From 7a8ce9247af4d5c8541b008591c9737636f872a7 Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Fri, 28 Aug 2026 09:38:41 -0400 Subject: [PATCH 01/25] openssl_3: 3.0.21 -> 3.0.22 Changelog: https://github.com/openssl/openssl/releases/tag/openssl-3.0.22 (cherry picked from commit 9075dd22368da78b118f95e6db917f3ba5a6a89f) --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 7b9a221cc2d1..63e9ecd6e87a 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -444,8 +444,8 @@ in }; openssl_3 = common { - version = "3.0.21"; - hash = "sha256-YX4pr45CH0ZklISkk35IxoXkf0ZIgWfJgviLxOwdUi8="; + version = "3.0.22"; + hash = "sha256-Z+vKflDRc4MCgEVIZlNJIZW4PblfhVhwlwG7R7XB74E="; patches = [ # Support for NIX_SSL_CERT_FILE, motivation: From 3c56224ac75d3436ed5350f5ae411277fddfeabd Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Fri, 28 Aug 2026 09:40:17 -0400 Subject: [PATCH 02/25] openssl_3_5: 3.5.7 -> 3.5.8 Changelog: https://github.com/openssl/openssl/releases/tag/openssl-3.5.8 (cherry picked from commit 2a33cb7d903cd94a41a43eac84cebb7661404f51) --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 63e9ecd6e87a..eb3c40406b84 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -474,8 +474,8 @@ in }; openssl_3_5 = common { - version = "3.5.7"; - hash = "sha256-qMDSilKcpID582z1eS4s0hmEVSo8jkqhGiSqMa6smOg="; + version = "3.5.8"; + hash = "sha256-qPhKOZGOxkFc52XZtCnTE7qXuBQxacFy5zS5UURk9bI="; patches = [ # Support for NIX_SSL_CERT_FILE, motivation: From 16b80ffbc1d7eb2bdc64cfe338fccbc409bed9a1 Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Fri, 28 Aug 2026 09:46:44 -0400 Subject: [PATCH 03/25] openssl_4_0: 4.0.1 -> 4.0.2 Changelog: https://github.com/openssl/openssl/releases/tag/openssl-4.0.2 (cherry picked from commit be467b2cf5dbb53946e437593a4f99d68c2401fa) --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index eb3c40406b84..e2d56c362b49 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -535,8 +535,8 @@ in }; openssl_4_0 = common { - version = "4.0.1"; - hash = "sha256-LbPzoNbqS1nh8JSs4sjNU23/uHzcOQhMWvoeb3833Qk="; + version = "4.0.2"; + hash = "sha256-c2tGdTD5FnN7cDExDMsh2CGMYinmHo4WDNHTRYzVQ6g="; patches = [ # Support for NIX_SSL_CERT_FILE, motivation: From 5d53f7125d453c62b38d6f38493506c5f4a91662 Mon Sep 17 00:00:00 2001 From: Gerhard Schwanzer Date: Tue, 1 Sep 2026 08:16:43 +0200 Subject: [PATCH 04/25] dolibarr: fix CVE-2026-81728 and CVE-2026-82633 Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol) Not-cherry-picked-because: master is already fixed by Dolibarr 24.0.0 --- pkgs/by-name/do/dolibarr/CVE-2026-81728.patch | 241 ++++++++++++++++++ pkgs/by-name/do/dolibarr/package.nix | 12 + 2 files changed, 253 insertions(+) create mode 100644 pkgs/by-name/do/dolibarr/CVE-2026-81728.patch diff --git a/pkgs/by-name/do/dolibarr/CVE-2026-81728.patch b/pkgs/by-name/do/dolibarr/CVE-2026-81728.patch new file mode 100644 index 000000000000..21e73107c623 --- /dev/null +++ b/pkgs/by-name/do/dolibarr/CVE-2026-81728.patch @@ -0,0 +1,241 @@ +--- a/htdocs/core/modules/import/import_csv.modules.php ++++ b/htdocs/core/modules/import/import_csv.modules.php +@@ -891,38 +891,53 @@ + $insertdone = false; + + $is_table_category_link = false; +- $fname = 'rowid'; ++ $sanitizedfname = 'rowid'; + if (strpos($tablename, '_categorie_') !== false) { + $is_table_category_link = true; +- $fname = '*'; ++ $sanitizedfname = '*'; + } + + if (!empty($updatekeys)) { + // We do SELECT to get the rowid, if we already have the rowid, it's to be used below for related tables (extrafields) + + if (empty($lastinsertid)) { // No insert done yet for a parent table +- $sqlSelect = "SELECT ".$fname." FROM ".$tablename; ++ $sqlSelect = "SELECT ".$sanitizedfname." FROM ".$this->db->sanitize($tablename); + $data = array_combine($listfields, $listvalues); + $where = array(); // filters to forge SQL request + $filters = array(); // filters to forge output error message + foreach ($updatekeys as $key) { ++ if (!is_array($objimport->array_import_updatekeys[0]) || !array_key_exists($key, $objimport->array_import_updatekeys[0])) { ++ $this->errors[$error]['lib'] = 'You try to search duplicates on field '.dol_string_nohtmltag($key).' that is not an allowed field.'; ++ $this->errors[$error]['type'] = 'UPDATEKEYBADCOLUMN'; ++ $error++; ++ break; ++ } + $col = $objimport->array_import_updatekeys[0][$key]; +- $key = preg_replace('/^.*\./i', '', $key); +- if (isModEnabled("socialnetworks") && strpos($key, "socialnetworks") !== false) { +- $tmp = explode("_", $key); +- $key = $tmp[0]; ++ $keyfordata = preg_replace('/^.*\./i', '', $key); ++ $keyfordata = preg_replace('/[^a-zA-Z0-9\._]/', '', $keyfordata); ++ ++ if (isModEnabled("socialnetworks") && strpos($keyfordata, "socialnetworks") !== false) { ++ $tmp = explode("_", $keyfordata); ++ $keyfordata = $tmp[0]; + $socialnetwork = $tmp[1]; +- $jsondata = $data[$key]; ++ $jsondata = $data[$keyfordata]; + $json = json_decode($jsondata); + $stringtosearch = json_encode($socialnetwork).':'.json_encode($json->$socialnetwork); + //var_dump($stringtosearch); + //var_dump($this->db->escape($stringtosearch)); // This provide a value for sql string (but not for a like) +- $where[] = $key." LIKE '%".$this->db->escape($this->db->escapeforlike($stringtosearch))."%'"; ++ $where[] = $this->db->sanitize($keyfordata)." LIKE '%".$this->db->escape($this->db->escapeforlike($stringtosearch))."%'"; + $filters[] = $col." LIKE '%".$this->db->escape($this->db->escapeforlike($stringtosearch))."%'"; + //var_dump($where[1]); // This provide a value for sql string inside a like + } else { +- $where[] = $key.' = '.$data[$key]; +- $filters[] = $col.' = '.$data[$key]; ++ $sanitizedvalue = $data[$keyfordata]; ++ if ((string) $sanitizedvalue === '') { ++ $this->errors[$error]['lib'] = 'You request to search duplicates on field '.$keyfordata.' but no value was provided for this field on this line.'; ++ $this->errors[$error]['type'] = 'UPDATEKEYBADVALUE'; ++ $error++; ++ } else { ++ $where[] = $this->db->sanitize($keyfordata)." = ".$sanitizedvalue; ++ $filters[] = $col." = ".$sanitizedvalue; ++ } + } + } + if (!empty($tablewithentity_cache[$tablename])) { +@@ -931,29 +946,31 @@ + } + $sqlSelect .