From 345ea485e5ea448e74ffde8dc10dc28ecee67bec Mon Sep 17 00:00:00 2001 From: Alex Martens Date: Mon, 18 Sep 2023 17:14:23 -0700 Subject: [PATCH 01/14] github-runner: 2.307.1 -> 2.309.0 --- .../tools/continuous-integration/github-runner/default.nix | 5 +++-- .../tools/continuous-integration/github-runner/deps.nix | 6 +++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix index 6ccc923ec30d..3250bdbccdea 100644 --- a/pkgs/development/tools/continuous-integration/github-runner/default.nix +++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix @@ -17,13 +17,13 @@ }: buildDotnetModule rec { pname = "github-runner"; - version = "2.307.1"; + version = "2.309.0"; src = fetchFromGitHub { owner = "actions"; repo = "runner"; rev = "v${version}"; - hash = "sha256-h/JcOw7p/loBD6aj7NeZyqK3GtapNkjWTYw0G6OCmVQ="; + hash = "sha256-P70kNcd5TjWsHj16y11SEYROGG+JUkpwE9eVpHzvTes="; leaveDotGit = true; postFetch = '' git -C $out rev-parse --short HEAD > $out/.git-revision @@ -178,6 +178,7 @@ buildDotnetModule rec { ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [ # "JavaScript Actions in Alpine containers are only supported on x64 Linux runners. Detected Linux Arm64" "GitHub.Runner.Common.Tests.Worker.StepHostL0.DetermineNodeRuntimeVersionInAlpineContainerAsync" + "GitHub.Runner.Common.Tests.Worker.StepHostL0.DetermineNode20RuntimeVersionInAlpineContainerAsync" ] ++ lib.optionals DOTNET_SYSTEM_GLOBALIZATION_INVARIANT [ "GitHub.Runner.Common.Tests.ProcessExtensionL0.SuccessReadProcessEnv" diff --git a/pkgs/development/tools/continuous-integration/github-runner/deps.nix b/pkgs/development/tools/continuous-integration/github-runner/deps.nix index caa00cad9af2..bf6c56d8f85e 100644 --- a/pkgs/development/tools/continuous-integration/github-runner/deps.nix +++ b/pkgs/development/tools/continuous-integration/github-runner/deps.nix @@ -3,7 +3,7 @@ { fetchNuGet }: [ (fetchNuGet { pname = "Castle.Core"; version = "4.4.0"; sha256 = "0rpcbmyhckvlvp6vbzpj03c1gqz56ixc6f15vgmxmyf1g40c24pf"; }) - (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "5.2.4"; sha256 = "00fkczf69z2rwarcd8kjjdp47517a0ca6lggn72qbilsp03a5scj"; }) + (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "5.2.9"; sha256 = "1sy1q36bm9fz3gi780w4jgysw3dwaz2f3a5gcn6jxw1gkmdasb08"; }) (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.2.0"; sha256 = "018yl113i037m5qhm3z6csb0c4l8kj412dxw2dagdbj07qbxwikj"; }) (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; }) (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "5.2.1"; sha256 = "1gpka9jm2gl6f07pcwzwvaxw9xq1a19i9fskn0qs921c5grhlp3g"; }) @@ -29,7 +29,7 @@ (fetchNuGet { pname = "Moq"; version = "4.11.0"; sha256 = "08bnk80scjjqnkdbjam8grcqrw2rvj9z7556hiznac7in3fcp77w"; }) (fetchNuGet { pname = "NETStandard.Library"; version = "1.5.0-rc2-24027"; sha256 = "1kazwidj63w53r1s6fd8sgykb70kdic27fg9qhg74qzwm354imwm"; }) (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; }) - (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; }) + (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; }) (fetchNuGet { pname = "Newtonsoft.Json"; version = "9.0.1"; sha256 = "0mcy0i7pnfpqm4pcaiyzzji4g0c8i3a5gjz28rrr28110np8304r"; }) (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.1"; sha256 = "1r1hvj5gjl466bya2bfl5aaj8rbwyf5x1msg710wf3k2llbci1xa"; }) (fetchNuGet { pname = "NuGet.Frameworks"; version = "5.11.0"; sha256 = "0wv26gq39hfqw9md32amr5771s73f5zn1z9vs4y77cgynxr73s4z"; }) @@ -81,7 +81,7 @@ (fetchNuGet { pname = "System.AppContext"; version = "4.1.0-rc2-24027"; sha256 = "0c0x3sg12a5zwiamvxs9c4bhdwmmm9by6x5da58fbrzz7afbaaag"; }) (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; }) (fetchNuGet { pname = "System.Buffers"; version = "4.0.0-rc2-24027"; sha256 = "1mqnay87pkxih73984jf5fm14d0m6yjq4cv4cqbj37nmgm54ssjp"; }) - (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; }) + (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; }) (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; }) (fetchNuGet { pname = "System.Collections"; version = "4.0.11-rc2-24027"; sha256 = "0ijpgf7iy3mcvr9327craxsb0lsznprajqzjy59sspc75gk0yahq"; }) (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; }) From 7c431df7cc3dcfa57963eacdc9b24fbc4de6390e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Sun, 27 Aug 2023 18:59:13 +0200 Subject: [PATCH 02/14] =?UTF-8?q?betterbird:=20102.12.0-bb37=20=E2=86=92?= =?UTF-8?q?=20102.14.0-bb39?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../networking/mailreaders/betterbird/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/mailreaders/betterbird/default.nix b/pkgs/applications/networking/mailreaders/betterbird/default.nix index d08bd5dfcc4a..9c63f3f37cad 100644 --- a/pkgs/applications/networking/mailreaders/betterbird/default.nix +++ b/pkgs/applications/networking/mailreaders/betterbird/default.nix @@ -12,13 +12,13 @@ let thunderbird-unwrapped = thunderbirdPackages.thunderbird-102; - version = "102.12.0"; + version = "102.14.0"; majVer = lib.versions.major version; betterbird-patches = fetchFromGitHub { owner = "Betterbird"; repo = "thunderbird-patches"; - rev = "${version}-bb37"; + rev = "${version}-bb39"; postFetch = '' echo "Retrieving external patches" @@ -36,7 +36,7 @@ let . ./external.sh rm external.sh ''; - sha256 = "sha256-LH0dgWqariutfaOCPIUZrHzZ8oCbZF1VaaKQIQS4aL8="; + hash = "sha256-O9nGlJs3OziQLbdbdt3eFRHvk1A9cdEsbKDtsZrnY5Q="; }; in ((buildMozillaMach { pname = "betterbird"; @@ -49,7 +49,7 @@ in ((buildMozillaMach { src = fetchurl { # https://download.cdn.mozilla.net/pub/thunderbird/releases/ url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz"; - sha512 = "303787a8f22a204e48784d54320d5f4adaeeeedbe4c2294cd26ad75792272ffc9453be7f0ab1434214b61a2cc46982c23c4fd447c4d80d588df4a7800225ddee"; + sha512 = "4ae3f216833aec55421f827d55bc1b5fc2f0ad4fefecb27724a5be3318c351df24d30a4897b924e733ed2e3995be284b6d135049d46001143fb1c961fefc1830"; }; extraPostPatch = thunderbird-unwrapped.extraPostPatch or "" + /* bash */ '' From 9f9421015cedc0c3d1d3adb2d0dac1eef68eb94b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Wed, 6 Sep 2023 16:04:35 +0200 Subject: [PATCH 03/14] betterbird: 102.14.0-bb39 -> 102.15.0-bb40 --- .../networking/mailreaders/betterbird/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/mailreaders/betterbird/default.nix b/pkgs/applications/networking/mailreaders/betterbird/default.nix index 9c63f3f37cad..e3810dc80617 100644 --- a/pkgs/applications/networking/mailreaders/betterbird/default.nix +++ b/pkgs/applications/networking/mailreaders/betterbird/default.nix @@ -12,13 +12,13 @@ let thunderbird-unwrapped = thunderbirdPackages.thunderbird-102; - version = "102.14.0"; + version = "102.15.0"; majVer = lib.versions.major version; betterbird-patches = fetchFromGitHub { owner = "Betterbird"; repo = "thunderbird-patches"; - rev = "${version}-bb39"; + rev = "${version}-bb40"; postFetch = '' echo "Retrieving external patches" @@ -36,7 +36,7 @@ let . ./external.sh