7tkKub6kg=" + "rev": "56ac34b3f45fae2eca1f32584f7f0b279be2cf1f", + "hash": "sha256-uw3r5g5rWamlFubBkXDb4KRx3hkOAoQyFo8l95GYGZI=" }, "src/third_party/libei/src": { "url": "https://chromium.googlesource.com/external/gitlab.freedesktop.org/libinput/libei.git", @@ -812,13 +822,18 @@ }, "src/third_party/zstd/src": { "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git", - "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f", - "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg=" + "rev": "5233c58e6ca0b1c4c6b353ad79649191ed195bdc", + "hash": "sha256-vEl0s7Mjh+5rciOMxm99PNWiamtCk+sTN4lRYKCIZ+8=" }, "src/v8": { "url": "https://chromium.googlesource.com/v8/v8.git", - "rev": "933ce636c562cd54d68e7f7c93ab5cdffd685fca", - "hash": "sha256-zYArO6QS9nDIVWPINRVaDN1uX8X/wchBDeZHPZnwHYk=" + "rev": "968f19a8970f8d91702d86f0ec1522f3909781b7", + "hash": "sha256-x3rCWvC3hEjyJq6PNThhZEp4oRF9Y1JJEPnZTqVNVrY=" + }, + "src/agents/shared": { + "url": "https://chromium.googlesource.com/chromium/agents.git", + "rev": "e75efa515896f6bf1dea92eaffbcf8ee711a65d8", + "hash": "sha256-z2GrzF8jDkdfBdq1HP3gTgQpoqjmhc80kEZBmlue0os=" } } }, diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch new file mode 100644 index 000000000000..113097a87be8 --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch @@ -0,0 +1,21 @@ +diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn +index e1da11405c1f667280099ee815abc5349d1ad1bd..202992dbbe1c2a70eb6d8b559568d388f98b28f6 100644 +--- a/build/config/compiler/BUILD.gn ++++ b/build/config/compiler/BUILD.gn +@@ -1678,16 +1678,6 @@ config("runtime_library") { + configs += [ "//build/config/c++:runtime_library" ] + } + +- # Rust and C++ both provide intrinsics for LLVM to call for math operations. +- # We want to use the C++ intrinsics, not the ones in the Rust +- # compiler_builtins library. The Rust symbols are marked as weak, so that they +- # can be replaced by the C++ symbols. This config ensures the C++ symbols +- # exist and are strong in order to cause that replacement to occur by +- # explicitly linking in clang's compiler-rt library. +- if (is_clang && !(is_a_target_toolchain && is_cronet_build)) { +- configs += [ "//build/config/clang:compiler_builtins" ] +- } +- + # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia + # configuration. + if (is_posix || is_fuchsia) { diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch new file mode 100644 index 000000000000..84926ab177b3 --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch @@ -0,0 +1,27 @@ +diff --git a/third_party/widevine/cdm/BUILD.gn b/third_party/widevine/cdm/BUILD.gn +index 6d18f9fa163718d95610de9b6229dd38478543c7..93884543edcaa7211f4a7d61175bc068c6fd7dd4 100644 +--- a/third_party/widevine/cdm/BUILD.gn ++++ b/third_party/widevine/cdm/BUILD.gn +@@ -19,7 +19,7 @@ buildflag_header("buildflags") { + + flags = [ + "ENABLE_WIDEVINE=$enable_widevine", +- "BUNDLE_WIDEVINE_CDM=$bundle_widevine_cdm", ++ "BUNDLE_WIDEVINE_CDM=true", + "ENABLE_WIDEVINE_CDM_COMPONENT=$enable_widevine_cdm_component", + "ENABLE_MEDIA_FOUNDATION_WIDEVINE_CDM=$enable_media_foundation_widevine_cdm", + ] +diff --git a/third_party/widevine/cdm/widevine.gni b/third_party/widevine/cdm/widevine.gni +index 927b2e4809cf76e6b3ef51ee6cd2bbd04a92d60b..41761d10a4105a20fc4acf35f761c7ab23f867dd 100644 +--- a/third_party/widevine/cdm/widevine.gni ++++ b/third_party/widevine/cdm/widevine.gni +@@ -40,8 +40,7 @@ enable_library_widevine_cdm = + # Widevine CDM can be deployed as a component. Currently only supported on + # desktop platforms. The CDM can be bundled regardless whether it's a + # component. See below. +-enable_widevine_cdm_component = +- enable_library_widevine_cdm && (is_win || is_mac || is_linux || is_chromeos) ++enable_widevine_cdm_component = false + + # Enable (Windows) Media Foundation Widevine CDM component. + declare_args() { From c8c6c98a4b10a0410567f73f3ef57f5ec1dab6d8 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 1 Jul 2026 11:04:07 +0000 Subject: [PATCH 50/56] checkstyle: 13.6.0 -> 13.7.0 (cherry picked from commit 28b39eb67289dbe245b8b52d0653c953d544b9ad) --- pkgs/by-name/ch/checkstyle/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix index 5eb0d22fef51..acdc60aef140 100644 --- a/pkgs/by-name/ch/checkstyle/package.nix +++ b/pkgs/by-name/ch/checkstyle/package.nix @@ -8,17 +8,17 @@ }: maven.buildMavenPackage (finalAttrs: { - version = "13.6.0"; + version = "13.7.0"; pname = "checkstyle"; src = fetchFromGitHub { owner = "checkstyle"; repo = "checkstyle"; tag = "checkstyle-${finalAttrs.version}"; - hash = "sha256-5E3GTE4fPmJYoSm2lK4tW1Dcu+SuyQKL396JLg3J22E="; + hash = "sha256-BrgjkqkVnLYMlouyopUoCTby2z4YWZl4UK7m3Ktm5bE="; }; - mvnHash = "sha256-r0adD/80UguRCIznE6hGdhRifm29GxMhQRSmd2/nabc="; + mvnHash = "sha256-IKO61ugVjF03zA6pCwYKmwMVx/Ogy8hrt70ArOUm0NA="; nativeBuildInputs = [ maven From 0d013e5b4e0f5691d3b4f98ff094f3f775030074 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ak=E1=B9=A3aya=20=C5=9Ar=C4=ABniv=C4=81san?