= " WHERE ".implode(' AND ', $where); + +- $resql = $this->db->query($sqlSelect); +- if ($resql) { +- $num_rows = $this->db->num_rows($resql); +- if ($num_rows == 1) { +- $res = $this->db->fetch_object($resql); +- $lastinsertid = $res->rowid; +- $keyfield = 'rowid'; +- if ($is_table_category_link) { +- $lastinsertid = 'linktable'; +- } // used to apply update on tables like llx_categorie_product and avoid being blocked for all file content if at least one entry already exists +- $last_insert_id_array[$tablename] = $lastinsertid; +- } elseif ($num_rows > 1) { +- $this->errors[$error]['lib'] = $langs->trans('MultipleRecordFoundWithTheseFilters', implode(', ', $filters)); ++ if (!$error) { ++ $resql = $this->db->query($sqlSelect); ++ if ($resql) { ++ $num_rows = $this->db->num_rows($resql); ++ if ($num_rows == 1) { ++ $res = $this->db->fetch_object($resql); ++ $lastinsertid = $res->rowid; ++ $keyfield = 'rowid'; ++ if ($is_table_category_link) { ++ $lastinsertid = 'linktable'; ++ } // used to apply update on tables like llx_categorie_product and avoid being blocked for all file content if at least one entry already exists ++ $last_insert_id_array[$tablename] = $lastinsertid; ++ } elseif ($num_rows > 1) { ++ $this->errors[$error]['lib'] = $langs->trans('MultipleRecordFoundWithTheseFilters', implode(', ', $filters)); ++ $this->errors[$error]['type'] = 'SQL'; ++ $error++; ++ } else { ++ // No record found with filters, insert will be tried below ++ } ++ } else { ++ //print 'E'; ++ $this->errors[$error]['lib'] = $this->db->lasterror(); + $this->errors[$error]['type'] = 'SQL'; + $error++; +- } else { +- // No record found with filters, insert will be tried below + } +- } else { +- //print 'E'; +- $this->errors[$error]['lib'] = $this->db->lasterror(); +- $this->errors[$error]['type'] = 'SQL'; +- $error++; + } + } else { + // We have a last INSERT ID (got by previous pass), so we check if we have a row referencing this foreign key. +--- a/htdocs/core/modules/import/import_xlsx.modules.php ++++ b/htdocs/core/modules/import/import_xlsx.modules.php +@@ -970,17 +970,17 @@ + $insertdone = false; + + $is_table_category_link = false; +- $fname = 'rowid'; ++ $sanitizedfname = 'rowid'; + if (strpos($tablename, '_categorie_') !== false) { + $is_table_category_link = true; +- $fname = '*'; ++ $sanitizedfname = '*'; + } + + if (!empty($updatekeys)) { + // We do SELECT to get the rowid, if we already have the rowid, it's to be used below for related tables (extrafields) + + if (empty($lastinsertid)) { // No insert done yet for a parent table +- $sqlSelect = "SELECT ".$fname." FROM " . $tablename; ++ $sqlSelect = "SELECT ".$sanitizedfname." FROM " . $this->db->sanitize($tablename); + + $data = array_combine($listfields, $listvalues); + +@@ -989,23 +989,38 @@ + '@phan-var string[] $where'; + $filters = array(); // filters to forge output error message + foreach ($updatekeys as $key) { ++ if (!is_array($objimport->array_import_updatekeys[0]) || !array_key_exists($key, $objimport->array_import_updatekeys[0])) { ++ $this->errors[$error]['lib'] = 'You try to search duplicates on field '.dol_string_nohtmltag($key).' that is not an allowed field.'; ++ $this->errors[$error]['type'] = 'UPDATEKEYBADCOLUMN'; ++ $error++; ++ break; ++ } + $col = $objimport->array_import_updatekeys[0][$key]; +- $key = preg_replace('/^.*\./i', '', $key); +- if (isModEnabled("socialnetworks") && strpos($key, "socialnetworks") !== false) { +- $tmp = explode("_", $key); +- $key = $tmp[0]; ++ $keyfordata = preg_replace('/^.*\./i', '', $key); ++ $keyfordata = preg_replace('/[^a-zA-Z0-9\._]/', '', $keyfordata); ++ ++ if (isModEnabled("socialnetworks") && strpos($keyfordata, "socialnetworks") !== false) { ++ $tmp = explode("_", $keyfordata); ++ $keyfordata = $tmp[0]; + $socialnetwork = $tmp[1]; +- $jsondata = $data[$key]; ++ $jsondata = $data[$keyfordata]; + $json = json_decode($jsondata); + $stringtosearch = json_encode($socialnetwork).':'.json_encode($json->$socialnetwork); + //var_dump($stringtosearch); + //var_dump($this->db->escape($stringtosearch)); // This provide a value for sql string (but not for a like) +- $where[] = $key." LIKE '%".$this->db->escape($this->db->escapeforlike($stringtosearch))."%'"; ++ $where[] = $this->db->sanitize($keyfordata)." LIKE '%".$this->db->escape($this->db->escapeforlike($stringtosearch))."%'"; + $filters[] = $col." LIKE '%".$this->db->escape($this->db->escapeforlike($stringtosearch))."%'"; + //var_dump($where[1]); // This provide a value for sql string inside a like + } else { +- $where[] = $key.' = '.$data[$key]; +- $filters[] = $col.' = '.$data[$key]; ++ $sanitizedvalue = $data[$keyfordata]; ++ if ((string) $sanitizedvalue === '') { ++ $this->errors[$error]['lib'] = 'You request to search duplicates on field '.$keyfordata.' but no value was provided for this field on this line.'; ++ $this->errors[$error]['type'] = 'UPDATEKEYBADVALUE'; ++ $error++; ++ } else { ++ $where[] = $this->db->sanitize($keyfordata)." = ".$sanitizedvalue; ++ $filters[] = $col." = ".$sanitizedvalue; ++ } + } + } + if (!empty($tablewithentity_cache[$tablename])) { +@@ -1014,29 +1029,31 @@ + } + $sqlSelect .= " WHERE " . implode(' AND ', $where); + +- $resql = $this->db->query($sqlSelect); +- if ($resql) { +- $num_rows = $this->db->num_rows($resql); +- if ($num_rows == 1) { +- $res = $this->db->fetch_object($resql); +- $lastinsertid = $res->rowid; +- $keyfield = 'rowid'; +- if ($is_table_category_link) { +- $lastinsertid = 'linktable'; +- } // used to apply update on tables like llx_categorie_product and avoid being blocked for all file content if at least one entry already exists +- $last_insert_id_array[$tablename] = $lastinsertid; +- } elseif ($num_rows > 1) { +- $this->errors[$error]['lib'] = $langs->trans('MultipleRecordFoundWithTheseFilters', implode(', ', $filters)); ++ if (!