rm external.sh ''; - hash = "sha256-O9nGlJs3OziQLbdbdt3eFRHvk1A9cdEsbKDtsZrnY5Q="; + hash = "sha256-7/JEcP76rp0hSSxzlIlHqkcxTSEJQswFhCoOLYntQ5I="; }; in ((buildMozillaMach { pname = "betterbird"; @@ -49,7 +49,7 @@ in ((buildMozillaMach { src = fetchurl { # https://download.cdn.mozilla.net/pub/thunderbird/releases/ url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz"; - sha512 = "4ae3f216833aec55421f827d55bc1b5fc2f0ad4fefecb27724a5be3318c351df24d30a4897b924e733ed2e3995be284b6d135049d46001143fb1c961fefc1830"; + sha512 = "11d4c77049c532753c9b693d69ab9a0bcd0eb13d49f87a511ad8ba680b70041ac6f64c5f9cd5dd44246d46e7695d9bd51146b1fe62b0b7c9fbc862eb53d5cfda"; }; extraPostPatch = thunderbird-unwrapped.extraPostPatch or "" + /* bash */ '' From 08cf29241776fdbf13b4d56aa537279c13433e3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 14 Sep 2023 19:32:55 +0200 Subject: [PATCH 04/14] betterbird: 102.15.0-bb40 -> 102.15.1-bb41 --- .../networking/mailreaders/betterbird/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/mailreaders/betterbird/default.nix b/pkgs/applications/networking/mailreaders/betterbird/default.nix index e3810dc80617..42ea0d150a20 100644 --- a/pkgs/applications/networking/mailreaders/betterbird/default.nix +++ b/pkgs/applications/networking/mailreaders/betterbird/default.nix @@ -12,13 +12,13 @@ let thunderbird-unwrapped = thunderbirdPackages.thunderbird-102; - version = "102.15.0"; + version = "102.15.1"; majVer = lib.versions.major version; betterbird-patches = fetchFromGitHub { owner = "Betterbird"; repo = "thunderbird-patches"; - rev = "${version}-bb40"; + rev = "${version}-bb41"; postFetch = '' echo "Retrieving external patches" @@ -36,7 +36,7 @@ let . ./external.sh rm external.sh ''; - hash = "sha256-7/JEcP76rp0hSSxzlIlHqkcxTSEJQswFhCoOLYntQ5I="; + hash = "sha256-fP763ec4B8LbivzmYHzQ4j39QMxWrymqI8chXfF3KX8="; }; in ((buildMozillaMach { pname = "betterbird"; @@ -49,7 +49,7 @@ in ((buildMozillaMach { src = fetchurl { # https://download.cdn.mozilla.net/pub/thunderbird/releases/ url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz"; - sha512 = "11d4c77049c532753c9b693d69ab9a0bcd0eb13d49f87a511ad8ba680b70041ac6f64c5f9cd5dd44246d46e7695d9bd51146b1fe62b0b7c9fbc862eb53d5cfda"; + hash = "sha256-og1Tu7PAHOqGs02jkHU291BCGuKDy1J+72v4Gsu4oDg="; }; extraPostPatch = thunderbird-unwrapped.extraPostPatch or "" + /* bash */ '' From a95c07be4bb56d6d4c371496ece390c096778d02 Mon Sep 17 00:00:00 2001 From: Sophie Tauchert Date: Tue, 19 Sep 2023 18:06:35 +0200 Subject: [PATCH 05/14] mastodon: 4.1.7 -> 4.1.8 (cherry picked from commit fc400479c83170f94c3f755789c7574441c48a60) --- pkgs/servers/mastodon/source.nix | 4 ++-- pkgs/servers/mastodon/version.nix | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/mastodon/source.nix b/pkgs/servers/mastodon/source.nix index e0920eadf5f2..c203852a76d1 100644 --- a/pkgs/servers/mastodon/source.nix +++ b/pkgs/servers/mastodon/source.nix @@ -3,8 +3,8 @@ src = fetchFromGitHub { owner = "mastodon"; repo = "mastodon"; - rev = "v4.1.7"; - hash = "sha256-afGv7/Cl7bxbHvLXrtpZPlG4oJeL7LgQQKXBBt3LRSo="; + rev = "v4.1.8"; + hash = "sha256-L4ikr270hXpTgh9DAyN9c5wzj/93urulcG9bTxwNOFw="; }; in applyPatches { inherit src; diff --git a/pkgs/servers/mastodon/version.nix b/pkgs/servers/mastodon/version.nix index 2d0483ea06a4..a7c64b1833f5 100644 --- a/pkgs/servers/mastodon/version.nix +++ b/pkgs/servers/mastodon/version.nix @@ -1 +1 @@ -"4.1.7" +"4.1.8" From dce6d779cde702a1322a7fd202e2108e42bbbb1d