From 2011838f7660ba21e08baea95b51cb81e864556d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 3 Mar 2026 21:28:40 +0000 Subject: [PATCH 01/13] unityhub: 3.16.2 -> 3.16.3 (cherry picked from commit 9585e8547435be8d062e7aa7755a009fa244773b) --- pkgs/by-name/un/unityhub/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix index d3da001a1040..c0d53248ed53 100644 --- a/pkgs/by-name/un/unityhub/package.nix +++ b/pkgs/by-name/un/unityhub/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation rec { pname = "unityhub"; - version = "3.16.2"; + version = "3.16.3"; src = fetchurl { url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb"; - hash = "sha256-SvHnIIqNfT2PhyNuKliBl7CsokZE4lrsnbhwtf+1YsA="; + hash = "sha256-Sfgzx2K+38T0v31K4SdtbMS6alAVuOyTS9O89OYjozU="; }; nativeBuildInputs = [ From 511547908a428f269868ca0253ea831e9f161f83 Mon Sep 17 00:00:00 2001 From: benaryorg Date: Sat, 23 May 2026 17:44:52 +0000 Subject: [PATCH 02/13] ceph: pyopenssl CVE fixes Belated fixes for some CVEs for the vendored pyopenssl. The Ceph source code directly is very unlikely to use (and in particular misuse) the affected parts of the API. Both `set_cookie_generate_callback` and `set_tlsext_servername_callback` have no actual occurrences in the tarball, so any use would be limited to dependencies, which would be hard to track. The major merge conflicts for backporting have been changes to the changlog which I've simply cut from the diff altogether. Contained should be the fixes and the tests only. Since this version of Ceph is phased out with the ongoing release of 26.05, moving to the new release and thus Ceph Tentacle is the recommended approach anyway, this is sort of a stopgap measure. Not-cherry-picked-because: only applicable to 25.11 Signed-off-by: benaryorg --- ...or-CVE-2026-27459-and-CVE-2026-27448.patch | 202 ++++++++++++++++++ pkgs/by-name/ce/ceph/package.nix | 4 +- 2 files changed, 205 insertions(+), 1 deletion(-) create mode 100644 pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch diff --git a/pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch b/pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch new file mode 100644 index 000000000000..eb1c8e08ed6c --- /dev/null +++ b/pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch @@ -0,0 +1,202 @@ +From 776f2a97d34c2ccfba90c0bcb448de7792edfdb6 Mon Sep 17 00:00:00 2001 +From: Alex Gaynor +Date: Wed, 18 Feb 2026 07:46:15 -0500 +Subject: [PATCH 1/2] Fix buffer overflow in DTLS cookie generation callback + (#1479) + +The cookie generate callback copied user-returned bytes into a +fixed-size native buffer without enforcing a maximum length. A +callback returning more than DTLS1_COOKIE_LENGTH bytes would overflow +the OpenSSL-provided buffer, corrupting adjacent memory. + +Co-authored-by: Claude Opus 4.6 +--- + src/OpenSSL/SSL.py | 7 +++++++ + tests/test_ssl.py | 38 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 45 insertions(+) + +diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py +index efbf7907e618c912d48352f74fb80a9c19b9b98b..e28e10ab81ade8d79aff0cb9232fa71b1fb5314b 100644 +--- a/src/OpenSSL/SSL.py ++++ b/src/OpenSSL/SSL.py +@@ -561,11 +561,18 @@ class _CookieGenerateCallbackHelper(_CallbackExceptionHelper): + def __init__(self, callback): + _CallbackExceptionHelper.