$error) { ++ $resql = $this->db->query($sqlSelect); ++ if ($resql) { ++ $num_rows = $this->db->num_rows($resql); ++ if ($num_rows == 1) { ++ $res = $this->db->fetch_object($resql); ++ $lastinsertid = $res->rowid; ++ $keyfield = 'rowid'; ++ if ($is_table_category_link) { ++ $lastinsertid = 'linktable'; ++ } // used to apply update on tables like llx_categorie_product and avoid being blocked for all file content if at least one entry already exists ++ $last_insert_id_array[$tablename] = $lastinsertid; ++ } elseif ($num_rows > 1) { ++ $this->errors[$error]['lib'] = $langs->trans('MultipleRecordFoundWithTheseFilters', implode(', ', $filters)); ++ $this->errors[$error]['type'] = 'SQL'; ++ $error++; ++ } else { ++ // No record found with filters, insert will be tried below ++ } ++ } else { ++ //print 'E'; ++ $this->errors[$error]['lib'] = $this->db->lasterror(); + $this->errors[$error]['type'] = 'SQL'; + $error++; +- } else { +- // No record found with filters, insert will be tried below + } +- } else { +- //print 'E'; +- $this->errors[$error]['lib'] = $this->db->lasterror(); +- $this->errors[$error]['type'] = 'SQL'; +- $error++; + } + } else { + // We have a last INSERT ID (got by previous pass), so we check if we have a row referencing this foreign key. diff --git a/pkgs/by-name/do/dolibarr/package.nix b/pkgs/by-name/do/dolibarr/package.nix index 658a78085a9d..31752b2ed7f3 100644 --- a/pkgs/by-name/do/dolibarr/package.nix +++ b/pkgs/by-name/do/dolibarr/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch, nixosTests, stateDir ? "/var/lib/dolibarr", }: @@ -17,6 +18,17 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-YJKTaLGaILhCFREtAgmX+vzhXIKp0DIj6jn7TtqtFB4="; }; + patches = [ + # Remove when updating to Dolibarr 24.0.0 or a 23.x release containing 24b1b99c89c7. + ./CVE-2026-81728.patch + # Remove when updating to Dolibarr 24.0.0 or a 23.x release containing fd478850f823. + (fetchpatch { + name = "CVE-2026-82633.patch"; + url = "https://github.com/Dolibarr/dolibarr/commit/fd478850f823e27c672300acb4b02baeef79aef1.patch"; + hash = "sha256-OkkQh06r9vnyP/02VIg7ZexT4AQit3rYEgiUC/qnXbg="; + }) + ]; + dontBuild = true; postPatch = '' From d2da7a1530caa769dd239ac4ac630807b7346b3b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 2 Sep 2026 09:22:37 +0000 Subject: [PATCH 05/25] acli: 1.3.29-stable -> 1.3.36-stable (cherry picked from commit 3da8e04ec0bd704f6590355e837bbdb9ce7996c2) --- pkgs/by-name/ac/acli/sources.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/ac/acli/sources.json b/pkgs/by-name/ac/acli/sources.json index 520130c33b29..e5bd850645a7 100644 --- a/pkgs/by-name/ac/acli/sources.json +++ b/pkgs/by-name/ac/acli/sources.json @@ -1,21 +1,21 @@ { - "version": "1.3.29-stable", + "version": "1.3.36-stable", "sources": { "aarch64-darwin": { - "url": "https://acli.atlassian.com/darwin/1.3.29-stable/acli_1.3.29-stable_darwin_arm64.tar.gz", - "sha256": "b2f6343d13ac8f3c32ea1043aba8317876d845662967793eb00016a2e5b5cf79" + "url": "https://acli.atlassian.com/darwin/1.3.36-stable/acli_1.3.36-stable_darwin_arm64.tar.gz", + "sha256": "f5307d1518364c20f35f92c745bfc1282a41b4cd4a4c83dfdf4e50d4e0ca3945" }, "aarch64-linux": { - "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_arm64.tar.gz", - "sha256": "cea39c4eb90c65d8d0cafc869a75fa3b6afaaf4573f8da650f4ae73801f8ec46" + "url": "https://acli.atlassian.com/linux/1.3.36-stable/acli_1.3.36-stable_linux_arm64.tar.gz", + "sha256": "4c404a2a0cb98e516502b6f528ad70fb95187aebf744ea108f0632e41984d0bd" }, "x86_64-darwin": { "url": "https://acli.atlassian.com/darwin/1.3.22-stable/acli_1.3.22-stable_darwin_amd64.tar.gz", "sha256": "993fd692700d602fd1e3cff7f1d29f70e44a2ebb8056fbb93bdc8aed1e5cbbd4" }, "x86_64-linux": { - "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_amd64.tar.gz", - "sha256": "8dcfc7bcf9dc788e7143e93d74445310094977ba1bad2513c6c613460851d34e" + "url": "https://acli.atlassian.com/linux/1.3.36-stable/acli_1.3.36-stable_linux_amd64.tar.gz", + "sha256": "b6a9d70fd107ce5e284380d110d2eaee82155c4fc90f7bb17612213c9a1087e1" } } } From 0515192cd764c13d0c01149eca9e7e03e982daa7 Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Wed, 2 Sep 2026 17:11:57 +0200 Subject: [PATCH 06/25] jenkins: 2.568.2 -> 2.568.3 Signed-off-by: Felix Singer (cherry picked from commit 6f44084ada20aea1fbe5392a59e23343836d0216) --- pkgs/by-name/je/jenkins/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix index fd2039199db9..afa05f0889cf 100644 --- a/pkgs/by-name/je/jenkins/package.nix +++ b/pkgs/by-name/je/jenkins/package.nix @@ -18,11 +18,11 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "jenkins"; - version = "2.568.2"; + version = "2.568.3"; src = fetchurl { url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war"; - hash = "sha256-m7srMp5Scwun3s0aehCVmH9iUOx2H7IRV9uyy80e9ZA="; + hash = "sha256-zNv9zq3oNInjQoWk1XwSE0/+oKCcogBiKC5YDL+l8J4="; }; nativeBuildInputs = [ makeWrapper ]; From 08ed27f00dbcfae834ae970cac3ea05c3a0ca1e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= Date: Tue, 1 Sep 2026 20:40:52 +0200 Subject: [PATCH 07/25] zigbee2mqtt: 2.13.0 -> 2.14.0 Release notes: https://github.com/Koenkk/zigbee2mqtt/releases/tag/2.14.0 (cherry picked from commit 9b59094014d451b199f0af4047d6b3f8c5867cb9) --- pkgs/by-name/zi/zigbee2mqtt/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/zi/zigbee2mqtt/package.nix b/pkgs/by-name/zi/zigbee2mqtt/package.nix index c73b8df14224..bf85f7aea93b 100644 --- a/pkgs/by-name/zi/zigbee2mqtt/package.nix +++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix @@ -14,20 +14,20 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "zigbee2mqtt"; - version = "2.13.0"; + version = "2.14.0"; src = fetchFromGitHub { owner = "Koenkk"; repo = "zigbee2mqtt"; tag = finalAttrs.version; - hash = "sha256-JSmJXjEF0dQ1sWyXvtLmN9gfAg3PjXWPOlb7xCxz8RI="; + hash = "sha256-xV53JrflZsbprHeEgeCtTTPLVPt1neJgzsY9BTT000U="; }; pnpmDeps = fetchPnpmDeps { inherit (finalAttrs) pname version src; pnpm = pnpm_10; fetcherVersion = 4; - hash = "sha256-5S3VnPxR7P4dwXcFQSjNbTJ5KOWteb4ZBpTy7gtoY4I="; + hash = "sha256-NnrwIJbWmegTfZl5UGSQs/U4ov6sdV2EaX6aVE5XUJ4="; }; nativeBuildInputs = [ From 2169511dd7ac4494e9556e547e9ab99dbc641066 Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Mon, 31 Aug 2026 10:32:47 -0400 Subject: [PATCH 08/25] victoriametrics: 1.150.0 -> 1.151.0 Changelog: https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.151.0 (cherry picked from commit b03ae3bded84ef543af3b722ad0ea09d847907e0) --- pkgs/by-name/vi/victoriametrics/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix index f0361b1f915c..c03666eef1af 100644 --- a/pkgs/by-name/vi/victoriametrics/package.nix +++ b/pkgs/by-name/vi/victoriametrics/package.nix @@ -14,13 +14,13 @@ buildGoModule (finalAttrs: { pname = "VictoriaMetrics"; - version = "1.150.0"; + version = "1.151.0"; src = fetchFromGitHub { owner = "VictoriaMetrics"; repo = "VictoriaMetrics"; tag = "v${finalAttrs.version}"; - hash = "sha256-fY8rfWuMk46sNiS+IhQYINxoasmHhUJzBKI2ocROZR8="; + hash = "sha256-LMilqB2enkzZr3zLcwnDLojtFV/lcOsXA9EhjiFarqE="; }; vendorHash = null; From 0f838b821271e35ca224383e455186e3ad60837d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 2 Sep 2026 21:14:06 +0000 Subject: [PATCH 09/25] dokuwiki: 2026-07-14b -> 2026-07-14c (cherry picked from commit eb02530ac93905716982b33571637deeff8c0d85) --- pkgs/by-name/do/dokuwiki/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/do/dokuwiki/package.nix b/pkgs/by-name/do/dokuwiki/package.nix index 69f0d9b3461c..3059ee06e05a 100644 --- a/pkgs/by-name/do/dokuwiki/package.nix +++ b/pkgs/by-name/do/dokuwiki/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation rec { pname = "dokuwiki"; - version = "2026-07-14a"; + version = "2026-07-14c"; src = fetchFromGitHub { owner = "dokuwiki"; repo = "dokuwiki"; rev = "release-${version}"; - sha256 = "sha256-qj+Ng20aB3qV2afrER309kvlh6gXRFPh3MqnomvvCf4="; + sha256 = "sha256-84kMuFTWYo6Cjd6qpkZsLZoECIP9IzSrc9dX1uKMp0M="; }; preload = writeText "preload.php" '' From caa9521ebd804c1526b5f6a0dfd841c336afe8a5 Mon Sep 17 00:00:00 2001 From: Ihar Hrachyshka Date: Tue, 25 Aug 2026 23:04:29 -0400 Subject: [PATCH 10/25] firefox/wrapper: add appDataDir argument This is immediately helpful on MacOS 27+ where access to default datadir is now restricted to apps that are signed by Mozilla. Moving datadir to a new location implies a completely new profile will be created, unless users migrate their datadirs from the default location to the new one. Nixpkgs derivation cannot execute this migration for the users, nor it includes any tools to help with it. For this reason, users on 27+ will have to explicitly opt-in their firefox to use a new location, potentially also migrating their existing datadir beforehand. I expect Home Manager programs.firefox module to allow to set the argument to: ${cfg.home.homeDirectory}/Library/Application Support/org.nixos.firefox Other package consumers are advised to use the same directory for portability reasons. Fixes #535123 (cherry picked from commit 2452ba690cfa131ce5bb55b2974b99a01ac94709) --- pkgs/applications/networking/browsers/firefox/wrapper.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index 9d08133aa610..9631e5ed0773 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -72,6 +72,7 @@ let pkcs11Modules ? [ ], useGlvnd ? (!isDarwin), cfg ? config.${applicationName} or { }, + appDataDir ? null, ## Following options are needed for extra prefs & policies # For more information about anti tracking (german website) @@ -341,6 +342,11 @@ let "MOZ_ALLOW_DOWNGRADE" "1" ] + ++ lib.optionals (appDataDir != null) [ + "--set" + "MOZ_APP_DATA" + appDataDir + ] ++ lib.optionals (!isDarwin) [ "--suffix" "GTK_PATH" From f5049d18635fa2b486c495ee957bb1f72733fb14 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Wed, 2 Sep 2026 18:04:35 +0000 Subject: [PATCH 11/25] firefox-beta-unwrapped: 155.0b5 -> 156.0b2 (cherry picked from commit 8a52ddab40d0765d19b0cdf611d08df8d2d66a7c) --- .../networking/browsers/firefox/packages/firefox-beta.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix index 8a03e06626a9..20f7f74a25af 100644 --- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix +++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix @@ -10,11 +10,11 @@ buildMozillaMach rec { pname = "firefox-beta"; binaryName = "firefox-beta"; - version = "155.0b5"; + version = "156.0b2"; applicationName = "Firefox Beta"; src = fetchurl { url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz"; - sha512 = "30b4b84c80057a992e763b8f967c65f46308324fd41c0307c9302e262e6428c379861ccd9ce52dde15d0dc3f4410b95a8c047ea7e5af9d90e60e7bb57ee59137"; + sha512 = "5b685f8b947af0b519c59a308fba6a41f9481df68b7fb6f4b395707653c3ef1822817d2f867d663081cd2d61c8fd4537f46b8002da84b5efa9b8a57ae9491164"; }; meta = { From 3fd492a61544e538e6d923b07f86fed3ba6724f4 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Wed, 2 Sep 2026 18:04:43 +0000 Subject: [PATCH 12/25] firefox-devedition-unwrapped: 155.0b5 -> 156.0b2 (cherry picked from commit 2e9ba061138d7d404fb5f71f5cc2d59799e4f386) --- .../browsers/firefox/packages/firefox-devedition.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix index 449995dd3620..f214b36faab1 100644 --- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix +++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix @@ -10,13 +10,13 @@ buildMozillaMach rec { pname = "firefox-devedition"; binaryName = "firefox-devedition"; - version = "155.0b5"; + version = "156.0b2"; applicationName = "Firefox Developer Edition"; requireSigning = false; branding = "browser/branding/aurora"; src = fetchurl { url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz"; - sha512 = "8e9ccc65a8cd6640171d4891fe8d01435cd524cee8164a5829429df827bcc2b49c3b7e6a092aaf5bfa48140d7f40f6c9cb371af48a7321132ea6ee5da0af08e3"; + sha512 = "683326ff4367f9b807c4c5b93f100970258ada9838da2c597358105a99ff4aa7e33269fe67d6c68d466e2f539d2bea3015457109516af19e1785588ce43426b5"; }; # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but From 6fbb8aa84a852750aaa8cd51c15a03b193e01e7e Mon Sep 17 00:00:00 2001 From: Jamie Magee Date: Wed, 19 Aug 2026 10:50:10 -0700 Subject: [PATCH 13/25] github-runner: fix reproducible builds Assisted-by: GitHub Copilot CLI (GPT-5.6 Sol) (cherry picked from commit fee9e9f9aa74a7cfe081de5120750306572f9f30) --- pkgs/by-name/gi/github-runner/package.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix index 2c8771aae97a..1508eeac2d3a 100644 --- a/pkgs/by-name/gi/github-runner/package.nix +++ b/pkgs/by-name/gi/github-runner/package.nix @@ -41,10 +41,10 @@ buildDotnetModule (finalAttrs: { owner = "actions"; repo = "runner"; tag = "v${finalAttrs.version}"; - hash = "sha256-wzPGtNdKszDT8VMgL13xUUp+IhP8UzpXVHkR0T2Ns1A="; + hash = "sha256-QbenIEfOvISgXXlsalZa51y0m8ZG5uc/MpLnddpxXLo="; leaveDotGit = true; postFetch = '' - git -C $out rev-parse --short HEAD > $out/.git-revision + git -C $out rev-parse HEAD > $out/.git-revision rm -rf $out/.git ''; }; @@ -67,8 +67,8 @@ buildDotnetModule (finalAttrs: { mkdir -p $TMPDIR/bin cat > $TMPDIR/bin/git < Date: Thu, 3 Sep 2026 05:01:32 +0000 Subject: [PATCH 14/25] openlist: 4.2.5 -> 4.2.6 (cherry picked from commit b67bdad72f1279b1a59fa2ba94377470bb524096) --- pkgs/by-name/op/openlist/frontend.nix | 8 ++++---- pkgs/by-name/op/openlist/package.nix | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix index bf33427635e9..28d6b66977bb 100644 --- a/pkgs/by-name/op/openlist/frontend.nix +++ b/pkgs/by-name/op/openlist/frontend.nix @@ -12,18 +12,18 @@ }: buildNpmPackage (finalAttrs: { pname = "openlist-frontend"; - version = "4.2.5"; + version = "4.2.6"; src = fetchFromGitHub { owner = "OpenListTeam"; repo = "OpenList-Frontend"; tag = "v${finalAttrs.version}"; - hash = "sha256-AOy8IZnrf3893d33Gkuu8Ktz1WY/FnvhUzbiHf9PpGk="; + hash = "sha256-m/5DoGnmOAVv8PGWwUWEUntiQNAzUbJ5pIhP4JsRt+s="; }; i18n = fetchzip { url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz"; - hash = "sha256-ID8fEVBpq68rrppqx1bx3rwD9hJU/JlEDKuKz5g9DPs="; + hash = "sha256-0+y4/stjTMek65Poq8Qfxadta0UrLefdFHxk6S9MGbM="; stripRoot = false; }; @@ -41,7 +41,7 @@ buildNpmPackage (finalAttrs: { inherit (finalAttrs) pname version src; pnpm = openlistPnpm; fetcherVersion = 4; - hash = "sha256-+QW8ViG8jNUiGPPAUuAY2AhzSUHuFOlLYB2uHA0ILpU="; + hash = "sha256-06zs01JrlsCFuOWvREEOGuk/6bR7lwGh7cV7ZeBunzQ="; }; npmConfigHook = pnpmConfigHook; diff --git a/pkgs/by-name/op/openlist/package.nix b/pkgs/by-name/op/openlist/package.nix index 8578e45c6e0d..29dd2c9d029a 100644 --- a/pkgs/by-name/op/openlist/package.nix +++ b/pkgs/by-name/op/openlist/package.nix @@ -12,13 +12,13 @@ buildGoModule (finalAttrs: { pname = "openlist"; - version = "4.2.5"; + version = "4.2.6"; src = fetchFromGitHub { owner = "OpenListTeam"; repo = "OpenList"; tag = "v${finalAttrs.version}"; - hash = "sha256-EVKHCyGJMYrD7nrvBGX1xReAPkgTV7ElAG2Uyu3W1cg="; + hash = "sha256-4mr342eIstv8owkBojPwUq1QZ6EhIqIfvntcYLh98y4="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. leaveDotGit = true; @@ -34,7 +34,7 @@ buildGoModule (finalAttrs: { frontend = callPackage ./frontend.nix { }; proxyVendor = true; - vendorHash = "sha256-G27D6zDuA4HBEOFUWjwf4+gt8OOHBKsPvuPatBussTM="; + vendorHash = "sha256-Jn+4bQbiJW/1nJ9prnI3UFXmb199WcsWdHxm2mcDsXw="; nativeBuildInputs = [ installShellFiles From 5cbf0df30ea5b93782b0026d0904494afcf59028 Mon Sep 17 00:00:00 2001 From: Oliver Schmidt Date: Mon, 31 Aug 2026 22:47:38 +0200 Subject: [PATCH 15/25] github-runner: 2.336.0 -> 2.337.0 (cherry picked from commit 193cc0c9a450ebfda8301606757d4cd33450a95f) --- pkgs/by-name/gi/github-runner/deps.json | 162 ++++++++++++++++------ pkgs/by-name/gi/github-runner/package.nix | 4 +- 2 files changed, 118 insertions(+), 48 deletions(-) diff --git a/pkgs/by-name/gi/github-runner/deps.json b/pkgs/by-name/gi/github-runner/deps.json index f11ad9e3f106..cb6709a350b4 100644 --- a/pkgs/by-name/gi/github-runner/deps.json +++ b/pkgs/by-name/gi/github-runner/deps.json @@ -1,18 +1,18 @@ [ { "pname": "Azure.Core", - "version": "1.50.0", - "hash": "sha256-8Pjz0/2wTLK5uY7G5qrxQr4CsmrjiR8gL4g6zJymj5s=" + "version": "1.55.0", + "hash": "sha256-6lPqo+pNn0R1JOhlfg7KwD33Do43y2e1hxK0gX6fvhU=" }, { "pname": "Azure.Storage.Blobs", - "version": "12.27.0", - "hash": "sha256-Ag8kMe/NBfq+HSchFzm0VAAo9xVnrKHFHUjbQ4KpSh0=" + "version": "12.29.2", + "hash": "sha256-eyEuuX8CjJfU5FCzxedc4F3oFMAAeIHcL28rurYCDc4=" }, { "pname": "Azure.Storage.Common", - "version": "12.26.0", - "hash": "sha256-GPiEPi/caj5z2cMFP5TUx/Jrj/zXZmA/xqC9CEoI+qQ=" + "version": "12.28.0", + "hash": "sha256-I1LbKRdd9OLXZRP4jsp3A4WiI4ZVrEA640wqcPry81c=" }, { "pname": "Castle.Core", @@ -31,13 +31,13 @@ }, { "pname": "Microsoft.Bcl.AsyncInterfaces", - "version": "8.0.0", - "hash": "sha256-9aWmiwMJKrKr9ohD1KSuol37y+jdDxPGJct3m2/Bknw=" + "version": "10.0.3", + "hash": "sha256-+wTcmczUD1qSnnWZ1miijr62/glcRbNWRpEZh/OBU2g=" }, { "pname": "Microsoft.Bcl.Cryptography", - "version": "10.0.7", - "hash": "sha256-5hOu8j2jLhCj9m7MlBoCjq3Qo0ST+b8n6oG2lLHL24s=" + "version": "10.0.11", + "hash": "sha256-+kdPkD18wpCVndcfoGinCINcr2Yk8Txl0RbJ3gYrNUc=" }, { "pname": "Microsoft.CodeCoverage", @@ -46,44 +46,89 @@ }, { "pname": "Microsoft.DevTunnels.Connections", - "version": "1.3.48", - "hash": "sha256-/E7ik2riVOMUyPt/1pxU7laDHG1pG5JpLIf5cQ7x7K4=" + "version": "1.3.51", + "hash": "sha256-0XsrCanwQ4E4BueU4njF0K8Ovczf9K4/mw9EhTxnzPM=" }, { "pname": "Microsoft.DevTunnels.Contracts", - "version": "1.3.48", - "hash": "sha256-YYmyZWmKv03BnOKAwbAeLrKqYDbBQ4ZS26jn92QkLSc=" + "version": "1.3.51", + "hash": "sha256-O2JYXYxzjj4AooGdWsEQ8WgE8IxvPz9L58GJcIVPHF8=" }, { "pname": "Microsoft.DevTunnels.Management", - "version": "1.3.48", - "hash": "sha256-DyDPqIwQkKJESx5K9Y4nKtw05cHrTlTp56rg/JXuVag=" + "version": "1.3.51", + "hash": "sha256-AA6t3lboBSdBYTON2QCEBOYoNW9GPh8OquUiQkBogeE=" }, { "pname": "Microsoft.DevTunnels.Ssh", - "version": "3.12.24", - "hash": "sha256-+GFTJiVQ5NZy3HeCiFIm4DggKAKPlEb90P/ZBB/rRxc=" + "version": "3.12.40", + "hash": "sha256-EB/1D5evYbXJ/1jkeUeLgvOQtuPdT+xaJ4P6Na2vd+Q=" }, { "pname": "Microsoft.DevTunnels.Ssh.Tcp", - "version": "3.12.24", - "hash": "sha256-NCNAGmQ9ugp5ezJ8adujvP0HRtYkIn4Ly0AWq2nDH9M=" + "version": "3.12.40", + "hash": "sha256-UrNqqNYxCNUUO4rCs4PsWX4naaJv3mD+eLf0Dxg1PSg=" + }, + { + "pname": "Microsoft.Extensions.Configuration.Abstractions", + "version": "10.0.3", + "hash": "sha256-OfcPeDv7RJvvv7ns+wCMAQCdG/He2KtxV6MRlwvp35I=" }, { "pname": "Microsoft.Extensions.DependencyInjection.Abstractions", - "version": "8.0.2", - "hash": "sha256-UfLfEQAkXxDaVPC7foE/J3FVEXd31Pu6uQIhTic3JgY=" + "version": "10.0.3", + "hash": "sha256-ShB94jEtsq5X5r6xDZQ+wotZYG3OPKOCHNGy4B7NVFs=" + }, + { + "pname": "Microsoft.Extensions.Diagnostics.Abstractions", + "version": "10.0.3", + "hash": "sha256-JglKtC6+jfiggRUU5AXC6mR0cW1t3M33wR7WXKyJjBs=" + }, + { + "pname": "Microsoft.Extensions.FileProviders.Abstractions", + "version": "10.0.3", + "hash": "sha256-uWAZh/RdMEiwTM2311KlDKK2LBo81tIYXPTUzJXbceA=" + }, + { + "pname": "Microsoft.Extensions.Hosting.Abstractions", + "version": "10.0.3", + "hash": "sha256-d8zXyTfgVdok+Cgg5EC04DH4iPQtLxlU9CsGy5+dr6s=" }, { "pname": "Microsoft.Extensions.Logging.Abstractions", - "version": "8.0.3", - "hash": "sha256-5MSY1aEwUbRXehSPHYw0cBZyFcUH4jkgabddxhMiu3Q=" + "version": "10.0.3", + "hash": "sha256-lIStSIPTxaoCRoUBHsBPXZbuVj5io02390Wkyepyflw=" + }, + { + "pname": "Microsoft.Extensions.Options", + "version": "10.0.3", + "hash": "sha256-KDYaVBSdNEuhs3U164RV0n20cjwrpi7uI71B0j/UFsA=" + }, + { + "pname": "Microsoft.Extensions.Primitives", + "version": "10.0.3", + "hash": "sha256-w0G+IW9kz70ug1BEuJTeS1N7werQhms3gQl6ODzNIpQ=" }, { "pname": "Microsoft.Extensions.Primitives", "version": "8.0.0", "hash": "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo=" }, + { + "pname": "Microsoft.Identity.Client", + "version": "4.83.1", + "hash": "sha256-WDt1xgK5hdxSYg6cIK5wXtY4/PB+BaT393gNLawzE8A=" + }, + { + "pname": "Microsoft.Identity.Client.Extensions.Msal", + "version": "4.83.1", + "hash": "sha256-t4hG5KSzfBfhfZ7dJDBS2wr7v2nnDwRjPs78ZziM/b8=" + }, + { + "pname": "Microsoft.IdentityModel.Abstractions", + "version": "8.14.0", + "hash": "sha256-bkCuz1Wj56N+LHWLvHKLcCtIRqBK+3k5vD2qfB7xXKk=" + }, { "pname": "Microsoft.Net.Http.Headers", "version": "8.0.25", @@ -481,8 +526,8 @@ }, { "pname": "System.ClientModel", - "version": "1.8.0", - "hash": "sha256-ZWVhuw3IRk9rZXkXERhesEET2KMMzHjUH/HDI288WK8=" + "version": "1.11.0", + "hash": "sha256-wLbZlxAXOzKtjrdwrzvBdBTujt1QRwwGlbAa+Jx4PCc=" }, { "pname": "System.Collections", @@ -524,6 +569,11 @@ "version": "4.3.0", "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM=" }, + { + "pname": "System.Diagnostics.DiagnosticSource", + "version": "10.0.3", + "hash": "sha256-YQzu50E7/1slw8IcFkVpQd33/IyWw1hJapTIscnoF5Q=" + }, { "pname": "System.Diagnostics.DiagnosticSource", "version": "4.3.0", @@ -536,8 +586,8 @@ }, { "pname": "System.Diagnostics.EventLog", - "version": "10.0.7", - "hash": "sha256-fV+2RcEzBV/JUnPDOLce3VBQKqvo32zcTWMZeJcAAJg=" + "version": "10.0.9", + "hash": "sha256-asuR1KqI8IdI83alSGSvPmcfNuPHK5WweZ2uAhuxe2U=" }, { "pname": "System.Diagnostics.EventLog", @@ -561,8 +611,8 @@ }, { "pname": "System.Formats.Asn1", - "version": "10.0.7", - "hash": "sha256-s48DCef2td3qUMdsRRGFfzkZ/wl/kUaVseQBDDfWUzM=" + "version": "10.0.11", + "hash": "sha256-AQ14gRr3Uyn/FsLbc1jUvIE9XzHaudYBiIy9HmOwuYc=" }, { "pname": "System.Globalization", @@ -636,8 +686,13 @@ }, { "pname": "System.IO.Hashing", - "version": "10.0.1", - "hash": "sha256-k8EHcxnLitXo0CxoDZAxFmUlJJdKZVsZJ2+9zDMYB94=" + "version": "10.0.3", + "hash": "sha256-IK2hZpaQysKYAoM0AbEVgTwla5hhqaop7360Tb2tZzk=" + }, + { + "pname": "System.IO.Pipelines", + "version": "10.0.3", + "hash": "sha256-+LsHlaUFMFVb60U7GFcvD1l7IpEcjdm1+Iw2g+qrUik=" }, { "pname": "System.IO.Pipelines", @@ -661,8 +716,8 @@ }, { "pname": "System.Memory.Data", - "version": "8.0.1", - "hash": "sha256-cxYZL0Trr6RBplKmECv94ORuyjrOM6JB0D/EwmBSisg=" + "version": "10.0.3", + "hash": "sha256-HefKyCuNJ7bONOVqGi2WScG6XIoFyfGSwTQM9Ol06+U=" }, { "pname": "System.Net.Http", @@ -856,8 +911,8 @@ }, { "pname": "System.Security.Cryptography.Pkcs", - "version": "10.0.7", - "hash": "sha256-+3RdvoSme0k3FoutPdJLkbWPWsmqPVo80hMgpuH3FP0=" + "version": "10.0.11", + "hash": "sha256-+L6ZL7/9VeyMlOJDcNjV/Rb7FMxXctLekfWROU0tMIM=" }, { "pname": "System.Security.Cryptography.Primitives", @@ -866,8 +921,8 @@ }, { "pname": "System.Security.Cryptography.ProtectedData", - "version": "10.0.3", - "hash": "sha256-JF/WTKv00v/C4ml4g/VL3j4JMPpZa1HBmVMvUnphHr4=" + "version": "10.0.11", + "hash": "sha256-YZi5wcj1Rfnt4SygMIWtdPNitbMwJeNEbtfpa0gPTtE=" }, { "pname": "System.Security.Cryptography.X509Certificates", @@ -896,8 +951,8 @@ }, { "pname": "System.ServiceProcess.ServiceController", - "version": "10.0.7", - "hash": "sha256-koSlZI43JaCrG3ultJ6Sj7Ic9D9N878L+6HtRRGyJSA=" + "version": "10.0.9", + "hash": "sha256-Z3M1YYCnY2dThtLcG7661EEXL3GgN3Ea5L2SXpnp32w=" }, { "pname": "System.Text.Encoding", @@ -911,8 +966,8 @@ }, { "pname": "System.Text.Encoding.CodePages", - "version": "10.0.3", - "hash": "sha256-tDbCCtsmw1O8G9QvH2wyJtF7txxt6lpBy35w5rVZ800=" + "version": "10.0.11", + "hash": "sha256-qkR7i03teRNMKtmSc0Ap4NnC3CMsuhfbCaDL/8c7U2E=" }, { "pname": "System.Text.Encoding.Extensions", @@ -924,6 +979,16 @@ "version": "4.3.0", "hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc=" }, + { + "pname": "System.Text.Encodings.Web", + "version": "10.0.3", + "hash": "sha256-TuOSPfi9dfFnHvH5++zIi30JpRERp35HFpm2R0NWUAk=" + }, + { + "pname": "System.Text.Json", + "version": "10.0.3", + "hash": "sha256-E1gPHMAuk2tR4cyScCfsSlDDerhlLAQCUZZMiByIk18=" + }, { "pname": "System.Text.RegularExpressions", "version": "4.3.1", @@ -941,8 +1006,8 @@ }, { "pname": "System.Threading.Channels", - "version": "10.0.3", - "hash": "sha256-JuimR9Phq1bx34EQzFxWINDyANQV8ZCP2zN2cBydGVI=" + "version": "10.0.10", + "hash": "sha256-HCTjxLnKxalcdPZatq5/x1YZPcLExAR9cC8h4c2Ar3s=" }, { "pname": "System.Threading.Tasks", @@ -974,6 +1039,11 @@ "version": "4.0.1-rc2-24027", "hash": "sha256-B3qiX7GvZ6wU9lyg4BEQhspVq0LGcF/W4H+4RwWJfBo=" }, + { + "pname": "System.ValueTuple", + "version": "4.5.0", + "hash": "sha256-niH6l2fU52vAzuBlwdQMw0OEoRS/7E1w5smBFoqSaAI=" + }, { "pname": "System.Xml.ReaderWriter", "version": "4.0.11-rc2-24027", @@ -1021,8 +1091,8 @@ }, { "pname": "xunit.runner.visualstudio", - "version": "2.8.2", - "hash": "sha256-UlfK348r8kJuraywfdCtpJJxHkv04wPNzpUaz4UM/60=" + "version": "4.0.0", + "hash": "sha256-1CY2ZY7UEnMdeTFXW4dX4xHD1mB4VWuU1Rsa8ROHcQE=" }, { "pname": "YamlDotNet.Signed", diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix index 1508eeac2d3a..75676751815e 100644 --- a/pkgs/by-name/gi/github-runner/package.nix +++ b/pkgs/by-name/gi/github-runner/package.nix @@ -35,13 +35,13 @@ assert builtins.all ( buildDotnetModule (finalAttrs: { pname = "github-runner"; - version = "2.336.0"; + version = "2.337.0"; src = fetchFromGitHub { owner = "actions"; repo = "runner"; tag = "v${finalAttrs.version}"; - hash = "sha256-QbenIEfOvISgXXlsalZa51y0m8ZG5uc/MpLnddpxXLo="; + hash = "sha256-aM8GmgCkjgaipEDBjC5v6U61WPjCAdKnPEGQypfTzmA="; leaveDotGit = true; postFetch = '' git -C $out rev-parse HEAD > $out/.git-revision From 99854627535fb05bcb4b8c25070989396bb832fe Mon Sep 17 00:00:00 2001 From: Oliver Schmidt Date: Mon, 31 Aug 2026 22:49:01 +0200 Subject: [PATCH 16/25] github-runner: add myself as maintainer (cherry picked from commit 6562a6d6fe21801e78d06e57d8f1caaae9bcd32a) --- pkgs/by-name/gi/github-runner/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix index 75676751815e..5249b9eeb9c6 100644 --- a/pkgs/by-name/gi/github-runner/package.nix +++ b/pkgs/by-name/gi/github-runner/package.nix @@ -378,6 +378,7 @@ buildDotnetModule (finalAttrs: { aanderse zimbatm schmittlauch + osnyx ]; platforms = [ "x86_64-linux" From 61cf5e26963ac80a96bf327bcaf9701c9a7bc4db Mon Sep 17 00:00:00 2001 From: Oliver Schmidt Date: Mon, 31 Aug 2026 22:49:37 +0200 Subject: [PATCH 17/25] github-runner: drop schmittlauch as maintainer (cherry picked from commit 594b869331162dd7e065088aa30c3071a08b4c74) --- pkgs/by-name/gi/github-runner/package.