Merge remote-tracking branch 'origin/release-26.05' into staging-next-26.05

pkgs/by-name/do/domination/package.nix

@@ -30,7 +30,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "domination";
-  version = "1.3.4";
+  version = "1.3.5";
 
   # The .zip releases do not contain the build.xml file
   src = fetchsvn {
@@ -40,8 +40,8 @@ stdenv.mkDerivation {
     # https://sourceforge.net/p/domination/code/HEAD/tree/Domination/ChangeLog.txt
     # Alternatively, look for revs like "changelog update",
     # "new version x.y.z info on website", or "website update for x.y.z".
-    rev = "2664";
-    hash = "sha256-bkaHpqJSc3UvwNT7LwuPUT8xN0g6QypfLSHlLmm8nX8=";
+    rev = "2778";
+    hash = "sha256-OsCpSL/0QgaaUAzoyPPrAlJixRlqsLJu2D8FkEuo0Ak=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fi/fittrackee/package.nix

@@ -112,5 +112,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
       tebriel
       traxys
     ];
+    knownVulnerabilities = [
+      # https://github.com/SamR1/FitTrackee/security/advisories/GHSA-rc38-72q6-pc7w
+      "GHSA-rc38-72q6-pc7w: JWT logout bypass in FitTrackee"
+    ];
   };
 })

pkgs/by-name/li/libvirt/package.nix

@@ -135,6 +135,26 @@ stdenv.mkDerivation rec {
   patches = [
     ./0001-meson-patch-in-an-install-prefix-for-building-on-nix.patch
 
+    # CVE-2026-15268
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/f74495c7a157618e3df6fa61079678084c4cc685.patch";
+      hash = "sha256-ZOC7ApQiowMyLC0iB51rwDe4dIDwRmpFHpdAdHnEjHY=";
+    })
+    # CVE-2026-18917
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f.patch";
+      hash = "sha256-EjNp97J2++Wn7MLFaC99HPsJYUj4Nid8Fuk8fGq3Cis=";
+    })
+    # CVE-2026-63622
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b.patch";
+      hash = "sha256-balBw0Rs2fSrnOeeiaqKRDnloXIWA1eITuciaZQ7zsk=";
+    })
+    # CVE-2026-63623
+    (fetchpatch {
+      url = "https://gitlab.com/libvirt/libvirt/-/commit/69335a484768d550854da1133d5490074695e825.patch";
+      hash = "sha256-3UCMOVOq//bKkKfRsn9NVq1j9rN3CZlBOsEeYQufleU=";
+    })
     # CVE-2026-61478
     (fetchpatch {
       url = "https://gitlab.com/libvirt/libvirt/-/commit/68da70aae766c6271b8d3b466374d3cc7d1a8afb.patch";

pkgs/by-name/pd/pdfding/package.nix

@@ -141,6 +141,7 @@ python.pkgs.buildPythonPackage (finalAttrs: {
     "huey"
     "nh3"
     "psycopg2-binary"
+    "pypdf"
     "pypdfium2"
   ];
 

pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix

@@ -7,13 +7,13 @@
 buildGoModule (finalAttrs: {
   __structuredAttrs = true;
   pname = "prometheus-speedtest-exporter";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "podocarp";
     repo = "speedtest_exporter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n9eunZRssS13mTOeFeZ/PpfSj430DKf3ZRS10hY4Ps8=";
+    hash = "sha256-xXTyxwECGlYv9bBco09zvlOpF4GcHeT3yZMNUQTPPoo=";
   };
 
   vendorHash = "sha256-HBg44D0CUc4HYCBwGrswnrqG5o5ltA6UT8L0oWetlIc=";

pkgs/development/compilers/go/1.25.nix

@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.12";
+  version = "1.25.13";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-+Q3O5L0CP6N2N06gpabr5VNTeznEJv/YxolGm0VRmTI=";
+    hash = "sha256-HX4vcLHum5PH3478ynH1rcxqWXl6QzbC0QFxvUwXRhQ=";
   };
 
   strictDeps = true;

pkgs/development/compilers/go/1.27.nix

@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.27rc2";
+  version = "1.27rc3";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-hg/XowsoXuFqKuDsXURBy0fEiHKgowy2DK40iUf0iiU=";
+    hash = "sha256-6eIO3RcgCV+RCWluljpmBp0/bUjQDrk4jIiM4GYx31w=";
   };
 
   strictDeps = true;

pkgs/development/interpreters/python/default.nix

@@ -47,10 +47,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "15";
+        patch = "16";
         suffix = "";
       };
-      hash = "sha256-JyF53dmi5BoPyOQuM9+9ygs3EapavzctPy1RVD0JtiU=";
+      hash = "sha256-kbzev93iOaADrpNzin/OD5Iw/uXEvCuG9uboxvmKq+g=";
       inherit passthruFun;
     };
 
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "12";
-        patch = "13";
+        patch = "14";
         suffix = "";
       };
-      hash = "sha256-wIvGWoGXHB3VeDGCgmUDNpRmx+ZzdNFkZRmt8FIHtoQ=";
+      hash = "sha256-XIRir1eQuvQ6MhoVWdvg2wbRvkMA+4X7U8QAYGaOVIo=";
       inherit passthruFun;
     };
 

pkgs/development/python-modules/pypdf/default.nix

@@ -12,9 +12,11 @@
   myst-parser,
 
   # optionals
+  arabic-reshaper,
   cryptography,
   fonttools,
   pillow,
+  python-bidi,
 
   # tests
   fpdf2,
@@ -24,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "pypdf";
-  version = "6.14.2";
+  version = "6.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -33,7 +35,7 @@ buildPythonPackage rec {
     tag = version;
     # fetch sample files used in tests
     fetchSubmodules = true;
-    hash = "sha256-h7JuQTTUZ5tWoAhixjp+grDVA3JQ8PbHcMBzIyCMOJU=";
+    hash = "sha256-e39xclCnXlX4oagx4TnFCf99VKdJZeM2Kc3set1KXuo=";
   };
 
   outputs = [
@@ -55,10 +57,14 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = rec {
-    full = crypto ++ fonts ++ image;
+    full = crypto ++ fonts ++ image ++ rtl_text;
     crypto = [ cryptography ];
     fonts = [ fonttools ];
     image = [ pillow ];
+    rtl_text = [
+      arabic-reshaper
+      python-bidi
+    ];
   };
 
   pythonImportsCheck = [ "pypdf" ];

pkgs/servers/kanidm/1_11.nix

@@ -1,5 +1,5 @@
 import ./generic.nix {
-  version = "1.11.0";
-  hash = "sha256-3dcJxJx8UFebW6WMdVTH6kfsNBed+55JFwHWVhZulOU=";
-  cargoHash = "sha256-qOs/uSs3iaiTGsqydpNbZ6KSLNE+k+5bM7k3ijRzNT0=";
+  version = "1.11.1";
+  hash = "sha256-IQmXHl+Gx7QLuLUCmIh919o+ziCy2q2NvVabwQwhML0=";
+  cargoHash = "sha256-DSYynKWb9jjFp3u3c6z9dFXts8ydgEho7xoFlL6cPXs=";
 }