__init__(self) + ++ max_cookie_len = getattr(_lib, "DTLS1_COOKIE_LENGTH", 255) ++ + @wraps(callback) + def wrapper(ssl, out, outlen): + try: + conn = Connection._reverse_mapping[ssl] + cookie = callback(conn) ++ if len(cookie) > max_cookie_len: ++ raise ValueError( ++ f"Cookie too long (got {len(cookie)} bytes, " ++ f"max {max_cookie_len})" ++ ) + out[0 : len(cookie)] = cookie + outlen[0] = len(cookie) + return 1 +diff --git a/tests/test_ssl.py b/tests/test_ssl.py +index 024436f064ddadbf79a3e6b78e2a9e4aeeee7ac2..5f427e92b48e57276fee7acb5ffdbaf136462cee 100644 +--- a/tests/test_ssl.py ++++ b/tests/test_ssl.py +@@ -4497,6 +4497,44 @@ class TestDTLS: + except NotImplementedError: # OpenSSL 1.1.0 and earlier + pass + ++ def test_cookie_generate_too_long(self) -> None: ++ s_ctx = Context(DTLS_METHOD) ++ ++ def generate_cookie(ssl: Connection) -> bytes: ++ return b"\x00" * 256 ++ ++ def verify_cookie(ssl: Connection, cookie: bytes) -> bool: ++ return True ++ ++ s_ctx.set_cookie_generate_callback(generate_cookie) ++ s_ctx.set_cookie_verify_callback(verify_cookie) ++ s_ctx.use_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem)) ++ s_ctx.use_certificate(load_certificate(FILETYPE_PEM, server_cert_pem)) ++ s_ctx.set_options(OP_NO_QUERY_MTU) ++ s = Connection(s_ctx) ++ s.set_accept_state() ++ ++ c_ctx = Context(DTLS_METHOD) ++ c_ctx.set_options(OP_NO_QUERY_MTU) ++ c = Connection(c_ctx) ++ c.set_connect_state() ++ ++ c.set_ciphertext_mtu(1500) ++ s.set_ciphertext_mtu(1500) ++ ++ # Client sends ClientHello ++ try: ++ c.do_handshake() ++ except SSL.WantReadError: ++ pass ++ chunk = c.bio_read(self.LARGE_BUFFER) ++ s.bio_write(chunk) ++ ++ # Server tries DTLSv1_listen, which triggers cookie generation. ++ # The oversized cookie should raise ValueError. ++ with pytest.raises(ValueError, match="Cookie too long"): ++ s.DTLSv1_listen() ++ + def test_timeout(self, monkeypatch): + c_ctx = Context(DTLS_METHOD) + c = Connection(c_ctx) +-- +2.53.0 + + +From d39f020cc63c1da4d44be683f310fbc9f44f61bb Mon Sep 17 00:00:00 2001 +From: Alex Gaynor +Date: Mon, 16 Feb 2026 21:04:37 -0500 +Subject: [PATCH 2/2] Handle exceptions in set_tlsext_servername_callback + callbacks (#1478) + +When the servername callback raises an exception, call sys.excepthook +with the exception info and return SSL_TLSEXT_ERR_ALERT_FATAL to abort +the handshake. Previously, exceptions would propagate uncaught through +the CFFI callback boundary. + +https://claude.ai/code/session_01P7y1XmWkdtC5UcmZwGDvGi + +Co-authored-by: Claude +--- + src/OpenSSL/SSL.py | 9 +++++++-- + tests/test_ssl.py | 50 ++++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 57 insertions(+), 2 deletions(-) + +diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py +index e28e10ab81ade8d79aff0cb9232fa71b1fb5314b..a2d5f5b086b3fe27c6e30848cdd027ee60f69677 100644 +--- a/src/OpenSSL/SSL.py ++++ b/src/OpenSSL/SSL.py +@@ -1,5 +1,6 @@ + import os + import socket ++import sys + from errno import errorcode + from functools import partial, wraps + from itertools import chain, count +@@ -1444,8 +1445,12 @@ class Context: + """ + + @wraps(callback) +- def wrapper(ssl, alert, arg): +- callback(Connection._reverse_mapping[ssl]) ++ def wrapper(ssl, alert, arg): # type: ignore[no-untyped-def] ++ try: ++ callback(Connection._reverse_mapping[ssl]) ++ except Exception: ++ sys.excepthook(*sys.exc_info()) ++ return _lib.SSL_TLSEXT_ERR_ALERT_FATAL + return 0 + + self._tlsext_servername_callback = _ffi.callback( +diff --git a/tests/test_ssl.py b/tests/test_ssl.py +index 5f427e92b48e57276fee7acb5ffdbaf136462cee..d42beace175c1ea79929050ec6f88faa539ff6b4 