= Date: Wed, 13 May 2026 13:42:44 +0530 Subject: [PATCH 51/56] skypilot: fix for incompat. w/ defaults handling in click >= 8.2 (cherry picked from commit 29aca32618ab4eadacbae0504fef28798034523c) --- ...-default-for-Click-8.2-compatibility.patch | 31 +++++++++++++++++++ pkgs/by-name/sk/skypilot/package.nix | 4 +++ 2 files changed, 35 insertions(+) create mode 100644 pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch diff --git a/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch b/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch new file mode 100644 index 000000000000..4192588ac4a5 --- /dev/null +++ b/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch @@ -0,0 +1,31 @@ +From 6a2202baf3edff90aea6b66996a8e11e4e7c133e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ak=E1=B9=A3aya=20=C5=9Ar=C4=ABniv=C4=81san?= + +Date: Wed, 13 May 2026 13:31:19 +0530 +Subject: [PATCH] Fix --docker flag default for Click >= 8.2 compatibility + +Click 8.2 changed flag_value option handling: default=False is no longer +normalised to None before the 'is None' guard. Change to default=None so +sky launch works with Click >= 8.2 (e.g. nixpkgs). + +Upstream constrains click<8.2; this makes the code robust to newer versions. +--- + sky/client/cli/command.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py +index 6ee1102d0..15a5057d6 100644 +--- a/sky/client/cli/command.py ++++ b/sky/client/cli/command.py +@@ -1072,7 +1072,7 @@ def _handle_infra_cloud_region_zone_options(infra: Optional[str], + @click.option('--docker', + 'backend_name', + flag_value=backends.LocalDockerBackend.NAME, +- default=False, ++ default=None, + hidden=True, + help=('(Deprecated) Local docker support is deprecated. ' + 'To run locally, create a local Kubernetes cluster with ' +-- +2.53.0 + diff --git a/pkgs/by-name/sk/skypilot/package.nix b/pkgs/by-name/sk/skypilot/package.nix index d48db1649d1a..44b19af0f7c9 100644 --- a/pkgs/by-name/sk/skypilot/package.nix +++ b/pkgs/by-name/sk/skypilot/package.nix @@ -35,6 +35,10 @@ python3Packages.buildPythonApplication (finalAttrs: { pyproject = true; pythonRelaxDeps = true; + patches = [ + ./0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch + ]; + nativeBuildInputs = [ writableTmpDirAsHomeHook ]; From 554efaa77062bcb6d6a87161cda42b6fe93b2087 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ak=E1=B9=A3aya=20=C5=9Ar=C4=ABniv=C4=81san?= Date: Sun, 31 May 2026 14:53:26 +0530 Subject: [PATCH 52/56] skypilot: wrap websocket_proxy.py with wrapPythonProgramsIn (cherry picked from commit 75e8b52ec6fee74df6fe59c9d342c062c260ef89) --- ...y-call-script-directly-as-executable.patch | 37 +++++++++++++++++++ pkgs/by-name/sk/skypilot/package.nix | 6 +++ 2 files changed, 43 insertions(+) create mode 100644 pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch diff --git a/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch b/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch new file mode 100644 index 000000000000..781741b2dc37 --- /dev/null +++ b/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch @@ -0,0 +1,37 @@ +diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py +index 15a5057d6..5417cad9f 100644 +--- a/sky/client/cli/command.py ++++ b/sky/client/cli/command.py +@@ -203,7 +203,6 @@ def _get_cluster_records_and_set_ssh_config( + escaped_key_path = shlex.quote( + (cluster_utils.SSHConfigHelper.generate_local_key_file( + handle.cluster_name, credentials))) +- escaped_executable_path = shlex.quote(sys.executable) + escaped_websocket_proxy_path = shlex.quote( + f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py') + # Instead of directly use websocket_proxy.py, we add an +@@ -220,8 +219,7 @@ def _get_cluster_records_and_set_ssh_config( + # TODO(zhwu): write the template to a temp file, don't use + # the one in skypilot repo, to avoid changing the file when + # updating skypilot. +- f'\"{escaped_executable_path} ' +- f'{escaped_websocket_proxy_path} ' ++ f'\"{escaped_websocket_proxy_path} ' + f'{server_common.get_server_url()} ' + f'{handle.cluster_name} ' + f'kubernetes-pod-ssh-proxy\"') +@@ -229,13 +227,11 @@ def _get_cluster_records_and_set_ssh_config( + elif isinstance(handle.launched_resources.cloud, clouds.Slurm): + # Replace the proxy command to proxy through the SkyPilot API + # server with websocket. +- escaped_executable_path = shlex.quote(sys.executable) + escaped_websocket_proxy_path = shlex.quote( + f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py') + # %w is a placeholder for the node index, substituted per-node + # in cluster_utils.SSHConfigHelper.add_cluster(). +- proxy_command = (f'{escaped_executable_path} ' +- f'{escaped_websocket_proxy_path} ' ++ proxy_command = (f'{escaped_websocket_proxy_path} ' + f'{server_common.get_server_url()} ' + f'{handle.cluster_name} ' + f'slurm-job-ssh-proxy %w') diff --git a/pkgs/by-name/sk/skypilot/package.nix b/pkgs/by-name/sk/skypilot/package.nix index 44b19af0f7c9..fe2dfc14dbe9 100644 --- a/pkgs/by-name/sk/skypilot/package.nix +++ b/pkgs/by-name/sk/skypilot/package.nix @@ -37,6 +37,7 @@ python3Packages.buildPythonApplication (finalAttrs: { patches = [ ./0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch + ./0002-Fix-websocket-proxy-call-script-directly-as-executable.patch ]; nativeBuildInputs = [ @@ -221,6 +222,11 @@ python3Packages.buildPythonApplication (finalAttrs: { cp -r ${dashboard}/* $out/${python3Packages.python.sitePackages}/sky/dashboard/out/ ''; + postFixup = '' + chmod +x $out/${python3Packages.python.sitePackages}/sky/templates/websocket_proxy.py + wrapPythonProgramsIn "$out/${python3Packages.python.sitePackages}/sky/templates" "$out ''${pythonPath[*]}" + ''; + # Excluding the tests as it fails with error: # Message: 'Config loaded from /build/source/examples/admin_policy/restful_policy.yaml:\nadmin_policy: http://localhost:8080\n' #Arguments: () From 3d906ba7c3715b4f902a83e385e0d56070343e07 Mon Sep 17 00:00:00 2001 From: daspk04 Date: Wed, 1 Jul 2026 00:44:48 -0500 Subject: [PATCH 53/56] skypilot: patch CVE-2026-13482 (cherry picked from commit c7d40d39db98d15348374c3bb3c7a89ca9308e2d) --- pkgs/by-name/sk/skypilot/CVE-2026-13482.patch | 364 ++++++++++++++++++ pkgs/by-name/sk/skypilot/package.nix | 2 + 2 files changed, 366 insertions(+) create mode 100644 pkgs/by-name/sk/skypilot/CVE-2026-13482.patch diff --git a/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch b/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch new file mode 100644 index 000000000000..a6c7766082d6 --- /dev/null +++ b/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch @@ -0,0 +1,364 @@ +From 2435727f0c6b02d56e254a5ba1d8e041c7c33c86 Mon Sep 17 00:00:00 2001 +From: DanielZhangQD <36026334+DanielZhangQD@users.noreply.github.com> +Date: Mon, 29 Jun 2026 14:59:48 +0800 +Subject: [PATCH] [Core] Mark non-security MD5/SHA1 hashes with + usedforsecurity=False (#9972) + +* [Core] Mark non-security MD5/SHA1 hashes with usedforsecurity=False + +These hashlib.md5/sha1 calls derive identifiers, cache keys, and resource +names from non-secret inputs (usernames, paths, region/subscription ids, +cluster/host names, wheel/catalog contents). None protects a secret or +makes an authentication decision -- passwords use bcrypt via crypt_ctx and +auth is enforced by oauth2-proxy / SSO. Pass usedforsecurity=False so +weak-hash scanners (CWE-328) stop flagging them. The flag does not change +any digest value, so all derived ids, cache keys and names are unchanged. + +Co-Authored-By: Claude Opus 4.8 (1M context) + +* [Core] Address review: avoid split hexdigest() call in oauth2_proxy + +Compute the digest first, then slice, instead of splitting the empty +hexdigest() parentheses across lines. yapf-stable and more readable. + +Co-Authored-By: Claude Opus 4.8 (1M context) + +--------- + +Co-authored-by: Claude Opus 4.8 (1M context) +--- + sky/backends/backend_utils.py | 3 ++- + sky/backends/wheel_utils.py | 3 ++- + sky/batch/io_formats.py | 3 ++- + sky/catalog/aws_catalog.py | 6 ++++-- + sky/catalog/common.py | 4 +++- + sky/clouds/aws.py | 2 +- + sky/clouds/nebius.py | 3 ++- + sky/data/mounting_utils.py | 3 ++- + sky/data/storage.py | 6 ++++-- + sky/provision/azure/config.py | 2 +- + sky/provision/kubernetes/utils.py | 3 ++- + sky/provision/scp/instance.py | 2 +- + sky/server/auth/oauth2_proxy.py | 7 +++++-- + sky/server/server.py | 5 ++++- + sky/users/permission.py | 6 ++++-- + sky/users/server.py | 13 ++++++++++--- + sky/utils/command_runner.py | 7 ++++--- + sky/utils/common_utils.py | 13 ++++++++++--- + sky/utils/kubernetes/gpu_labeler.py | 3 ++- + 19 files changed, 65 insertions(+), 29 deletions(-) + +diff --git a/sky/backends/backend_utils.py b/sky/backends/backend_utils.py +index ff4662b4160..ec0b4bf74fb 100644 +--- a/sky/backends/backend_utils.py ++++ b/sky/backends/backend_utils.py +@@ -707,7 +707,8 @@ def get_expirable_clouds( + + + def _get_volume_name(path: str, cluster_name_on_cloud: str) -> str: +- path_hash = hashlib.md5(path.encode()).hexdigest()[:6] ++ path_hash = hashlib.md5(path.encode(), ++ usedforsecurity=False).hexdigest()[:6] + return f'{cluster_name_on_cloud}-{path_hash}' + + +diff --git a/sky/backends/wheel_utils.py b/sky/backends/wheel_utils.py +index 4cfd4c485a5..f142011bfe1 100644 +--- a/sky/backends/wheel_utils.py ++++ b/sky/backends/wheel_utils.py +@@ -210,7 +210,8 @@ def _build_sky_wheel() -> pathlib.Path: + # wheel content hash doesn't change. + with open(wheel_path, 'rb') as f: + contents = f.read() +- hash_of_latest_wheel = hashlib.md5(contents).hexdigest() ++ hash_of_latest_wheel = hashlib.md5(contents, ++ usedforsecurity=False).hexdigest() + + wheel_dir = WHEEL_DIR / hash_of_latest_wheel + wheel_dir.mkdir(parents=True, exist_ok=True) +diff --git