nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-08-25 17:55:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge release-25.11 into staging-next-25.11

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2026-05-28 00:43:39 +00:00
committed by GitHub
parent ecadfebb38 f52c223fcf
commit a8d0e22201
15 changed files with 280 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
pkgs/applications/networking/browsers/firefox/wrapper.nix
View File

@@ -149,36 +149,34 @@ let
) (lib.optionals usesNixExtensions nixExtensions);
enterprisePolicies = {
policies = {
DisableAppUpdate = true;
}
// lib.optionalAttrs usesNixExtensions {
ExtensionSettings = {
"*" = {
blocked_install_message = "You can't have manual extension mixed with nix extensions";
installation_mode = "blocked";
};
}
// lib.foldr (
e: ret:
ret
// {
"${e.extid}" = {
installation_mode = "allowed";
policies =
lib.optionalAttrs usesNixExtensions {
ExtensionSettings = {
"*" = {
blocked_install_message = "You can't have manual extension mixed with nix extensions";
installation_mode = "blocked";
};
}
) { } extensions;
// lib.foldr (
e: ret:
ret
// {
"${e.extid}" = {
installation_mode = "allowed";
};
}
) { } extensions;
Extensions = {
Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
};
}
// lib.optionalAttrs smartcardSupport {
SecurityDevices = {
"OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
};
}
// extraPolicies;
Extensions = {
Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
};
}
// lib.optionalAttrs smartcardSupport {
SecurityDevices = {
"OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
};
}
// extraPolicies;
};
mozillaCfg = ''
@@ -397,6 +395,9 @@ let
ln -sfT "$target" "$out/$l"
done
# Disable update checks
touch $out/${libDir}/is-packaged-app
cd "$out"
''

11
pkgs/applications/networking/mailreaders/thunderbird/packages.nix
View File

@@ -30,11 +30,12 @@ let
(if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
];
# FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
# https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
# https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
extraPostPatch =
lib.optionalString (lib.versionAtLeast version "147" && lib.versionOlder version "149")
lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152")
''
find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
'';
meta = {
@@ -73,8 +74,8 @@ rec {
thunderbird = thunderbird-latest;
thunderbird-latest = common {
version = "150.0.2";
sha512 = "3e52220ff34aa6cd1bf46a910dba1f30d0abf7d19ed7f501ffeeb8f5901b8d97fdc0adb0cceb434ef8e83c7f7b83f28024b872280237af72ff2da9d89fafe065";
version = "151.0.1";
sha512 = "a09c1e18faa8d7fdccf39e905542c21e817230e68c7cc6050beec048d0fec0f8eb92e51278d2ccd8d8cfa842762662235517e20238b555a4ad48ee5648dc3589";
updateScript = callPackage ./update.nix {
attrPath = "thunderbirdPackages.thunderbird-latest";

3
pkgs/applications/science/logic/hol_light/default.nix
View File

@@ -9,6 +9,7 @@
zarith,
camlp5,
camlp-streams,
pcre2,
}:
let
@@ -18,6 +19,7 @@ let
''
-I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \
-I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
''
else
lib.optionalString (num != null) ''
@@ -61,6 +63,7 @@ stdenv.mkDerivation {
];
propagatedBuildInputs = [
camlp-streams
pcre2
(if use_zarith then zarith else num)
];

5
pkgs/build-support/rust/import-cargo-lock.nix
View File

@@ -130,7 +130,10 @@ let
};
registries = {
"https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates";
# Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
# rate limit on the API servers, which currently returns intermittent 403s.
# See https://github.com/rust-lang/crates.io/issues/13482
"https://github.com/rust-lang/crates.io-index" = "https://static.crates.io/crates";
}
// extraRegistries;

202
pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch Normal file
View File