Mon Sep 17 00:00:00 2001 From: Markus Kowalewski Date: Fri, 15 Sep 2023 23:21:33 +0200 Subject: [PATCH 06/14] hwloc: 2.9.2 -> 2.9.3 fixed CVE-2022-47022 (cherry picked from commit 6b61971c7a8cb46c53e673faf5e5512cef034000) --- pkgs/development/libraries/hwloc/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/hwloc/default.nix b/pkgs/development/libraries/hwloc/default.nix index fbef44bf67ea..367a14c22a07 100644 --- a/pkgs/development/libraries/hwloc/default.nix +++ b/pkgs/development/libraries/hwloc/default.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation rec { pname = "hwloc"; - version = "2.9.2"; + version = "2.9.3"; src = fetchurl { url = "https://www.open-mpi.org/software/hwloc/v${lib.versions.majorMinor version}/downloads/hwloc-${version}.tar.bz2"; - sha256 = "sha256-Cof99nf4sAtWfSKbYyC/ayXGk+2qQ+C4UmjZmdawYM8="; + sha256 = "sha256-XEBizlVvbTRR/Bd/+4ZzohIPgd9oNd6mohqQ+9//Dew="; }; configureFlags = [ From ab08afa0ea255d5014ff4d92255aad500662d7a5 Mon Sep 17 00:00:00 2001 From: Charlotte Van Petegem Date: Tue, 19 Sep 2023 22:23:48 +0200 Subject: [PATCH 07/14] mautrix-whatsapp: 0.10.1 -> 0.10.2 https://github.com/mautrix/whatsapp/releases/tag/v0.10.2 (cherry picked from commit 6fdb57536c04a5d1a65a4ebc4a503c76342c61eb) --- pkgs/servers/mautrix-whatsapp/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix index 1a0845e8752d..e0db6f3c0841 100644 --- a/pkgs/servers/mautrix-whatsapp/default.nix +++ b/pkgs/servers/mautrix-whatsapp/default.nix @@ -2,18 +2,18 @@ buildGoModule rec { pname = "mautrix-whatsapp"; - version = "0.10.1"; + version = "0.10.2"; src = fetchFromGitHub { owner = "mautrix"; repo = "whatsapp"; rev = "v${version}"; - hash = "sha256-I1qM1hq6bnBgbtfzgWvySairfr+Q6TthMIQM+Mregc8="; + hash = "sha256-GWtci/OiipaUFzzha3GvkoKmN1lb9Fg3i+X1ZFkGKtc="; }; buildInputs = [ olm ]; - vendorHash = "sha256-TH353K6BOTzFC/iPIf1S7rV0DSIxjJEg42ru5H8NbSE="; + vendorHash = "sha256-IEBSY61Bjuc42GqQUvChqLayO1hiDEDBxlMoAKJo12E="; doCheck = false; From d83d306fdd21ec30c49edc804bda534b64fb048d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Tue, 19 Sep 2023 20:07:47 -0600 Subject: [PATCH 08/14] linux/hardened/patches/5.10: 5.10.194-hardened1 -> 5.10.195-hardened1 (cherry picked from commit 5bf057e81272c679e8f52bf6dac0107bd012db45) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 594b303a25a8..8205aabdba4f 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -22,12 +22,12 @@ "5.10": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.10.194-hardened1.patch", - "sha256": "1ba8ridhjz9y8ap1wgp7z41jmwzx8j0bxkyp1zjfls1z7mqq4vpf", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.194-hardened1/linux-hardened-5.10.194-hardened1.patch" + "name": "linux-hardened-5.10.195-hardened1.patch", + "sha256": "15liin3i9wh7hwr97pyc8rl79ri7frsprssl50si9z810zvc9chb", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.195-hardened1/linux-hardened-5.10.195-hardened1.patch" }, - "sha256": "15fr7krhpmqz0xqjg78m2xvfllbni3xh8xyhxh9ni31ppd3mw394", - "version": "5.10.194" + "sha256": "0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1", + "version": "5.10.195" }, "5.15": { "patch": { From 8894f6f7369ab364bf7f8f79b9de148dc4d12f96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Tue, 19 Sep 2023 20:08:06 -0600 Subject: [PATCH 09/14] linux/hardened/patches/5.15: 5.15.131-hardened1 -> 5.15.132-hardened1 (cherry picked from commit 5975e81e97aeef3458111d2f0deceaf2eaa2bb23) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 