100644 +--- a/tests/test_ssl.py ++++ b/tests/test_ssl.py +@@ -1854,6 +1854,56 @@ class TestServerNameCallback: + + assert args == [(server, b"foo1.example.com")] + ++ def test_servername_callback_exception( ++ self, monkeypatch: pytest.MonkeyPatch ++ ) -> None: ++ """ ++ When the callback passed to `Context.set_tlsext_servername_callback` ++ raises an exception, ``sys.excepthook`` is called with the exception ++ and the handshake fails with an ``Error``. ++ """ ++ exc = TypeError("server name callback failed") ++ ++ def servername(conn: Connection) -> None: ++ raise exc ++ ++ excepthook_calls: list[ ++ tuple[type[BaseException], BaseException, object] ++ ] = [] ++ ++ def custom_excepthook( ++ exc_type: type[BaseException], ++ exc_value: BaseException, ++ exc_tb: object, ++ ) -> None: ++ excepthook_calls.append((exc_type, exc_value, exc_tb)) ++ ++ context = Context(SSLv23_METHOD) ++ context.set_tlsext_servername_callback(servername) ++ ++ # Necessary to actually accept the connection ++ context.use_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem)) ++ context.use_certificate( ++ load_certificate(FILETYPE_PEM, server_cert_pem) ++ ) ++ ++ # Do a little connection to trigger the logic ++ server = Connection(context, None) ++ server.set_accept_state() ++ ++ client = Connection(Context(SSLv23_METHOD), None) ++ client.set_connect_state() ++ client.set_tlsext_host_name(b"foo1.example.com") ++ ++ monkeypatch.setattr(sys, "excepthook", custom_excepthook) ++ with pytest.raises(Error): ++ interact_in_memory(server, client) ++ ++ assert len(excepthook_calls) == 1 ++ assert excepthook_calls[0][0] is TypeError ++ assert excepthook_calls[0][1] is exc ++ assert excepthook_calls[0][2] is not None ++ + + class TestApplicationLayerProtoNegotiation: + """ +-- +2.53.0 + diff --git a/pkgs/by-name/ce/ceph/package.nix b/pkgs/by-name/ce/ceph/package.nix index a39b06cb62a4..fee451951e4d 100644 --- a/pkgs/by-name/ce/ceph/package.nix +++ b/pkgs/by-name/ce/ceph/package.nix @@ -282,7 +282,9 @@ let inherit version; hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc="; }; - patches = [ ]; # those two CVE patches do not apply (!) + patches = [ + ./old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch + ]; disabledTests = old.disabledTests or [ ] ++ [ "test_export_md5_digest" ]; From ad59befbf3703cbd77ed586392f4201701b72873 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 26 May 2026 20:17:50 +0200 Subject: [PATCH 03/13] thunderbird-unwrapped: 150.0.2 -> 151.0.1 https://www.thunderbird.net/en-US/thunderbird/151.0/releasenotes/ https://www.thunderbird.net/en-US/thunderbird/151.0.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2026-50/ Fixes: CVE-2026-8946, CVE-2026-8947, CVE-2026-8948, CVE-2026-8950, CVE-2026-8952, CVE-2026-8953, CVE-2026-8954, CVE-2026-8955, CVE-2026-8956, CVE-2026-8957, CVE-2026-8958, CVE-2026-8960, CVE-2026-8961, CVE-2026-8962, CVE-2026-8963, CVE-2026-8964, CVE-2026-8965, CVE-2026-8966, CVE-2026-8967, CVE-2026-8968, CVE-2026-8969, CVE-2026-8970, CVE-2026-8971, CVE-2026-8972, CVE-2026-8973, CVE-2026-8974, CVE-2026-8975 (cherry picked from commit 6327c2998490e1f697df9515a0fc51c6c17966bb) --- .../networking/mailreaders/thunderbird/packages.nix | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix index e8a2b74c4156..8a78d99b79c8 100644 --- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix +++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix @@ -30,11 +30,12 @@ let (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch) ]; # FIXME: let's hope that upstream will fix this soon and we can drop this hack again. - # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630 + # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877 extraPostPatch = - lib.optionalString (lib.versionAtLeast version "147" && lib.versionOlder version "149") + lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152") '' - find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i + echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt + echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt ''; meta = { @@ -73,8 +74,8 @@ rec { thunderbird = thunderbird-latest; thunderbird-latest = common { - version = "150.0.2"; - sha512 = "3e52220ff34aa6cd1bf46a910dba1f30d0abf7d19ed7f501ffeeb8f5901b8d97fdc0adb0cceb434ef8e83c7f7b83f28024b872280237af72ff2da9d89fafe065"; + version = "151.0.1"; + sha512 = "a09c1e18faa8d7fdccf39e905542c21e817230e68c7cc6050beec048d0fec0f8eb92e51278d2ccd8d8cfa842762662235517e20238b555a4ad48ee5648dc3589"; updateScript = callPackage ./update.nix { attrPath = "thunderbirdPackages.thunderbird-latest"; From 532adf42f44e05680997ff65a0e270719724bb1e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 26 May 2026 20:59:54 +0000 Subject: [PATCH 04/13] kdlfmt: 0.1.6 -> 0.1.7 (cherry picked from commit dd5e5a35e8f9e77f8cbb5b0ef60bc771445a3399) --- pkgs/by-name/kd/kdlfmt/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/kd/kdlfmt/package.nix b/pkgs/by-name/kd/kdlfmt/package.nix index cae9a3ff470e..ca955b6792e9 100644 --- a/pkgs/by-name/kd/kdlfmt/package.nix +++ b/pkgs/by-name/kd/kdlfmt/package.nix @@ -10,16 +10,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "kdlfmt"; - version = "0.1.6"; + version = "0.1.7"; src = fetchFromGitHub { owner = "hougesen"; repo = "kdlfmt"; tag = "v${finalAttrs.version}"; - hash = "sha256-W4a+pPdQv6/XOS3ps1CBCLuspcSAn7FJuvkA5hesvww="; + hash = "sha256-Ftzf4gI7E5tPo8U5ZxUMqlY5+AK5IEUUAll+GsEKYpg="; }; - cargoHash = "sha256-VXg7CVsTuAvXrQNAtzlcJvd24BtS/bQYTGselh4Dzyk="; + cargoHash = "sha256-B/ir+Sf4uxQ9Fqmy6yEa3DMt0qdpfPrwD8lhUMOEUbo="; nativeBuildInputs = [ installShellFiles ]; From 8bcdbf752982aa1ef6cd4aa32bb3634e0d0ab976 Mon Sep 17 00:00:00 2001 From: Vincent Laporte Date: Mon, 11 May 2026 08:33:49 +0200 Subject: [PATCH 05/13] hol_light: fix (cherry picked from commit 823a2a5430b9dd2ab9a5febca9ef1fbea8524bf9) --- pkgs/applications/science/logic/hol_light/default.nix | 3 +++ pkgs/top-level/all-packages.nix | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/science/logic/hol_light/default.nix b/pkgs/applications/science/logic/hol_light/default.nix index ac908ab9f8ab..4bbbb2677297 100644 --- a/pkgs/applications/science/logic/hol_light/default.nix +++ b/pkgs/applications/science/logic/hol_light/default.nix @@ -9,6 +9,7 @@ zarith, camlp5, camlp-streams, + pcre2, }: let @@ -18,6 +19,7 @@ let '' -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \ -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \ + -I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \ '' else lib.optionalString (num != null) '' @@ -61,6 +63,7 @@ stdenv.mkDerivation { ]; propagatedBuildInputs = [ camlp-streams + pcre2 (if use_zarith then zarith else num) ]; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 34a6493fe46e..dfa56dfa88b4 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -13661,7 +13661,7 @@ with pkgs; enableUnfree = true; }; - inherit (ocamlPackages) hol_light; + inherit (ocaml-ng.ocamlPackages_5_3) hol_light; isabelle = callPackage ../by-name/is/isabelle/package.nix { polyml = polyml.overrideAttrs { From fe6a949cd0403b5f86dbb1c75bbfc2842ee1fc95 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 26 May 2026 19:55:27 +0000 Subject: [PATCH 06/13] jackett: 0.24.1879 -> 0.24.1954 (cherry picked from commit 629f87d2bdc6b45a5820c9447b10b8746fe9572d) --- pkgs/by-name/ja/jackett/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix index 80a9a287fb09..1bb0694ff6d9 100644 --- a/pkgs/by-name/ja/jackett/package.nix +++ b/pkgs/by-name/ja/jackett/package.nix @@ -12,13 +12,13 @@ buildDotnetModule (finalAttrs: { pname = "jackett"; - version = "0.24.1879"; + version = "0.24.1954"; src = fetchFromGitHub { owner = "jackett"; repo = "jackett"; tag = "v${finalAttrs.version}"; - hash = "sha256-gtDN77TB1AKLfqtvFPoQ3tatXB63Ajax2j1gokgHX4s="; + hash = "sha256-HuMK8nW0PRBmRYUYAr3h/hDkVhUGgQIj+7v60ChuKRw="; }; projectFile = "src/Jackett.Server/Jackett.Server.csproj"; From ac6e1fae6eedd009542cbd86f77e22e37d1ee37a Mon Sep 17 00:00:00 2001 From: K900 Date: Wed, 27 May 2026 13:15:06 +0300 Subject: [PATCH 07/13] firefox/wrapper: better way to disable update checks See https://bugzilla.mozilla.org/show_bug.cgi?id=2042197 (cherry picked from commit 1da3ca73732263dc0473f0d64ccdfa810eaa1fac) --- .../networking/browsers/firefox/wrapper.nix | 55 ++++++++++--------- 1 file changed, 28 insertions(+), 27 deletions(-) diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index f705dd20cb79..16e74e73529c 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -149,36 +149,34 @@ let ) (lib.optionals usesNixExtensions nixExtensions); enterprisePolicies = { - policies = { - DisableAppUpdate = true; - } - // lib.optionalAttrs usesNixExtensions { - ExtensionSettings = { - "*" = { - blocked_install_message = "You can't have manual extension mixed with nix extensions"; - installation_mode = "blocked"; - }; - } - // lib.foldr ( - e: ret: - ret - // { - "${e.extid}" = { - installation_mode = "allowed"; + policies = + lib.optionalAttrs usesNixExtensions { + ExtensionSettings = { + "*" = { + blocked_install_message = "You can't have manual extension mixed with nix extensions"; + installation_mode = "blocked"; }; } - ) { } extensions; + // lib.foldr ( + e: ret: + ret + // { + "${e.extid}" = { + installation_mode = "allowed"; + }; + } + ) { } extensions; - Extensions = { - Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions; - }; - } - // lib.optionalAttrs smartcardSupport { - SecurityDevices = { - "OpenSC PKCS#11 Module" = "opensc-pkcs11.so"; - }; - } - // extraPolicies; + Extensions = { + Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions; + }; + } + // lib.optionalAttrs smartcardSupport { + SecurityDevices = { + "OpenSC PKCS#11 Module" = "opensc-pkcs11.so"; + }; + } + // extraPolicies; }; mozillaCfg = '' @@ -397,6 +395,9 @@ let ln -sfT "$target" "$out/$l" done + # Disable update checks + touch $out/${libDir}/is-packaged-app + cd "$out" '' From 3f11b9c0099fca599108bf68c2e4d6e5da3c4044 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 24 May 2026 10:36:29 -0700 Subject: [PATCH 08/13] perlPackages.Imager: 1.025 -> 1.031 Changelog: https://metacpan.org/release/TONYC/Imager-1.031/source/Changes (cherry picked from commit 8c5161adf0c7a915a3234ddc68e1e8fb7139f08b) --- pkgs/top-level/perl-packages.nix | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 32ecbb4d35ea..a12872f671c8 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -17053,12 +17053,12 @@ with self; }; }; - Imager = buildPerlPackage { + Imager = buildPerlPackage rec { pname = "Imager"; - version = "1.025"; + version = "1.031"; src = fetchurl { - url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-1.025.tar.gz"; - hash = "sha256-TwJ1y7HgEdfz/sYE3GtgwaxvAt78KYs9A31ur3vqcFg="; + url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz"; + hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE="; }; buildInputs = [ pkgs.freetype @@ -17075,6 +17075,7 @@ with self; "${pkgs.libpng.out}/lib" ]; meta = { + changelog = "https://metacpan.org/release/TONYC/Imager-${version}/source/Changes"; description = "Perl extension for Generating 24 bit Images"; homepage = "http://imager.perl.org"; license = with lib.licenses; [ From dec6653a779854e111cb1848d00d8d3e8c5b3ee0 Mon Sep 17 00:00:00 2001 From: Kenichi Kamiya Date: Mon, 25 May 2026 12:12:28 +0900 Subject: [PATCH 09/13] html2pdf: add versionCheckHook version flag is available in 0.8.3: https://github.com/ilaborie/html2pdf/commit/4886ded651458f8331898e81ed5ce5f2a94f957f (cherry picked from commit 8c7c19f27a69b29e26a5736cfb372c471f18c6bc) --- pkgs/by-name/ht/html2pdf/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/ht/html2pdf/package.nix b/pkgs/by-name/ht/html2pdf/package.nix index 3b92226b4059..273364ddd29e 100644 --- a/pkgs/by-name/ht/html2pdf/package.nix +++ b/pkgs/by-name/ht/html2pdf/package.nix @@ -6,6 +6,7 @@ makeWrapper, chromium, withChromium ? (lib.meta.availableOn stdenv.hostPlatform chromium), + versionCheckHook, nix-update-script, }: @@ -41,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: { '' ); + doInstallCheck = true; + nativeInstallCheckInputs = [ + versionCheckHook + ]; + passthru.updateScript = nix-update-script { }; meta = { From 72e4093b080144a6179e5466f5271b9288162bc5 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 27 May 2026 21:16:47 +0200 Subject: [PATCH 10/13] pretix: patch CVE-2026-9712 https://pretix.eu/about/en/blog/20260527-release-2026-4-2/ --- pkgs/by-name/pr/pretix/package.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix index ade92ce1e33c..996fdccd9c3f 100644 --- a/pkgs/by-name/pr/pretix/package.nix +++ b/pkgs/by-name/pr/pretix/package.nix @@ -3,6 +3,7 @@ buildNpmPackage, fetchFromGitHub, fetchPypi, + fetchpatch, nodejs, python3, gettext, @@ -78,6 +79,13 @@ python.pkgs.buildPythonApplication rec { # Discover pretix.plugin entrypoints during build and add them into # INSTALLED_APPS, so that their static files are collected. ./plugin-build.patch + + (fetchpatch { + name = "CVE-2026-9712.patch"; + url = "https://github.com/pretix/pretix/commit/db520994041964f6ff26917bfc88dfacb2b1b5ea.patch"; + excludes = [ "src/pretix/__init__.py" ]; + hash = "sha256-NejLY78O+Ahx+dDED+GZ8nY04sxrKWCN5kBlwusyAjw="; + }) ]; pythonRelaxDeps = [ From 7218b613880cacd6a1a33c9516fb8d85267c1512 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Wed, 27 May 2026 12:47:02 -0700 Subject: [PATCH 11/13] rustPlatform.importCargoLock: download crates from static.crates.io The crates.io API server's 1 req/sec rate limit currently surfaces as intermittent HTTP 403 errors when vendoring lockfiles. Switch to the CDN endpoint as recommended by upstream (rust-lang/crates.io#13482), mirroring the fix already applied to fetchCargoVendor in #512735. fetchurl is content-addressed by sha256, so the URL change does not affect any downstream store paths. Fixes #524979 (cherry picked from commit f830e6112b4dbdb98cb7668cd291ea07ffc288e8) --- pkgs/build-support/rust/import-cargo-lock.