@@ -0,0 +1,202 @@
From 776f2a97d34c2ccfba90c0bcb448de7792edfdb6 Mon Sep 17 00:00:00 2001
From: Alex Gaynor <alex.gaynor@gmail.com>
Date: Wed, 18 Feb 2026 07:46:15 -0500
Subject: [PATCH 1/2] Fix buffer overflow in DTLS cookie generation callback
(#1479)
The cookie generate callback copied user-returned bytes into a
fixed-size native buffer without enforcing a maximum length. A
callback returning more than DTLS1_COOKIE_LENGTH bytes would overflow
the OpenSSL-provided buffer, corrupting adjacent memory.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
src/OpenSSL/SSL.py | 7 +++++++
tests/test_ssl.py | 38 ++++++++++++++++++++++++++++++++++++++
2 files changed, 45 insertions(+)
diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py
index efbf7907e618c912d48352f74fb80a9c19b9b98b..e28e10ab81ade8d79aff0cb9232fa71b1fb5314b 100644
--- a/src/OpenSSL/SSL.py
+++ b/src/OpenSSL/SSL.py
@@ -561,11 +561,18 @@ class _CookieGenerateCallbackHelper(_CallbackExceptionHelper):
def __init__(self, callback):
_CallbackExceptionHelper.__init__(self)
+ max_cookie_len = getattr(_lib, "DTLS1_COOKIE_LENGTH", 255)
+
@wraps(callback)
def wrapper(ssl, out, outlen):
try:
conn = Connection._reverse_mapping[ssl]
cookie = callback(conn)
+ if len(cookie) > max_cookie_len:
+ raise ValueError(
+ f"Cookie too long (got {len(cookie)} bytes, "
+ f"max {max_cookie_len})"
+ )
out[0 : len(cookie)] = cookie
outlen[0] = len(cookie)
return 1
diff --git a/tests/test_ssl.py b/tests/test_ssl.py
index 024436f064ddadbf79a3e6b78e2a9e4aeeee7ac2..5f427e92b48e57276fee7acb5ffdbaf136462cee 100644
--- a/tests/test_ssl.py
+++ b/tests/test_ssl.py
@@ -4497,6 +4497,44 @@ class TestDTLS:
except NotImplementedError: # OpenSSL 1.1.0 and earlier
pass
+ def test_cookie_generate_too_long(self) -> None:
+ s_ctx = Context(DTLS_METHOD)
+
+ def generate_cookie(ssl: Connection) -> bytes:
+ return b"\x00" * 256
+
+ def verify_cookie(ssl: Connection, cookie: bytes) -> bool:
+ return True
+
+ s_ctx.set_cookie_generate_callback(generate_cookie)
+ s_ctx.set_cookie_verify_callback(verify_cookie)
+ s_ctx.use_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem))
+ s_ctx.use_certificate(load_certificate(FILETYPE_PEM, server_cert_pem))
+ s_ctx.set_options(OP_NO_QUERY_MTU)
+ s = Connection(s_ctx)
+ s.set_accept_state()
+
+ c_ctx = Context(DTLS_METHOD)
+ c_ctx.set_options(OP_NO_QUERY_MTU)
+ c = Connection(c_ctx)
+ c.set_connect_state()
+
+ c.set_ciphertext_mtu(1500)
+ s.set_ciphertext_mtu(1500)
+
+ # Client sends ClientHello
+ try:
+ c.do_handshake()
+ except SSL.WantReadError:
+ pass
+ chunk = c.bio_read(self.LARGE_BUFFER)
+ s.bio_write(chunk)
+
+ # Server tries DTLSv1_listen, which triggers cookie generation.
+ # The oversized cookie should raise ValueError.
+ with pytest.raises(ValueError, match="Cookie too long"):
+ s.DTLSv1_listen()
+
def test_timeout(self, monkeypatch):
c_ctx = Context(DTLS_METHOD)
c = Connection(c_ctx)
--
2.53.0
From d39f020cc63c1da4d44be683f310fbc9f44f61bb Mon Sep 17 00:00:00 2001
From: Alex Gaynor <alex.gaynor@gmail.com>
Date: Mon, 16 Feb 2026 21:04:37 -0500
Subject: [PATCH 2/2] Handle exceptions in set_tlsext_servername_callback
callbacks (#1478)
When the servername callback raises an exception, call sys.excepthook
with the exception info and return SSL_TLSEXT_ERR_ALERT_FATAL to abort
the handshake. Previously, exceptions would propagate uncaught through
the CFFI callback boundary.
https://claude.ai/code/session_01P7y1XmWkdtC5UcmZwGDvGi
Co-authored-by: Claude <noreply@anthropic.com>
---
src/OpenSSL/SSL.py | 9 +++++++--
tests/test_ssl.py | 50 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 57 insertions(+), 2 deletions(-)
diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py
index e28e10ab81ade8d79aff0cb9232fa71b1fb5314b..a2d5f5b086b3fe27c6e30848cdd027ee60f69677 100644
--- a/src/OpenSSL/SSL.py
+++ b/src/OpenSSL/SSL.py
@@ -1,5 +1,6 @@
import os
import socket
+import sys
from errno import errorcode
from functools import partial, wraps
from itertools import chain, count
@@ -1444,8 +1445,12 @@ class Context:
"""
@wraps(callback)
- def wrapper(ssl, alert, arg):
- callback(Connection._reverse_mapping[ssl])
+ def wrapper(ssl, alert, arg): # type: ignore[no-untyped-def]
+ try:
+ callback(Connection._reverse_mapping[ssl])
+ except Exception:
+ sys.excepthook(*sys.exc_info())
+ return _lib.SSL_TLSEXT_ERR_ALERT_FATAL
return 0
self._tlsext_servername_callback = _ffi.callback(
diff --git a/tests/test_ssl.py b/tests/test_ssl.py
index 5f427e92b48e57276fee7acb5ffdbaf136462cee..d42beace175c1ea79929050ec6f88faa539ff6b4 100644
--- a/tests/test_ssl.py
+++ b/tests/test_ssl.py
@@ -1854,6 +1854,56 @@ class TestServerNameCallback:
assert args == [(server, b"foo1.example.com")]
+ def test_servername_callback_exception(
+ self, monkeypatch: pytest.MonkeyPatch
+ ) -> None:
+ """
+ When the callback passed to `Context.set_tlsext_servername_callback`
+ raises an exception, ``sys.excepthook`` is called with the exception
+ and the handshake fails with an ``Error``.
+ """
+ exc = TypeError("server name callback failed")
+
+ def servername(conn: Connection) -> None:
+ raise exc
+
+ excepthook_calls: list[
+ tuple[type[BaseException], BaseException, object]
+ ] = []
+
+ def custom_excepthook(
+ exc_type: type[BaseException],
+ exc_value: BaseException,
+ exc_tb: object,
+ ) -> None:
+ excepthook_calls.append((exc_type, exc_value, exc_tb))
+
+ context = Context(SSLv23_METHOD)
+ context.set_tlsext_servername_callback(servername)
+
+ # Necessary to actually accept the connection
+ context.use_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem))
+ context.use_certificate(
+ load_certificate(FILETYPE_PEM, server_cert_pem)
+ )
+
+ # Do a little connection to trigger the logic
+ server = Connection(context, None)
+ server.set_accept_state()
+
+ client = Connection(Context(SSLv23_METHOD), None)
+ client.set_connect_state()
+ client.set_tlsext_host_name(b"foo1.example.com")
+
+ monkeypatch.setattr(sys, "excepthook", custom_excepthook)
+ with pytest.raises(Error):
+ interact_in_memory(server, client)
+
+ assert len(excepthook_calls) == 1
+ assert excepthook_calls[0][0] is TypeError
+ assert excepthook_calls[0][1] is exc
+ assert excepthook_calls[0][2] is not None
+
class TestApplicationLayerProtoNegotiation:
"""
--
2.53.0