8205aabdba4f..5f65ea04455a 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -32,12 +32,12 @@ "5.15": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.15.131-hardened1.patch", - "sha256": "06hy3v9r2rqnqxsby2204grzjcll64561m26wlnkyiz20gpl16n4", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.131-hardened1/linux-hardened-5.15.131-hardened1.patch" + "name": "linux-hardened-5.15.132-hardened1.patch", + "sha256": "06wkcbhkdm8vnk1cqwngy9gdknqm4pb4za9lbh2q5j1f2nkcn7pq", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.132-hardened1/linux-hardened-5.15.132-hardened1.patch" }, - "sha256": "0sacnbw48lblnqaj56nybh588sq4k84gwf0r5zinzyrryj8k6z4r", - "version": "5.15.131" + "sha256": "1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1", + "version": "5.15.132" }, "5.4": { "patch": { From afb142b643eefccd5f4ad613bf83b3dc4195a59f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Tue, 19 Sep 2023 20:08:11 -0600 Subject: [PATCH 10/14] linux/hardened/patches/6.1: 6.1.53-hardened1 -> 6.1.54-hardened1 (cherry picked from commit 48c0d0aab74272d0a6b993a1de4d3a5fa8d225b3) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 5f65ea04455a..7f0c97de49d9 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -52,12 +52,12 @@ "6.1": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-6.1.53-hardened1.patch", - "sha256": "1v8k4rb3f24cpzvng7nyxllypmi8dc4cv0yj2jfvr64pxr7vzlkw", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.53-hardened1/linux-hardened-6.1.53-hardened1.patch" + "name": "linux-hardened-6.1.54-hardened1.patch", + "sha256": "0c8dmgciwc02pzhnx2mj5xlhds7mmicm8r6668di2zfw772rjgr4", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.54-hardened1/linux-hardened-6.1.54-hardened1.patch" }, - "sha256": "0zpdg3fcc12iyjhfs5w7cw75700z4i8m9jcg38mlzlhh92hf0msz", - "version": "6.1.53" + "sha256": "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653", + "version": "6.1.54" }, "6.4": { "patch": { From d7611d0322984df20bc6d955f2f7131344a385b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Tue, 19 Sep 2023 20:08:18 -0600 Subject: [PATCH 11/14] linux/hardened/patches/6.5: 6.5.3-hardened1 -> 6.5.4-hardened1 (cherry picked from commit 8901edab58eb976d60f94d50a652bc47c8d3b776) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 7f0c97de49d9..c7893abad213 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -72,11 +72,11 @@ "6.5": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-6.5.3-hardened1.patch", - "sha256": "0p92x3f129hmk5r5xmxs5ihvg5cdl2bmqlhqza3wy4314f1kngl7", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.3-hardened1/linux-hardened-6.5.3-hardened1.patch" + "name": "linux-hardened-6.5.4-hardened1.patch", + "sha256": "0r411dgp17am2bnfpk8lbzmymp6w9d5raz7hni0mw0kpcq6z996n", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.4-hardened1/linux-hardened-6.5.4-hardened1.patch" }, - "sha256": "0kzbcc3iar9i0hb99xf9k3b16lxb4f8qzmia0gwxrn3vn7vi7b2c", - "version": "6.5.3" + "sha256": "0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx", + "version": "6.5.4" } } From 4880c77cb51699cc4b482c04548b9a8754f3977b Mon Sep 17 00:00:00 2001 From: emilylange Date: Wed, 20 Sep 2023 14:06:54 +0200 Subject: [PATCH 12/14] Revert "chromium,ungoogled-chromium,chromedriver: 116.0.5845.187/96 -> 117.0.5938.88" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is due to some obscure linking issue in the past linking step. I'll try to look into this, and hopefully revert the revert soon-ish. The