a/sky/catalog/aws_catalog.py b/sky/catalog/aws_catalog.py +index c2480965708..e842068beaa 100644 +--- a/sky/catalog/aws_catalog.py ++++ b/sky/catalog/aws_catalog.py +@@ -113,7 +113,8 @@ def _get_az_mappings(aws_user_hash: str) -> Optional['pd.DataFrame']: + # Write md5 of the az_mapping file to a file so we can check it for + # any changes when uploading to the controller + with open(az_mapping_path, 'r', encoding='utf-8') as f: +- az_mapping_hash = hashlib.md5(f.read().encode()).hexdigest() ++ az_mapping_hash = hashlib.md5(f.read().encode(), ++ usedforsecurity=False).hexdigest() + with open(az_mapping_md5_path, 'w', encoding='utf-8') as f: + f.write(az_mapping_hash) + else: +@@ -147,7 +148,8 @@ def _fetch_and_apply_az_mapping(df: common.LazyDataFrame) -> 'pd.DataFrame': + user_identity_list = aws.AWS.get_active_user_identity() + assert user_identity_list, user_identity_list + user_identity = user_identity_list[0] +- aws_user_hash = hashlib.md5(user_identity.encode()).hexdigest()[:8] ++ aws_user_hash = hashlib.md5(user_identity.encode(), ++ usedforsecurity=False).hexdigest()[:8] + except (exceptions.CloudUserIdentityError, ImportError): + # If failed to get user identity, or import aws dependencies, we use the + # latest mapping file or the default mapping file. +diff --git a/sky/catalog/common.py b/sky/catalog/common.py +index 00829871e53..a0397e6301f 100644 +--- a/sky/catalog/common.py ++++ b/sky/catalog/common.py +@@ -291,7 +291,9 @@ def _update_catalog(): + tmp_path = f.name + os.rename(tmp_path, catalog_path) + with open(meta_path + '.md5', 'w', encoding='utf-8') as f: +- f.write(hashlib.md5(r.text.encode()).hexdigest()) ++ f.write( ++ hashlib.md5(r.text.encode(), ++ usedforsecurity=False).hexdigest()) + logger.debug(f'Updated {cloud} catalog {filename}.') + return True + +diff --git a/sky/clouds/aws.py b/sky/clouds/aws.py +index af4ca56e911..06607e0d802 100644 +--- a/sky/clouds/aws.py ++++ b/sky/clouds/aws.py +@@ -1347,7 +1347,7 @@ def get_user_identities(cls) -> Optional[List[List[str]]]: + # - aws credentials are not set, proceed anyway to get unified error + # message for users + return cls._sts_get_caller_identity() +- config_hash = hashlib.md5(stdout).hexdigest()[:8] ++ config_hash = hashlib.md5(stdout, usedforsecurity=False).hexdigest()[:8] + # Getting aws identity cost ~1s, so we cache the result with the output of + # `aws configure list` as cache key. Different `aws configure list` output + # can have same aws identity, our assumption is the output would be stable +diff --git a/sky/data/mounting_utils.py b/sky/data/mounting_utils.py +index f49a8db097f..6b97b2d6ef0 100644 +--- a/sky/data/mounting_utils.py ++++ b/sky/data/mounting_utils.py +@@ -714,7 +714,8 @@ def get_mount_cached_cmd( + # This is because the full path may be longer than + # the filename length limit. + # The hash is a non-negative integer in string form. +- hashed_mount_path = hashlib.md5(mount_path.encode()).hexdigest() ++ hashed_mount_path = hashlib.md5(mount_path.encode(), ++ usedforsecurity=False).hexdigest() + log_file_path = os.path.join(constants.RCLONE_MOUNT_CACHED_LOG_DIR, + f'{hashed_mount_path}.log') + create_log_cmd = (f'mkdir -p {constants.RCLONE_MOUNT_CACHED_LOG_DIR} && ' +diff --git a/sky/data/storage.py b/sky/data/storage.py +index 022fc471f41..13e068c5be5 100644 +--- a/sky/data/storage.py ++++ b/sky/data/storage.py +@@ -3367,10 +3367,12 @@ def get_default_storage_account_name(region: Optional[str]) -> str: + """ + assert region is not None + subscription_id = azure.get_subscription_id() +- subscription_hash_obj = hashlib.md5(subscription_id.encode('utf-8')) ++ subscription_hash_obj = hashlib.md5(subscription_id.encode('utf-8'), ++ usedforsecurity=False) + subscription_hash = subscription_hash_obj.hexdigest( + )[:AzureBlobStore._SUBSCRIPTION_HASH_LENGTH] +- region_hash_obj = hashlib.md5(region.encode('utf-8')) ++ region_hash_obj = hashlib.md5(region.encode('utf-8'), ++ usedforsecurity=False) + region_hash = region_hash_obj.hexdigest()[:AzureBlobStore. + _REGION_HASH_LENGTH] + +diff --git a/sky/provision/azure/config.py b/sky/provision/azure/config.py +index 2dbf115807f..074bc801c3e 100644 +--- a/sky/provision/azure/config.py ++++ b/sky/provision/azure/config.py +@@ -44,7 +44,7 @@ def get_azure_sdk_function(client: Any, function_name: str) -> Callable: + + def get_cluster_id_and_nsg_name(resource_group: str, + cluster_name_on_cloud: str) -> Tuple[str, str]: +- hasher = hashlib.md5(resource_group.encode('utf-8')) ++ hasher = hashlib.md5(resource_group.encode('utf-8'), usedforsecurity=False) + unique_id = hasher.hexdigest()[:UNIQUE_ID_LEN] + # We use the cluster name + resource group hash as the + # unique ID for the cluster, as we need to make sure that +diff --git a/sky/provision/kubernetes/utils.py b/sky/provision/kubernetes/utils.py +index 1ec32ffb095..e3478c45608 100644 +--- a/sky/provision/kubernetes/utils.py ++++ b/sky/provision/kubernetes/utils.py +@@ -5085,7 +5085,8 @@ def format_kubeconfig_exec_auth_with_cache(kubeconfig_path: str) -> str: + with open(kubeconfig_path, 'r', encoding='utf-8') as file: + config = yaml_utils.safe_load(file) + normalized = yaml.dump(config, sort_keys=True) +- hashed = hashlib.sha1(normalized.encode('utf-8')).hexdigest() ++ hashed = hashlib.sha1(normalized.encode('utf-8'), ++ usedforsecurity=False).hexdigest() + path = os.path.expanduser( + f'{kubernetes_constants.SKY_K8S_EXEC_AUTH_KUBECONFIG_CACHE}/{hashed}.yaml' + ) +diff --git a/sky/provision/scp/instance.py b/sky/provision/scp/instance.py +index 9aae05c9196..5a03c308e3f 100644 +--- a/sky/provision/scp/instance.py ++++ b/sky/provision/scp/instance.py +@@ -223,7 +223,7 @@ def _worker(cluster_name_on_cloud: str): + + + def _suffix(name: str, n: int = 5): +- return hashlib.sha1(name.encode()).hexdigest()[:n] ++ return hashlib.sha1(name.encode(), usedforsecurity=False).hexdigest()[:n] + + + def _get_instance_id(instance_name, cluster_name_on_cloud): +diff --git a/sky/server/auth/oauth2_proxy.py b/sky/server/auth/oauth2_proxy.py +index dece4792fa9..7d117642cf7 100644 +--- a/sky/server/auth/oauth2_proxy.py ++++ b/sky/server/auth/oauth2_proxy.py +@@ -204,8 +204,11 @@ def get_auth_user( + """Extract user info from OAuth2 proxy response headers.""" + email_header = response.headers.get('X-Auth-Request-Email') + if email_header: +- user_hash = hashlib.md5(email_header.encode()).hexdigest( +- )[:common_utils.USER_HASH_LENGTH] ++ # MD5 only derives a stable user id from the (non-secret) SSO ++ # email; auth itself is done by oauth2-proxy. Not a security use. ++ email_hash = hashlib.md5(email_header.encode(), ++ usedforsecurity=False).hexdigest() ++ user_hash = email_hash[:common_utils.USER_HASH_LENGTH] + return models.User(id=user_hash, + name=email_header, + user_type=models.UserType.SSO.value) +diff --git a/sky/server/server.py b/sky/server/server.py +index 4ec8ce1a86d..995ef89764c 100644 +--- a/sky/server/server.py ++++ b/sky/server/server.py +@@ -282,8 +282,11 @@ def _extract_user_from_header( + if not user_name: + return None + ++ # MD5 only derives a stable user id from the (non-secret) user name; ++ # not a security use. + user_hash = hashlib.md5( +- user_name.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH] ++ user_name.encode(), ++ usedforsecurity=False).hexdigest()[:common_utils.USER_HASH_LENGTH] + if proxy_config.enabled: + return models.User(id=user_hash, + name=user_name, +diff --git a/sky/users/permission.py b/sky/users/permission.py +index 82fb2877e50..a07be1c9b05 100644 +--- a/sky/users/permission.py ++++ b/sky/users/permission.py +@@ -182,8 +182,10 @@ def _maybe_initialize_basic_auth_user(self) -> None: + return + username, password = basic_auth.split(':', 1) + if username and password: +- user_hash = hashlib.md5( +- username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH] ++ # MD5 only derives a stable user id from the (non-secret) ++ # username; the password is checked separately. Not a security use. ++ user_hash = hashlib.md5(username.encode(), usedforsecurity=False ++ ).hexdigest()[:common_utils.USER_HASH_LENGTH] + user_info = global_user_state.get_user(user_hash) + if user_info: + logger.debug(f'Basic auth user {username} already exists') +diff --git a/sky/users/server.py b/sky/users/server.py +index 7cd42ee1726..8258702a2ff 100644 +--- a/sky/users/server.py ++++ b/sky/users/server.py +@@ -287,8 +287,12 @@ def user_create(user_create_body: payloads.UserCreateBody) -> None: + + # Create user + password_hash = server_common.crypt_ctx.hash(password) ++ # MD5 here only derives a stable user identifier from the (non-secret) ++ # username; it is not used for any security purpose (passwords use bcrypt ++ # via crypt_ctx). + user_hash = hashlib.md5( +- username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH] ++ username.encode(), ++ usedforsecurity=False).hexdigest()[:common_utils.USER_HASH_LENGTH] + with _user_lock(user_hash): + # Check if user already exists + if global_user_state.get_user_by_name(username): +@@ -627,8 +631,11 @@ def user_import(user_import_body: payloads.UserImportBody) -> Dict[str, Any]: + # Password is plain text, hash it + password_hash = server_common.crypt_ctx.hash(password) + +- user_hash = hashlib.md5( +- username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH] ++ # MD5 only derives a stable user identifier from the (non-secret) ++ # username; not a security use (passwords use bcrypt via crypt_ctx). ++ user_hash = hashlib.md5(username.encode(), ++ usedforsecurity=False).hexdigest() ++ user_hash = user_hash[:common_utils.USER_HASH_LENGTH] + + with _user_lock(user_hash): + global_user_state.add_or_update_user( +diff --git a/sky/utils/command_runner.py b/sky/utils/command_runner.py +index 344a65eb789..44f981ac520 100644 +--- a/sky/utils/command_runner.py ++++ b/sky/utils/command_runner.py +@@ -875,8 +875,8 @@ def git_clone( + raise exceptions.CommandError(1, '', error_msg, None) + + # Remote script path (use a unique name to avoid conflicts) +- script_hash = hashlib.md5( +- f'{self.node_id}_{target_dir}'.encode()).hexdigest()[:8] ++ script_hash = hashlib.md5(f'{self.node_id}_{target_dir}'.encode(), ++ usedforsecurity=False).hexdigest()[:8] + remote_script_path = f'/tmp/sky_git_clone_{script_hash}.sh' + + # Step 1: Transfer the script to remote machine using rsync +@@ -992,7 +992,8 @@ def __init__( + self.ssh_private_key = ssh_private_key + self.ssh_control_name = ( + None if ssh_control_name is None else hashlib.md5( +- ssh_control_name.encode()).hexdigest()[:_HASH_MAX_LENGTH]) ++ ssh_control_name.encode(), ++ usedforsecurity=False).hexdigest()[:_HASH_MAX_LENGTH]) + self._ssh_proxy_command = ssh_proxy_command + self._ssh_proxy_jump = ssh_proxy_jump + self.disable_control_master = ( +diff --git a/sky/utils/common_utils.py b/sky/utils/common_utils.py +index 027a59d5bca..71e7034f6a7 100644 +--- a/sky/utils/common_utils.py ++++ b/sky/utils/common_utils.py +@@ -91,7 +91,10 @@ def is_valid_user_hash(user_hash: Optional[str]) -> bool: + def generate_user_hash() -> str: + """Generates a unique user-machine specific hash.""" + hash_str = user_and_hostname_hash() +- user_hash = hashlib.md5(hash_str.encode()).hexdigest()[:USER_HASH_LENGTH] ++ # MD5 only derives a stable machine-specific identifier, not a security ++ # use. ++ user_hash = hashlib.md5( ++ hash_str.encode(), usedforsecurity=False).hexdigest()[:USER_HASH_LENGTH] + if not is_valid_user_hash(user_hash): + # A fallback in case the hash is invalid. + user_hash = uuid.uuid4().hex[:USER_HASH_LENGTH] +@@ -297,7 +300,9 @@ def make_cluster_name_on_cloud(display_name: str, + if truncate_cluster_name.endswith('-'): + truncate_cluster_name = truncate_cluster_name.rstrip('-') + assert truncate_cluster_name_length > 0, (cluster_name_on_cloud, max_length) +- display_name_hash = hashlib.md5(display_name.encode()).hexdigest() ++ # MD5 only derives a short suffix for the cluster name, not a security use. ++ display_name_hash = hashlib.md5(display_name.encode(), ++ usedforsecurity=False).hexdigest() + # Use base36 to reduce the length of the hash. + display_name_hash = base36_encode(display_name_hash) + return (f'{truncate_cluster_name}' +@@ -650,7 +655,9 @@ def user_and_hostname_hash() -> str: + The reason is AWS security group names are derived from this string, and + thus changing the SG name makes these clusters unrecognizable. + """ +- hostname_hash = hashlib.md5(socket.gethostname().encode()).hexdigest()[-4:] ++ # MD5 only derives a short hostname suffix, not a security use. ++ hostname_hash = hashlib.md5(socket.gethostname().encode(), ++ usedforsecurity=False).hexdigest()[-4:] + return f'{getpass.getuser()}-{hostname_hash}' + + +diff --git a/sky/utils/kubernetes/gpu_labeler.py b/sky/utils/kubernetes/gpu_labeler.py +index 227847cd50c..5de797139f9 100644 +--- a/sky/utils/kubernetes/gpu_labeler.py ++++ b/sky/utils/kubernetes/gpu_labeler.py +@@ -71,7 +71,8 @@ def cleanup(context: Optional[str] = None) -> Tuple[bool, str]: + + def get_node_hash(node_name: str): + # Generates a 32 character md5 hash from a string +- md5_hash = hashlib.md5(node_name.encode()).hexdigest() ++ md5_hash = hashlib.md5(node_name.encode(), ++ usedforsecurity=False).hexdigest() + return md5_hash[:32] + + diff --git a/pkgs/by-name/sk/skypilot/package.nix b/pkgs/by-name/sk/skypilot/package.nix index fe2dfc14dbe9..71df3b03526f 100644 --- a/pkgs/by-name/sk/skypilot/package.nix +++ b/pkgs/by-name/sk/skypilot/package.nix @@ -38,6 +38,8 @@ python3Packages.buildPythonApplication (finalAttrs: { patches = [ ./0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch ./0002-Fix-websocket-proxy-call-script-directly-as-executable.patch + # https://github.com/skypilot-org/skypilot/pull/9972 + ./CVE-2026-13482.patch ]; nativeBuildInputs = [ From 82ef2f5c660d8326251bba8c9c2de5e05a191829 Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Wed, 1 Jul 2026 17:56:20 -0400 Subject: [PATCH 54/56] google-chrome: 149.0.7827.200 -> 150.0.7871.46 Release note: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html (cherry picked from commit 8b266eba3a0771c00461183d9b4ca4a59bdd9be2) --- pkgs/by-name/go/google-chrome/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix index a0b030218353..e639b0005187 100644 --- a/pkgs/by-name/go/google-chrome/package.nix +++ b/pkgs/by-name/go/google-chrome/package.nix @@ -179,11 +179,11 @@ let linux = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "149.0.7827.200"; + version = "150.0.7871.46"; src = fetchurl { url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb"; - hash = "sha256-HDCPrhH44nKTr6Fzm9SqAV/Vdmtyx1znIZXsPkGmEqg="; + hash = "sha256-abQBOftzoCGnSfMvzeCFP7F4G286izyvFzrY9nR/qnw="; }; # With strictDeps on, some shebangs were not being patched correctly From 