From 04cbd0d0c5d853895ddcfa1692dc33cf777930cf Mon Sep 17 00:00:00 2001 From: Gerhard Schwanzer Date: Mon, 10 Aug 2026 21:42:07 +0200 Subject: [PATCH 01/10] python3Packages.pypdf: 6.14.2 -> 6.15.0 https://redirect.github.com/py-pdf/pypdf/releases/tag/6.15.0 This release bounds /ToUnicode token parsing and CID width expansion for malformed PDFs. Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol) (cherry picked from commit 33932a69a45474acae8fbc22c4891e3011f23579) --- pkgs/by-name/pd/pdfding/package.nix | 1 + pkgs/development/python-modules/pypdf/default.nix | 12 +++++++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pd/pdfding/package.nix b/pkgs/by-name/pd/pdfding/package.nix index c31c6ef1d0ec..c2b7ad980447 100644 --- a/pkgs/by-name/pd/pdfding/package.nix +++ b/pkgs/by-name/pd/pdfding/package.nix @@ -141,6 +141,7 @@ python.pkgs.buildPythonPackage (finalAttrs: { "huey" "nh3" "psycopg2-binary" + "pypdf" "pypdfium2" ]; diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix index 24c6076065e9..4c8cb142a090 100644 --- a/pkgs/development/python-modules/pypdf/default.nix +++ b/pkgs/development/python-modules/pypdf/default.nix @@ -12,9 +12,11 @@ myst-parser, # optionals + arabic-reshaper, cryptography, fonttools, pillow, + python-bidi, # tests fpdf2, @@ -24,7 +26,7 @@ buildPythonPackage rec { pname = "pypdf"; - version = "6.14.2"; + version = "6.15.0"; pyproject = true; src = fetchFromGitHub { @@ -33,7 +35,7 @@ buildPythonPackage rec { tag = version; # fetch sample files used in tests fetchSubmodules = true; - hash = "sha256-h7JuQTTUZ5tWoAhixjp+grDVA3JQ8PbHcMBzIyCMOJU="; + hash = "sha256-e39xclCnXlX4oagx4TnFCf99VKdJZeM2Kc3set1KXuo="; }; outputs = [ @@ -55,10 +57,14 @@ buildPythonPackage rec { ]; optional-dependencies = rec { - full = crypto ++ fonts ++ image; + full = crypto ++ fonts ++ image ++ rtl_text; crypto = [ cryptography ]; fonts = [ fonttools ]; image = [ pillow ]; + rtl_text = [ + arabic-reshaper + python-bidi + ]; }; pythonImportsCheck = [ "pypdf" ]; From 9bd28a500f7019eaef0edac5db9325abca14901b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 12 Aug 2026 16:46:39 +0000 Subject: [PATCH 02/10] domination: 1.3.4 -> 1.3.5 (cherry picked from commit fc730f1be7aa879cdb85e4627d9a150c7dd8b365) --- pkgs/by-name/do/domination/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/do/domination/package.nix b/pkgs/by-name/do/domination/package.nix index 736ee6533a8a..c20b07542e65 100644 --- a/pkgs/by-name/do/domination/package.nix +++ b/pkgs/by-name/do/domination/package.nix @@ -30,7 +30,7 @@ let in stdenv.mkDerivation { pname = "domination"; - version = "1.3.4"; + version = "1.3.5"; # The .zip releases do not contain the build.xml file src = fetchsvn { @@ -40,8 +40,8 @@ stdenv.mkDerivation { # https://sourceforge.net/p/domination/code/HEAD/tree/Domination/ChangeLog.txt # Alternatively, look for revs like "changelog update", # "new version x.y.z info on website", or "website update for x.y.z". - rev = "2664"; - hash = "sha256-bkaHpqJSc3UvwNT7LwuPUT8xN0g6QypfLSHlLmm8nX8="; + rev = "2778"; + hash = "sha256-OsCpSL/0QgaaUAzoyPPrAlJixRlqsLJu2D8FkEuo0Ak="; }; nativeBuildInputs = [ From 9d80977ece9b31cfb30b65f83e9fba21b1ccc083 Mon Sep 17 00:00:00 2001 From: Julian Stecklina Date: Thu, 13 Aug 2026 17:29:11 +0200 Subject: [PATCH 03/10] libvirt: fix security vulnerabilities Fixes: CVE-2026-15268 Fixes: CVE-2026-18917 Fixes: CVE-2026-63622 Fixes: CVE-2026-63623 Not-cherry-picked-because: Unstable is already on newer libvirt versions --- pkgs/by-name/li/libvirt/package.nix | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/pkgs/by-name/li/libvirt/package.nix b/pkgs/by-name/li/libvirt/package.nix