4
pkgs/by-name/ce/ceph/package.nix
View File

@@ -282,7 +282,9 @@ let
inherit version;
hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc=";
};
patches = [ ]; # those two CVE patches do not apply (!)
patches = [
./old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch
];
disabledTests = old.disabledTests or [ ] ++ [
"test_export_md5_digest"
];

10
pkgs/by-name/go/google-chrome/package.nix
View File

@@ -178,11 +178,11 @@ let
linux = stdenvNoCC.mkDerivation (finalAttrs: {
inherit pname meta passthru;
version = "148.0.7778.178";
version = "148.0.7778.215";
src = fetchurl {
url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
hash = "sha256-3iuKxcuwt/+BIcUqC715hbeRLhUjepNU1GbB3daIokI=";
hash = "sha256-IyKMotjgwLJ9AKAl+gE86DWd0GCtQoBjvbbvBiYULSQ=";
};
# With strictDeps on, some shebangs were not being patched correctly
@@ -292,11 +292,11 @@ let
darwin = stdenvNoCC.mkDerivation (finalAttrs: {
inherit pname meta passthru;
version = "148.0.7778.179";
version = "148.0.7778.216";
src = fetchurl {
url = "http://dl.google.com/release2/chrome/adxxii2zvsza6zjfnjbfh6fn4tqq_148.0.7778.179/GoogleChrome-148.0.7778.179.dmg";
hash = "sha256-QBHyF222wnaEmI79CQFOXQl5WkRNwneCYd/JFNMEEWU=";
url = "http://dl.google.com/release2/chrome/ac3wy6ujyaf3yzk7hqzmyw4nopha_148.0.7778.216/GoogleChrome-148.0.7778.216.dmg";
hash = "sha256-NauJr7eRVb5q1s38WXijxBAhJ2RryfrrlBc9oBg5HH4=";
};
dontPatch = true;

6
pkgs/by-name/ht/html2pdf/package.nix
View File

@@ -6,6 +6,7 @@
makeWrapper,
chromium,
withChromium ? (lib.meta.availableOn stdenv.hostPlatform chromium),
versionCheckHook,
nix-update-script,
}:
@@ -41,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
''
);
doInstallCheck = true;
nativeInstallCheckInputs = [
versionCheckHook
];
passthru.updateScript = nix-update-script { };
meta = {