82fa6137cf0bbf86bb5e09ab6835f22a2086ed1f Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 23 Jun 2026 09:39:24 +0000 Subject: [PATCH 55/56] nixpkgs-review: 3.8.0 -> 3.9.0 Diff: https://github.com/Mic92/nixpkgs-review/compare/3.8.0...3.9.0 Changelog: https://github.com/Mic92/nixpkgs-review/releases/tag/3.9.0 (cherry picked from commit 822f8ee64711c6755b2081aceb29e27e95a65514) --- pkgs/by-name/ni/nixpkgs-review/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix index ff037e9b7549..37cbd707d2bc 100644 --- a/pkgs/by-name/ni/nixpkgs-review/package.nix +++ b/pkgs/by-name/ni/nixpkgs-review/package.nix @@ -23,7 +23,7 @@ python3Packages.buildPythonApplication (finalAttrs: { pname = "nixpkgs-review"; - version = "3.8.0"; + version = "3.9.0"; pyproject = true; __structuredAttrs = true; @@ -32,7 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: { owner = "Mic92"; repo = "nixpkgs-review"; tag = finalAttrs.version; - hash = "sha256-Z8pOct9DtuRo4LERqhVpDxX9uoLNQGgqPFUh0Fn3MrI="; + hash = "sha256-u0DbEwe28csVWKbu8x9v9/Ah0ZUUgqXtZU2Rr5IJpWI="; }; build-system = [ From ea21df954a883a5fac5925cf692ae1e60175b599 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Tue, 30 Jun 2026 13:55:16 +0200 Subject: [PATCH 56/56] ci/eval: Allow disallowed attrs to depend on other disallowed attrs With a dependency chain like a -> b -> c it was not possible to e.g. add a `meta.problems.removal` to b, because that would cause b to be entirely unavailable as a dependency. This PR slightly lifts that restriction by allowing both a and b to be marked with such a problem without causing a CI failure. This is useful for: - Having a problem on a package that needs to be removed but still has dependents (which then also need a problem) - Having a problem on a package that is aliased under another attribute, which counts as a dependency (cherry picked from commit bf80cf0f2e8d5e3809931011d4c8c949d2b196d2) --- ci/eval/default.nix | 77 +++++++++++++++++++++++++------------- pkgs/top-level/default.nix | 40 ++++++++++++-------- pkgs/top-level/stage.nix | 10 ++--- 3 files changed, 80 insertions(+), 47 deletions(-) diff --git a/ci/eval/default.nix b/ci/eval/default.nix index 547fcf1f26be..8feaf5cf77aa 100644 --- a/ci/eval/default.nix +++ b/ci/eval/default.nix @@ -100,6 +100,7 @@ let myChunk=$2 system=$3 outputDir=$4 + preEvalFile=$5 # Default is 5, higher values effectively disable the warning. # This randomly breaks Eval. @@ -121,12 +122,12 @@ let --show-trace \ --arg chunkSize "$chunkSize" \ --arg myChunk "$myChunk" \ - --arg preEvalFile "${preEvalFile}" \ + --arg preEvalFile "$preEvalFile" \ --arg systems "[ \"$system\" ]" \ --arg includeBroken ${lib.boolToString includeBroken} \ --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \ -I ${nixpkgs} \ - -I ${preEvalFile} \ + -I "$preEvalFile" \ > "$outputDir/result/$myChunk" \ 2> "$outputDir/stderr/$myChunk" exitCode=$? @@ -164,12 +165,6 @@ let echo "System: $evalSystem" cores=$NIX_BUILD_CORES echo "Cores: $cores" - attrCount=$(jq '.paths | length' "${preEvalFile}") - echo "Attribute count: $attrCount" - echo "Chunk size: $chunkSize" - # Same as `attrCount / chunkSize` but rounded up - chunkCount=$(( (attrCount - 1) / chunkSize + 1 )) - echo "Chunk count: $chunkCount" mkdir -p $out/${evalSystem} @@ -190,29 +185,61 @@ let done ) & - seq_end=$(( chunkCount - 1 )) + chunkedEval() { + local chunkOutputDir=$1 + local preEvalFile=$2 - ${lib.optionalString quickTest '' - seq_end=0 - ''} + local attrCount=$(jq '.paths | length' "$preEvalFile") + echo "Attribute count: $attrCount" + echo "Chunk size: $chunkSize" + # Same as `attrCount / chunkSize` but rounded up + local chunkCount=$(( (attrCount - 1) / chunkSize + 1 )) + echo "Chunk count: $chunkCount" - chunkOutputDir=$(mktemp -d) - mkdir "$chunkOutputDir"/{result,stats,timestats,stderr} + local seq_end=$(( chunkCount - 1 )) + ${lib.optionalString quickTest '' + seq_end=0 + ''} - seq -w 0 "$seq_end" | - command time -f "%e" -o "$out/${evalSystem}/total-time" \ - xargs -I{} -P"$cores" \ - ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" + mkdir -p "$chunkOutputDir"/{result,stats,timestats,stderr} - cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk + seq -w 0 "$seq_end" | + xargs -I{} -P"$cores" \ + ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" "$preEvalFile" - if (( chunkSize * chunkCount != attrCount )); then - # A final incomplete chunk would mess up the stats, don't include it - rm "$chunkOutputDir"/stats/"$seq_end" - fi + if (( chunkSize * chunkCount != attrCount )); then + # A final incomplete chunk would mess up the stats, don't include it + rm "$chunkOutputDir"/stats/"$seq_end" + fi + } - cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json - cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json + chunkOutputDirs=$(mktemp -d) + + # Preparation for the second eval + disallowedAttributesPreEvalFile=$(mktemp) + jq '{ + paths: (.attrPathsDisallowedForInternalUse | map(.attrPath)), + attrPathsDisallowedForInternalUse: [] + }' ${preEvalFile} > "$disallowedAttributesPreEvalFile" + + startEpoch=$(date +%s) + + # The first eval evaluates only attributes that are not disallowed for internal Nixpkgs use, ensuring that they don't depend on disallowed attributes + # Because the first eval doesn't evaluate the disallowed attributes themselves, but we still want to check that they don't fail evaluation, we evaluate them separately in a second eval + # The reason we need two evals is because we want disallowed attributes to be able to depend on other disallowed attributes, which inherently needs a separate Nixpkgs instantiation + # And while we could interleave that instantiation into a single eval, that would ~double memory usage for all chunks, while doing it separately doesn't + echo "Evaluating the internally allowed attributes" + chunkedEval "$chunkOutputDirs"/allowed ${preEvalFile} + echo "Evaluating the internally disallowed attributes" + chunkedEval "$chunkOutputDirs"/disallowed "$disallowedAttributesPreEvalFile" + + echo $(( $(date +%s) - startEpoch )) > "$out/${evalSystem}/total-time" + + # We only use the stats from the allowed attrs eval, because the disallowed attrs are generally not even a full chunk + cp -r "$chunkOutputDirs"/allowed/stats $out/${evalSystem}/stats-by-chunk + + cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json + cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json ''; diff = callPackage ./diff.nix { }; diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix index 4e19941441da..c9e888067a74 100644 --- a/pkgs/top-level/default.nix +++ b/pkgs/top-level/default.nix @@ -216,27 +216,37 @@ let fixedPoint = boot stages; + removeInternallyDisallowedAttrPaths = + let + # Same as `lib.removeAttrs`, but can remove nested attributes (and order of arguments is fixed) + # TODO: Consider moving to lib.attrpaths.removeAttrPaths + removeAttrPaths = + attrPathsToRemove: set: + let + split = lib.partition ( + attrPath: + assert attrPath != [ ]; + lib.length attrPath == 1 + ) attrPathsToRemove; + nestedApplied = + set + // lib.mapAttrs (name: attrPaths: removeAttrPaths (lib.map lib.tail attrPaths) set.${name}) ( + lib.groupBy (attrPath: lib.head attrPath) split.wrong + ); + in + lib.removeAttrs nestedApplied (lib.map lib.head split.right); + in + removeAttrPaths (map (x: x.attrPath) config.attrPathsDisallowedForInternalUse); + pkgs = # Generally only set by CI, don't want to cause a performance hit for users if config.attrPathsDisallowedForInternalUse == [ ] then fixedPoint else # See ./stage.nix, which replaced config.attrPathsDisallowedForInternalUse with aborts. - # We replace these attribute paths with their original derivations again, - # because CI would just error out from the aborting attributes themselves. - # Internally all packages still see the aborting attributes if used as dependencies, - # because we do this here after the fixed-point is calculated. - # Note that we don't want to remove the attributes entirely like what aliases.nix does, - # because unlike aliases, CI still needs to check the packages to evaluate at all, - # which it wouldn't if they're removed entirely. - lib.updateManyAttrsByPath - (map (attrs: { - path = attrs.attrPath; - update = - _: - lib.getAttrFromPath attrs.attrPath fixedPoint.__internalBeforeInternallyDisallowedAttrPathsOverlay; - }) config.attrPathsDisallowedForInternalUse) - (removeAttrs fixedPoint [ "__internalBeforeInternallyDisallowedAttrPathsOverlay" ]); + # To prevent these attributes from causing CI failures we remove them entirely. + # These attrs are still evaluated but in a different way, see ci/eval/default.nix + removeInternallyDisallowedAttrPaths fixedPoint; in checked pkgs diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix index 20a5dfebb9f9..4b4d205d1c44 100644 --- a/pkgs/top-level/stage.nix +++ b/pkgs/top-level/stage.nix @@ -317,20 +317,16 @@ let }; # Replaces the attributes in config.attrPathsDisallowedForInternalUse with aborts. + # Not warnings because those wouldn't give a backtrace, which is important for debugging # Not throws because those would be ignored by nix-env, which is what CI uses to evaluate everything - # See also ./default.nix, where these attributes are added back again so they're still checked by CI + # See also ./default.nix, which removes these attributes entirely from the end result internallyDisallowedAttrPathsOverlay = final: prev: # Generally only set by CI, don't want to cause a performance hit for users if config.attrPathsDisallowedForInternalUse == [ ] then { } else - { - # So that ./default.nix can add them back again outside the fixed point - # Don't use this in packages! - __internalBeforeInternallyDisallowedAttrPathsOverlay = prev; - } - // lib.updateManyAttrsByPath (map ( + lib.updateManyAttrsByPath (map ( { attrPath, reason }: { path = attrPath;