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix index 5249b9eeb9c6..570d43f8aede 100644 --- a/pkgs/by-name/gi/github-runner/package.nix +++ b/pkgs/by-name/gi/github-runner/package.nix @@ -377,7 +377,6 @@ buildDotnetModule (finalAttrs: { kfollesdal aanderse zimbatm - schmittlauch osnyx ]; platforms = [ From 7c66676bf2c2407d5057a32e9dc7a3e8281761af Mon Sep 17 00:00:00 2001 From: brokkoli Date: Thu, 27 Aug 2026 21:38:06 +0200 Subject: [PATCH 18/25] nixos/frigate: exclude python multiprocessing sockets from tmpfiles cleanup Frigate runs with PrivateTmp = true. Frigate uses python's multiprocessing library to manage its detector processes. Python's multiprocessing creates files in /tmp/systemd-private-%b-*/tmp/pymp-*. The following systemd default tmpfiles rules # /etc/tmpfiles.d/systemd-tmp.conf x /tmp/systemd-private-%b-* X /tmp/systemd-private-%b-*/tmp # /etc/tmpfiles.d/tmp.conf q /tmp 1777 root root 10d clean out the python multiprocessing sockets that frigate uses. this leads to a FileNotFoundError when frigate tries to restart its detectors. This adds a tmpfiles exclude rule to keep the sockets. (cherry picked from commit 4093442be1fe7899864b6c961128dc42b4bae4e6) --- nixos/modules/services/video/frigate.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/modules/services/video/frigate.nix b/nixos/modules/services/video/frigate.nix index 387dc965cbee..43941e64ac0d 100644 --- a/nixos/modules/services/video/frigate.nix +++ b/nixos/modules/services/video/frigate.nix @@ -802,5 +802,10 @@ in ProtectProc = "invisible"; }; }; + + systemd.tmpfiles.settings."frigate" = { + # prevent gc of multiprocessing forkserver socket due to default systemd tmpfiles rules + "/tmp/systemd-private-%b-${config.systemd.services.frigate.name}-*/tmp/pymp-*".x = { }; + }; }; } From 8e99799ffab8845dc4a590a450d8f2555dd4c0df Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Sep 2026 19:15:29 +0000 Subject: [PATCH 19/25] xq-xml: 1.5.0 -> 1.5.1 (cherry picked from commit ad3e7f672a2e7ff3033423991fd430199e2dd96e) --- pkgs/by-name/xq/xq-xml/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/xq/xq-xml/package.nix b/pkgs/by-name/xq/xq-xml/package.nix index fcb2c2c6a8c7..ada1f81880b8 100644 --- a/pkgs/by-name/xq/xq-xml/package.nix +++ b/pkgs/by-name/xq/xq-xml/package.nix @@ -8,16 +8,16 @@ buildGoModule (finalAttrs: { pname = "xq"; - version = "1.5.0"; + version = "1.5.1"; src = fetchFromGitHub { owner = "sibprogrammer"; repo = "xq"; tag = "v${finalAttrs.version}"; - hash = "sha256-LjY+BQUrqjBZD3//4CULMiIbOfJXVB394ac1yT5DPaU="; + hash = "sha256-cDZdQ0gmyx3h64l+HlPKj9AJVyKR5EGFPaNU+4xX0pw="; }; - vendorHash = "sha256-ILlqmZwC0azNfvC3f5wSV96X7GPy969YUiIYOrFxJmU="; + vendorHash = "sha256-ZYZgac2AW7Yjy3wYjh+VXK5Ng7+CBZebn4bUX2lt2sc="; ldflags = [ "-s" From 7831ea497da412f0b5ac277a26f686e5ba45145a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 3 Sep 2026 04:41:57 +0000 Subject: [PATCH 20/25] freerdp: 3.30.0 -> 3.31.1 (cherry picked from commit 7464b5ef1dd9d47f50878058db63643746b2cca2) --- pkgs/by-name/fr/freerdp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fr/freerdp/package.nix b/pkgs/by-name/fr/freerdp/package.nix index f104a5949b54..8f5e1f2f823e 100644 --- a/pkgs/by-name/fr/freerdp/package.nix +++ b/pkgs/by-name/fr/freerdp/package.nix @@ -70,13 +70,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "freerdp"; - version = "3.30.0"; + version = "3.31.1"; src = fetchFromGitHub { owner = "FreeRDP"; repo = "FreeRDP"; tag = finalAttrs.version; - hash = "sha256-Fy7TB7cRHXB86deb86eg05Cwf9SHU0C/Qnfj5Ylmjug="; + hash = "sha256-6/YMQLcgOogoXu3Lhwl+g3+Ov59t4x7oOFlVLCa8+RU="; }; postPatch = '' From 70255c5704316232c4a2234ae1939061d8d0536f Mon Sep 17 00:00:00 2001 From: Gerhard Schwanzer Date: Mon, 31 Aug 2026 09:08:31 +0200 Subject: [PATCH 21/25] rsyslog: 8.2606.0 -> 8.2608.0, fix CVE-2026-78002 Release notes: https://redirect.github.com/rsyslog/rsyslog/releases/tag/v8.2608.0 Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol) (cherry picked from commit 01bb688abe384cbd916a1405e830fa8e1976b5b5) --- pkgs/by-name/rs/rsyslog/package.nix | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/pkgs/by-name/rs/rsyslog/package.nix b/pkgs/by-name/rs/rsyslog/package.nix index 457dc5947992..b827dc882941 100644 --- a/pkgs/by-name/rs/rsyslog/package.nix +++ b/pkgs/by-name/rs/rsyslog/package.nix @@ -66,29 +66,19 @@ stdenv.mkDerivation (finalAttrs: { pname = "rsyslog"; - version = "8.2606.0"; + version = "8.2608.0"; src = fetchurl { url = "https://www.rsyslog.com/files/download/rsyslog/rsyslog-${finalAttrs.version}.tar.gz"; - hash = "sha256-JXSz8waOaVXrlO9WQ+K2pbhYXMjqp3IJ/1y8Hi5fceU="; + hash = "sha256-49YMg0BSaMQi+V/ux0BFWhzEuRHQC9hCTV0ScrxQmxo="; }; patches = [ - # Remove with rsyslog 8.2608.0 or newer. + # Remove with the first rsyslog release containing this fix. (fetchpatch { - name = "CVE-2026-19654.patch"; - url = "https://github.com/rsyslog/rsyslog/commit/f7f774228273730ba1075f4cd457ae78303a8f08.patch"; - hash = "sha256-ww8Ade2eKrQygJduLMPFjxd/fmBnpQ4ePLEzHffPy90="; - }) - - # Fix imjournal invalidation reopen busy-loop. - # Remove with rsyslog 8.2608.0 or newer. - # https://github.com/rsyslog/rsyslog/pull/7384 - (fetchpatch { - name = "imjournal-invalidation-reopen-busy-loop.patch"; - url = "https://github.com/rsyslog/rsyslog/commit/383f80f21f16c3c94e7d7a57b0a5af12cdac9d75.patch"; - excludes = [ "ChangeLog" ]; - hash = "sha256-RlhXoK+dAPBN2wu4V7GoFw/d+uWQzO7+nUkW5+z7QJY="; + name = "CVE-2026-78002.patch"; + url = "https://github.com/rsyslog/rsyslog/commit/667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9.patch"; + hash = "sha256-QsxOJCvr6VBbLbXzednwgvCfisSvNm6zfxPaMFxXVT0="; }) ]; From 254fdc18d17a1fc554359ee157135c799c1805d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A9ana?= Date: Mon, 31 Aug 2026 23:43:54 +0200 Subject: [PATCH 22/25] wired: add libxkbcommon to rpath (cherry picked from commit e6699049618a164d488fa26fb28973009a690cab) --- pkgs/by-name/wi/wired/package.