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/build-support/rust/import-cargo-lock.nix b/pkgs/build-support/rust/import-cargo-lock.nix index a3cd9b825ffc..80815a179e47 100644 --- a/pkgs/build-support/rust/import-cargo-lock.nix +++ b/pkgs/build-support/rust/import-cargo-lock.nix @@ -130,7 +130,10 @@ let }; registries = { - "https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates"; + # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec + # rate limit on the API servers, which currently returns intermittent 403s. + # See https://github.com/rust-lang/crates.io/issues/13482 + "https://github.com/rust-lang/crates.io-index" = "https://static.crates.io/crates"; } // extraRegistries; From 287d3dc160f9cab054ddf401dc93c9e193a9f9e5 Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Wed, 27 May 2026 17:45:54 -0400 Subject: [PATCH 12/13] google-chrome: 148.0.7778.178 -> 148.0.7778.215 (cherry picked from commit 2c044ef431ad5794a6cc4ab1a3b7cbc46c679d5f) --- pkgs/by-name/go/google-chrome/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix index ae53d5e834c8..43c7e90c632e 100644 --- a/pkgs/by-name/go/google-chrome/package.nix +++ b/pkgs/by-name/go/google-chrome/package.nix @@ -178,11 +178,11 @@ let linux = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "148.0.7778.178"; + version = "148.0.7778.215"; src = fetchurl { url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb"; - hash = "sha256-3iuKxcuwt/+BIcUqC715hbeRLhUjepNU1GbB3daIokI="; + hash = "sha256-IyKMotjgwLJ9AKAl+gE86DWd0GCtQoBjvbbvBiYULSQ="; }; # With strictDeps on, some shebangs were not being patched correctly @@ -292,11 +292,11 @@ let darwin = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "148.0.7778.179"; + version = "148.0.7778.216"; src = fetchurl { - url = "http://dl.google.com/release2/chrome/adxxii2zvsza6zjfnjbfh6fn4tqq_148.0.7778.179/GoogleChrome-148.0.7778.179.dmg"; - hash = "sha256-QBHyF222wnaEmI79CQFOXQl5WkRNwneCYd/JFNMEEWU="; + url = "http://dl.google.com/release2/chrome/ac3wy6ujyaf3yzk7hqzmyw4nopha_148.0.7778.216/GoogleChrome-148.0.7778.216.dmg"; + hash = "sha256-NauJr7eRVb5q1s38WXijxBAhJ2RryfrrlBc9oBg5HH4="; }; dontPatch = true; From 11c8668ea44c1f496dfcc8f369bdaf62d70e430e Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 28 May 2026 00:39:42 +0200 Subject: [PATCH 13/13] samba: 4.22.6 -> 4.22.10 https://www.samba.org/samba/history/samba-4.22.7.html https://www.samba.org/samba/history/samba-4.22.8.html https://www.samba.org/samba/history/samba-4.22.9.html https://www.samba.org/samba/history/samba-4.22.10.html Fixes: CVE-2026-1933, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238, CVE-2026-4408, CVE-2026-4480 --- pkgs/servers/samba/4.x.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix index 502dff10a6f9..6a396c0a90d4 100644 --- a/pkgs/servers/samba/4.x.nix +++ b/pkgs/servers/samba/4.x.nix @@ -79,11 +79,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "samba"; - version = "4.22.6"; + version = "4.22.10"; src = fetchurl { url = "https://download.samba.org/pub/samba/stable/samba-${finalAttrs.version}.tar.gz"; - hash = "sha256-jmvrDM6H+zx2OvlMLcIf1HuP0C1Gs8sd6ypy35JZxCU="; + hash = "sha256-5gFDfN5IRaQueBg3nNCtX8T6UYp89ShMwKJlfnmzDDQ="; }; outputs = [