index 45bb395d06d0..2b2b50a61a7d 100644 --- a/pkgs/by-name/li/libvirt/package.nix +++ b/pkgs/by-name/li/libvirt/package.nix @@ -135,6 +135,26 @@ stdenv.mkDerivation rec { patches = [ ./0001-meson-patch-in-an-install-prefix-for-building-on-nix.patch + # CVE-2026-15268 + (fetchpatch { + url = "https://gitlab.com/libvirt/libvirt/-/commit/f74495c7a157618e3df6fa61079678084c4cc685.patch"; + hash = "sha256-ZOC7ApQiowMyLC0iB51rwDe4dIDwRmpFHpdAdHnEjHY="; + }) + # CVE-2026-18917 + (fetchpatch { + url = "https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f.patch"; + hash = "sha256-EjNp97J2++Wn7MLFaC99HPsJYUj4Nid8Fuk8fGq3Cis="; + }) + # CVE-2026-63622 + (fetchpatch { + url = "https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b.patch"; + hash = "sha256-balBw0Rs2fSrnOeeiaqKRDnloXIWA1eITuciaZQ7zsk="; + }) + # CVE-2026-63623 + (fetchpatch { + url = "https://gitlab.com/libvirt/libvirt/-/commit/69335a484768d550854da1133d5490074695e825.patch"; + hash = "sha256-3UCMOVOq//bKkKfRsn9NVq1j9rN3CZlBOsEeYQufleU="; + }) # CVE-2026-61478 (fetchpatch { url = "https://gitlab.com/libvirt/libvirt/-/commit/68da70aae766c6271b8d3b466374d3cc7d1a8afb.patch"; From 6670a73d2ba09355e5cbd8672ce0aa4bb9be1626 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 13 Aug 2026 15:05:30 +0200 Subject: [PATCH 04/10] python312: 3.12.13 -> 3.12.14 https://docs.python.org/release/3.12.14/whatsnew/changelog.html (cherry picked from commit 688b25aceb07460e0cc141f6d0a60f15358bd02f) --- pkgs/development/interpreters/python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix index 1d7b5fe795e0..ea04b0c60bd1 100644 --- a/pkgs/development/interpreters/python/default.nix +++ b/pkgs/development/interpreters/python/default.nix @@ -59,10 +59,10 @@ sourceVersion = { major = "3"; minor = "12"; - patch = "13"; + patch = "14"; suffix = ""; }; - hash = "sha256-wIvGWoGXHB3VeDGCgmUDNpRmx+ZzdNFkZRmt8FIHtoQ="; + hash = "sha256-XIRir1eQuvQ6MhoVWdvg2wbRvkMA+4X7U8QAYGaOVIo="; inherit passthruFun; }; From 7e8abe3eb489cc5f69b410c37c38652561485994 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 13 Aug 2026 15:17:56 +0200 Subject: [PATCH 05/10] python311: 3.11.15 -> 3.11.16 https://docs.python.org/release/3.11.16/whatsnew/changelog.html (cherry picked from commit 937cdf10634cb59d21698638e7bc510ad529273c) --- pkgs/development/interpreters/python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix index ea04b0c60bd1..b377eaf6d1f1 100644 --- a/pkgs/development/interpreters/python/default.nix +++ b/pkgs/development/interpreters/python/default.nix @@ -47,10 +47,10 @@ sourceVersion = { major = "3"; minor = "11"; - patch = "15"; + patch = "16"; suffix = ""; }; - hash = "sha256-JyF53dmi5BoPyOQuM9+9ygs3EapavzctPy1RVD0JtiU="; + hash = "sha256-kbzev93iOaADrpNzin/OD5Iw/uXEvCuG9uboxvmKq+g="; inherit passthruFun; }; From 37b50c9e125aaca69122f818847424da44901748 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 14 Aug 2026 00:29:48 +0200 Subject: [PATCH 06/10] go_1_27: 1.27rc2 -> 1.27rc3 Announcement: https://groups.google.com/g/golang-announce/c/6X8FgujJjUU (cherry picked from commit b27a12e4e2d583e6c9cea4fda66722fe90df442f) --- pkgs/development/compilers/go/1.27.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.27.nix b/pkgs/development/compilers/go/1.27.nix index 3a553d29a1c5..b6a0efa1040e 100644 --- a/pkgs/development/compilers/go/1.27.nix +++ b/pkgs/development/compilers/go/1.27.nix @@ -25,11 +25,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "go"; - version = "1.27rc2"; + version = "1.27rc3"; src = fetchurl { url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz"; - hash = "sha256-hg/XowsoXuFqKuDsXURBy0fEiHKgowy2DK40iUf0iiU="; + hash = "sha256-6eIO3RcgCV+RCWluljpmBp0/bUjQDrk4jIiM4GYx31w="; }; strictDeps = true; From 76bae500720feb5e5f101e6eb3219448ca2ae60f Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 14 Aug 2026 00:19:17 +0200 Subject: [PATCH 07/10] go_1_25: 1.25.12 -> 1.25.13 Changelog: https://go.dev/doc/devel/release#go1.25.minor (cherry picked from commit 65a751fbda382daac0d6f3dd9755a52c22a46a13) --- pkgs/development/compilers/go/1.25.