chromium bump is not too severe, in the context of chromium releases at least, as they are "only" medium severity CVEs 🫠 This has not been caught by ofborg, because it never reached the final linking step in the buildPhase, due to the globally hardcoded 3600s timeout. Failed hydra builds: https://hydra.nixos.org/build/235844127 This reverts merge commit d6274e5a50df8f3c1c8a617cf98ac0d1ae7a00a8. Which in turn reverts a9e1b120f2e2c4fd9f4a85b99ffe8f64871d108f, 020a58950c8bf52782f6fc57d825884e77466cf5, f5d7664e4c751da3982d702eb1f49414bc565912 and 95ee3b768c16bd2e9f5c95af0232b45c08f71d6f. --- .../networking/browsers/chromium/common.nix | 6 ---- .../browsers/chromium/ungoogled-flags.toml | 1 + .../browsers/chromium/upstream-info.nix | 36 +++++++++---------- 3 files changed, 19 insertions(+), 24 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix index c50f27f46440..bb44bf54af73 100644 --- a/pkgs/applications/networking/browsers/chromium/common.nix +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -241,12 +241,6 @@ let # We need the fix for https://bugs.chromium.org/p/chromium/issues/detail?id=1254408: base64 --decode ${clangFormatPython3} > buildtools/linux64/clang-format - # Add final newlines to scripts that do not end with one. - # This is a temporary workaround until https://github.com/NixOS/nixpkgs/pull/255463 (or similar) has been merged, - # as patchShebangs hard-crashes when it encounters files that contain only a shebang and do not end with a final - # newline. - find . -type f -perm -0100 -exec sed -i -e '$a\' {} + - patchShebangs . # Link to our own Node.js and Java (required during the build): mkdir -p third_party/node/linux/node-linux-x64/bin diff --git a/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml b/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml index 76a992fef3d0..8578089ae41a 100644 --- a/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml +++ b/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml @@ -4,6 +4,7 @@ clang_use_chrome_plugins=false disable_fieldtrial_testing_config=true enable_hangout_services_extension=false enable_mdns=false +enable_mse_mpeg2ts_stream_parser=true enable_nacl=false enable_reading_list=false enable_remoting=false diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix index 749a158260a0..b7acecd869ac 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix @@ -27,39 +27,39 @@ }; stable = { chromedriver = { - sha256_darwin = "0phhcqid7wjw923qdi65zql3fid25swwszksgnw3b8fgz67jn955"; + sha256_darwin = "0gzx3zka8i2ngsdiqp8sr0v6ir978vywa1pj7j08vsf8kmb93iiy"; sha256_darwin_aarch64 = - "00fwq8slvjm6c7krgwjd4mxhkkrp23n4icb63qlvi2hy06gfj4l6"; - sha256_linux = "0ws8ch1j2hzp483vr0acvam1zxmzg9d37x6gqdwiqwgrk6x5pvkh"; - version = "117.0.5938.88"; + "18iyapwjg0yha8qgbw7f605n0j54nd36shv3497bd84lc9k74b14"; + sha256_linux = "0d8mqzjc11g1bvxvffk0xyhxfls2ycl7ym4ssyjq752g2apjblhp"; + version = "116.0.5845.96"; }; deps = { gn = { - rev = "811d332bd90551342c5cbd39e133aa276022d7f8"; - sha256 = "0jlg3d31p346na6a3yk0x29pm6b7q03ck423n5n6mi8nv4ybwajq"; + rev = "4bd1a77e67958fb7f6739bd4542641646f264e5d"; + sha256 = "14h9jqspb86sl5lhh6q0kk2rwa9zcak63f8drp7kb3r4dx08vzsw"; url = "https://gn.googlesource.com/gn"; - version = "2023-08-01"; + version = "2023-06-09"; }; }; - sha256 = "01n9aqnilsjrbpv5kkx3c6nxs9p5l5lfwxj67hd5s5g4740di4a6"; - sha256bin64 = "1dhgagphdzbd19gkc7vpl1hxc9vn0l7sxny346qjlmrwafqlhbgi"; - version = "117.0.5938.88"; + sha256 = "152lyrw8k36gbmf4fmfny4ajqh0523y5d48yrshbgwn5klmbhaji"; + sha256bin64 = "118sk39939d52srws2vgs1mfizpikswxh5ihd9x053vzn0aj8cfa"; + version = "116.0.5845.187"; }; ungoogled-chromium = { deps = { gn = { - rev = "811d332bd90551342c5cbd39e133aa276022d7f8"; - sha256 = "0jlg3d31p346na6a3yk0x29pm6b7q03ck423n5n6mi8nv4ybwajq"; + rev = "4bd1a77e67958fb7f6739bd4542641646f264e5d"; + sha256 = "14h9jqspb86sl5lhh6q0kk2rwa9zcak63f8drp7kb3r4dx08vzsw"; url = "https://gn.googlesource.com/gn"; - version = "2023-08-01"; + version = "2023-06-09"; }; ungoogled-patches = { - rev = "117.0.5938.88-1"; - sha256 = "1wz15ib56j8c84bgrbf0djk5wli49b1lvaqbg18pdclkp1mqy5w9"; + rev = "116.0.5845.187-1"; + sha256 = "0br5lms6mxg2mg8ix5mkb79bg6wk5f2hn0xy1xc7gk9h3rl58is1"; }; }; - sha256 = "01n9aqnilsjrbpv5kkx3c6nxs9p5l5lfwxj67hd5s5g4740di4a6"; - sha256bin64 = "1dhgagphdzbd19gkc7vpl1hxc9vn0l7sxny346qjlmrwafqlhbgi"; - version = "117.0.5938.88"; + sha256 = "152lyrw8k36gbmf4fmfny4ajqh0523y5d48yrshbgwn5klmbhaji"; + sha256bin64 = "118sk39939d52srws2vgs1mfizpikswxh5ihd9x053vzn0aj8cfa"; + version = "116.0.5845.187"; }; } From f6c623aee6f92b820be57d47bc32d66e646f4d46 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 19 Sep 2023 22:36:44 +0200 Subject: [PATCH 13/14] atlassian-confluence: 7.19.12 -> 7.19.14 Fixes CVE-2023-22512. ChangeLog: https://confluence.atlassian.com/doc/issues-resolved-in-7-19-14-1289421565.html (cherry picked from commit 26f3d4397b636c121956e0fc8c54e58ad8e7a827) --- pkgs/servers/atlassian/confluence.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/atlassian/confluence.nix b/pkgs/servers/atlassian/confluence.nix index 2225ca02b26b..f677ce61ac55 100644 --- a/pkgs/servers/atlassian/confluence.nix +++ b/pkgs/servers/atlassian/confluence.nix @@ -15,11 +15,11 @@ in optionalWarning (crowdProperties != null) "Using `crowdProperties` is deprecated!" (stdenvNoCC.mkDerivation rec { pname = "atlassian-confluence"; - version = "7.19.12"; + version = "7.19.14"; src = fetchurl { url = "https://product-downloads.atlassian.com/software/confluence/downloads/${pname}-${version}.tar.gz"; - sha256 = "sha256-59JOZWKhHPtz9NFiGreFHAOgIL5aB227j6nC1XyofvE="; + sha256 = "sha256-Z4a4YZO9UnZSAZYB0FHRsX8QwX0ju3SeISsQquyA+w0="; }; buildPhase = '' From 777789ba7060d43e6e68becad1fc91b168eece5a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 19 Sep 2023 22:41:12 +0200 Subject: [PATCH 14/14] atlassian-jira: 9.6.0 -> 9.11.1 No release notes for 9.11.1 so far. For 9.11.0: https://confluence.atlassian.com/jirasoftware/issues-resolved-in-9-11-0-1282244702.html However, the 9.6 series hat its last release in January 2023[1], so going to the latest 9.x release with recent patch-level releases. [1] https://www.atlassian.com/de/software/jira/update (cherry picked from commit 891a43bab2cefc3b614992583c451b7801c006bf) --- pkgs/servers/atlassian/jira.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/atlassian/jira.nix b/pkgs/servers/atlassian/jira.nix index ae15331db1f1..dbbbbe9944b6 100644 --- a/pkgs/servers/atlassian/jira.nix +++ b/pkgs/servers/atlassian/jira.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation rec { pname = "atlassian-jira"; - version = "9.6.0"; + version = "9.11.1"; src = fetchurl { url = "https://product-downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-${version}.tar.gz"; - sha256 = "sha256-J4AT8fmSFVR45wyxDKZ3QgDyc5yz5TiJbEGFbfJB/Zo="; + sha256 = "sha256-ertaJrURAMViQ5WVa8JgCu9vlTNwGVRiPTt7grIrgZQ="; }; nativeBuildInputs = [ makeWrapper ];