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/by-name/wi/wired/package.nix b/pkgs/by-name/wi/wired/package.nix index 75eab1ae98d6..2dee76a18a8c 100644 --- a/pkgs/by-name/wi/wired/package.nix +++ b/pkgs/by-name/wi/wired/package.nix @@ -6,6 +6,7 @@ dbus, pango, cairo, + libxkbcommon, libxscrnsaver, libxrandr, libxi, @@ -46,6 +47,12 @@ rustPlatform.buildRustPackage (finalAttrs: { install -Dm444 -t $out/etc/wired wired.ron wired_multilayout.ron ''; + preFixup = '' + patchelf $out/bin/wired \ + --add-needed libxkbcommon-x11.so \ + --add-rpath ${libxkbcommon}/lib + ''; + meta = { description = "Lightweight notification daemon written in Rust"; homepage = "https://github.com/Toqozz/wired-notify"; From b0d632ca76f91adccefcf320439855bcf551f6a2 Mon Sep 17 00:00:00 2001 From: eljamm Date: Wed, 22 Jul 2026 08:08:49 +0200 Subject: [PATCH 23/25] peertube: 8.2.2 -> 8.2.3; add changelog Diff: https://github.com/Chocobozzz/PeerTube/compare/v8.2.2...v8.2.3 (cherry picked from commit 79da3f01739b0710355633af4baf04da111277ed) --- pkgs/by-name/pe/peertube/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pe/peertube/package.nix b/pkgs/by-name/pe/peertube/package.nix index 408dd20c1d2d..0932c189d5e5 100644 --- a/pkgs/by-name/pe/peertube/package.nix +++ b/pkgs/by-name/pe/peertube/package.nix @@ -21,7 +21,7 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "peertube"; - version = "8.2.2"; + version = "8.2.3"; __structuredAttrs = true; strictDeps = true; @@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "Chocobozzz"; repo = "PeerTube"; tag = "v${finalAttrs.version}"; - hash = "sha256-huyuaCWJ3w1KHCcQFjH2ZcofPjqwjLpLt+dg6auD/dQ="; + hash = "sha256-w+mSFr+uobq1TtqfewRmakGMYlEjwLs0k39mWHMbq+Q="; }; outputs = [ @@ -170,6 +170,7 @@ stdenv.mkDerivation (finalAttrs: { ''; license = lib.licenses.agpl3Plus; homepage = "https://joinpeertube.org/"; + changelog = "https://github.com/Chocobozzz/PeerTube/blob/${finalAttrs.src.rev}/CHANGELOG.md"; platforms = [ "x86_64-linux" "aarch64-linux" From 22a7eb6ae3b06384a25f06ea9d8ce134c459d283 Mon Sep 17 00:00:00 2001 From: eljamm Date: Thu, 3 Sep 2026 19:10:28 +0200 Subject: [PATCH 24/25] peertube: 8.2.3 -> 8.2.4; add update script Diff: https://github.com/Chocobozzz/PeerTube/compare/v8.2.3...v8.2.4 Changelog: https://github.com/Chocobozzz/PeerTube/blob/refs/tags/v8.2.4/CHANGELOG.md (cherry picked from commit a55eca2602f7b5175fbd26907e0cf9442dfa6834) --- pkgs/by-name/pe/peertube/package.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pe/peertube/package.nix b/pkgs/by-name/pe/peertube/package.nix index 0932c189d5e5..3afd53b810a2 100644 --- a/pkgs/by-name/pe/peertube/package.nix +++ b/pkgs/by-name/pe/peertube/package.nix @@ -3,6 +3,7 @@ stdenv, fetchFromGitHub, fetchPnpmDeps, + nix-update-script, # build brotli, @@ -21,7 +22,7 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "peertube"; - version = "8.2.3"; + version = "8.2.4"; __structuredAttrs = true; strictDeps = true; @@ -30,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "Chocobozzz"; repo = "PeerTube"; tag = "v${finalAttrs.version}"; - hash = "sha256-w+mSFr+uobq1TtqfewRmakGMYlEjwLs0k39mWHMbq+Q="; + hash = "sha256-ixSa4VV11vgG607I8PJET+0eC060XpAXIFFqJSJNHvM="; }; outputs = [ @@ -150,6 +151,7 @@ stdenv.mkDerivation (finalAttrs: { passthru = { nodejs = nodejs_24; tests.peertube = nixosTests.peertube; + updateScript = nix-update-script { }; }; meta = { From 580351438842c387a3fac92226e2dacfbcda8f0c Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:35:46 +1000 Subject: [PATCH 25/25] ci/github-script/check-target-branch-policy: add exemption for kernels kernel updates go to staging-nixos, they shouldn't be flagged (cherry picked from commit 5a4d138f793e25c6a108a4ccdf9bc442d58003c5) --- .../check-target-branch-policy.test.ts | 30 +++++++++++++++++-- .../check-target-branch-policy.ts | 5 +++- 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/ci/github-script/check-target-branch-policy.test.ts b/ci/github-script/check-target-branch-policy.test.ts index 008b88c97524..1dd5d28e768f 100644 --- a/ci/github-script/check-target-branch-policy.test.ts +++ b/ci/github-script/check-target-branch-policy.test.ts @@ -161,7 +161,31 @@ const cases: Array<{ expected: 'mass-rebuild', }, { - name: 'kernel exemption suppresses a possible mass rebuild', + name: 'kernels-org exemption suppresses a possible mass rebuild', + facts: { + maxRebuildCount: 999, + onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json', + }, + expected: 'dismiss', + }, + { + name: 'kernels-org exemption suppresses a definite mass rebuild', + facts: { + maxRebuildCount: 1000, + onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json', + }, + expected: 'dismiss', + }, + { + name: 'kernels-org exemption suppresses a NixOS test rebuild', + facts: { + rebuildsAllTests: true, + onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json', + }, + expected: 'dismiss', + }, + { + name: 'xanmod kernel exemption suppresses a possible mass rebuild', facts: { maxRebuildCount: 999, onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix', @@ -169,7 +193,7 @@ const cases: Array<{ expected: 'dismiss', }, { - name: 'kernel exemption suppresses a definite mass rebuild', + name: 'xanmod kernel exemption suppresses a definite mass rebuild', facts: { maxRebuildCount: 1000, onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix', @@ -177,7 +201,7 @@ const cases: Array<{ expected: 'dismiss', }, { - name: 'kernel exemption suppresses a NixOS test rebuild', + name: 'xanmod kernel exemption suppresses a NixOS test rebuild', facts: { rebuildsAllTests: true, onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix', diff --git a/ci/github-script/check-target-branch-policy.ts b/ci/github-script/check-target-branch-policy.ts index 288fdeecdf4d..a5367ded6925 100644 --- a/ci/github-script/check-target-branch-policy.ts +++ b/ci/github-script/check-target-branch-policy.ts @@ -62,9 +62,12 @@ export function evaluateTargetBranchPolicy({ shouldCheckNixosRebuild, } = getTargetBranchPolicy({ base, head }) + // https://github.com/NixOS/nixpkgs/pull/553786#issuecomment-5510286851 + // kernels-org should go to staging-nixos (or master) and staging-nixos-xx.xx (or release-xx.xx) when backported // https://github.com/NixOS/nixpkgs/pull/521157 - // These should go to master and release-xx.xx when backported + // xanmod should go to master and release-xx.xx when backported const isExemptKernelUpdate = + onlyChangedFile === 'pkgs/os-specific/linux/kernel/kernels-org.json' || onlyChangedFile === 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix' // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218