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix index 13eb53bd54cb..9930dd0af21b 100644 --- a/pkgs/development/compilers/go/1.25.nix +++ b/pkgs/development/compilers/go/1.25.nix @@ -25,11 +25,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "go"; - version = "1.25.12"; + version = "1.25.13"; src = fetchurl { url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz"; - hash = "sha256-+Q3O5L0CP6N2N06gpabr5VNTeznEJv/YxolGm0VRmTI="; + hash = "sha256-HX4vcLHum5PH3478ynH1rcxqWXl6QzbC0QFxvUwXRhQ="; }; strictDeps = true; From 62353f74b1ce81de92817e0290064f4cc7a56031 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 14 Aug 2026 08:19:30 +0200 Subject: [PATCH 08/10] kanidm_1_11: 1.11.0 -> 1.11.1 Changelog: https://github.com/kanidm/kanidm/releases/tag/v1.11.1 (cherry picked from commit 32edd5f8d328be198e2baa034aaf4ffab6e4e0ab) --- pkgs/servers/kanidm/1_11.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/kanidm/1_11.nix b/pkgs/servers/kanidm/1_11.nix index c06b30750207..f32d50c1d5b1 100644 --- a/pkgs/servers/kanidm/1_11.nix +++ b/pkgs/servers/kanidm/1_11.nix @@ -1,5 +1,5 @@ import ./generic.nix { - version = "1.11.0"; - hash = "sha256-3dcJxJx8UFebW6WMdVTH6kfsNBed+55JFwHWVhZulOU="; - cargoHash = "sha256-qOs/uSs3iaiTGsqydpNbZ6KSLNE+k+5bM7k3ijRzNT0="; + version = "1.11.1"; + hash = "sha256-IQmXHl+Gx7QLuLUCmIh919o+ziCy2q2NvVabwQwhML0="; + cargoHash = "sha256-DSYynKWb9jjFp3u3c6z9dFXts8ydgEho7xoFlL6cPXs="; } From 2849f5553ff21150016651953724774834d7e77f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 2 Aug 2026 08:39:01 +0000 Subject: [PATCH 09/10] prometheus-speedtest-exporter: 1.0.0 -> 1.1.0 (cherry picked from commit 6c35fcaa40efeee05a012edac8846a62e55dd830) --- pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix b/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix index 8eee84e785da..35418e89eae5 100644 --- a/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix +++ b/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix @@ -7,13 +7,13 @@ buildGoModule (finalAttrs: { __structuredAttrs = true; pname = "prometheus-speedtest-exporter"; - version = "1.0.0"; + version = "1.1.0"; src = fetchFromGitHub { owner = "podocarp"; repo = "speedtest_exporter"; tag = "v${finalAttrs.version}"; - hash = "sha256-n9eunZRssS13mTOeFeZ/PpfSj430DKf3ZRS10hY4Ps8="; + hash = "sha256-xXTyxwECGlYv9bBco09zvlOpF4GcHeT3yZMNUQTPPoo="; }; vendorHash = "sha256-HBg44D0CUc4HYCBwGrswnrqG5o5ltA6UT8L0oWetlIc="; From 7feae94c6a88cae67cf86a9a5974bc2a2e253f3e Mon Sep 17 00:00:00 2001 From: Chris Moultrie <821688+tebriel@users.noreply.github.com> Date: Mon, 10 Aug 2026 09:11:28 -0400 Subject: [PATCH 10/10] fittrackee: mark as insecure by GHSA-rc38-72q6-pc7w --- pkgs/by-name/fi/fittrackee/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/fi/fittrackee/package.nix b/pkgs/by-name/fi/fittrackee/package.nix index f261ac07eae6..de8b77f8f573 100644 --- a/pkgs/by-name/fi/fittrackee/package.nix +++ b/pkgs/by-name/fi/fittrackee/package.nix @@ -112,5 +112,9 @@ python3Packages.buildPythonApplication (finalAttrs: { tebriel traxys ]; + knownVulnerabilities = [ + # https://github.com/SamR1/FitTrackee/security/advisories/GHSA-rc38-72q6-pc7w + "GHSA-rc38-72q6-pc7w: JWT logout bypass in FitTrackee" + ]; }; })