4
pkgs/by-name/ja/jackett/package.nix
View File

@@ -12,13 +12,13 @@
buildDotnetModule (finalAttrs: {
pname = "jackett";
version = "0.24.1879";
version = "0.24.1954";
src = fetchFromGitHub {
owner = "jackett";
repo = "jackett";
tag = "v${finalAttrs.version}";
hash = "sha256-gtDN77TB1AKLfqtvFPoQ3tatXB63Ajax2j1gokgHX4s=";
hash = "sha256-HuMK8nW0PRBmRYUYAr3h/hDkVhUGgQIj+7v60ChuKRw=";
};
projectFile = "src/Jackett.Server/Jackett.Server.csproj";

6
pkgs/by-name/kd/kdlfmt/package.nix
View File

@@ -10,16 +10,16 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "kdlfmt";
version = "0.1.6";
version = "0.1.7";
src = fetchFromGitHub {
owner = "hougesen";
repo = "kdlfmt";
tag = "v${finalAttrs.version}";
hash = "sha256-W4a+pPdQv6/XOS3ps1CBCLuspcSAn7FJuvkA5hesvww=";
hash = "sha256-Ftzf4gI7E5tPo8U5ZxUMqlY5+AK5IEUUAll+GsEKYpg=";
};
cargoHash = "sha256-VXg7CVsTuAvXrQNAtzlcJvd24BtS/bQYTGselh4Dzyk=";
cargoHash = "sha256-B/ir+Sf4uxQ9Fqmy6yEa3DMt0qdpfPrwD8lhUMOEUbo=";
nativeBuildInputs = [ installShellFiles ];

8
pkgs/by-name/pr/pretix/package.nix
View File

@@ -3,6 +3,7 @@
buildNpmPackage,
fetchFromGitHub,
fetchPypi,
fetchpatch,
nodejs,
python3,
gettext,
@@ -78,6 +79,13 @@ python.pkgs.buildPythonApplication rec {
# Discover pretix.plugin entrypoints during build and add them into
# INSTALLED_APPS, so that their static files are collected.
./plugin-build.patch
(fetchpatch {
name = "CVE-2026-9712.patch";
url = "https://github.com/pretix/pretix/commit/db520994041964f6ff26917bfc88dfacb2b1b5ea.patch";
excludes = [ "src/pretix/__init__.py" ];
hash = "sha256-NejLY78O+Ahx+dDED+GZ8nY04sxrKWCN5kBlwusyAjw=";
})
];
pythonRelaxDeps = [

4
pkgs/by-name/un/unityhub/package.nix
View File

@@ -11,11 +11,11 @@
stdenv.mkDerivation rec {
pname = "unityhub";
version = "3.16.2";
version = "3.16.3";
src = fetchurl {
url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
hash = "sha256-SvHnIIqNfT2PhyNuKliBl7CsokZE4lrsnbhwtf+1YsA=";
hash = "sha256-Sfgzx2K+38T0v31K4SdtbMS6alAVuOyTS9O89OYjozU=";
};
nativeBuildInputs = [

4
pkgs/servers/samba/4.x.nix
View File

@@ -79,11 +79,11 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "samba";
version = "4.22.6";
version = "4.22.10";
src = fetchurl {
url = "https://download.samba.org/pub/samba/stable/samba-${finalAttrs.version}.tar.gz";
hash = "sha256-jmvrDM6H+zx2OvlMLcIf1HuP0C1Gs8sd6ypy35JZxCU=";
hash = "sha256-5gFDfN5IRaQueBg3nNCtX8T6UYp89ShMwKJlfnmzDDQ=";
};
outputs = [

2
pkgs/top-level/all-packages.nix
View File

@@ -13661,7 +13661,7 @@ with pkgs;
enableUnfree = true;
};
inherit (ocamlPackages) hol_light;
inherit (ocaml-ng.ocamlPackages_5_3) hol_light;
isabelle = callPackage ../by-name/is/isabelle/package.nix {
polyml = polyml.overrideAttrs {

9
pkgs/top-level/perl-packages.nix
View File

@@ -17053,12 +17053,12 @@ with self;
};
};
Imager = buildPerlPackage {
Imager = buildPerlPackage rec {
pname = "Imager";
version = "1.025";
version = "1.031";
src = fetchurl {
url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-1.025.tar.gz";
hash = "sha256-TwJ1y7HgEdfz/sYE3GtgwaxvAt78KYs9A31ur3vqcFg=";
url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE=";
};
buildInputs = [
pkgs.freetype
@@ -17075,6 +17075,7 @@ with self;
"${pkgs.libpng.out}/lib"
];
meta = {
changelog = "https://metacpan.org/release/TONYC/Imager-${version}/source/Changes";
description = "Perl extension for Generating 24 bit Images";
homepage = "http://imager.perl.org";
license = with lib.licenses; [