diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix index df6b082a92bc..c4052964cd91 100644 --- a/pkgs/by-name/ca/cacert/package.nix +++ b/pkgs/by-name/ca/cacert/package.nix @@ -20,7 +20,7 @@ let lib.concatStringsSep "\n\n" extraCertificateStrings ); - version = "3.125"; + version = "3.126"; meta = { homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers"; description = "Bundle of X.509 certificates of public Certificate Authorities (CA)"; @@ -52,7 +52,7 @@ stdenv.mkDerivation { "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}" "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}" ]; - hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0="; + hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg="; }; unpackPhase = '' diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix index 401df7d6762b..9c86d318fa57 100644 --- a/pkgs/by-name/du/duckdb/package.nix +++ b/pkgs/by-name/du/duckdb/package.nix @@ -152,11 +152,12 @@ stdenv.mkDerivation (finalAttrs: { ); LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH"; in + # FIXME: do something about the excessive logging on x86_64-linux (> 250 MiB). '' runHook preInstallCheck (($(ulimit -n) < 1024)) && ulimit -n 1024 - HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes} + HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null"} runHook postInstallCheck ''; diff --git a/pkgs/by-name/gd/gdal/package.nix b/pkgs/by-name/gd/gdal/package.nix index 208ad867955f..7a0b90e22c44 100644 --- a/pkgs/by-name/gd/gdal/package.nix +++ b/pkgs/by-name/gd/gdal/package.nix @@ -116,6 +116,24 @@ stdenv.mkDerivation (finalAttrs: { url = "https://github.com/OSGeo/gdal/commit/7b8b8de28bbd200b0fd3b09147fdc68b5bf5ce20.patch"; hash = "sha256-BxWMpiUwM3h7Vo9vxJ4H4A8aQfE3jcSRfRYwaLw/60w="; }) + + # Fix stack buffer overflow in netCDF driver + # https://github.com/OSGeo/gdal/issues/14594 + (fetchpatch { + name = "0005-netcdf-avoid-reading-attributes-without-checking-length.patch"; + url = "https://github.com/OSGeo/gdal/commit/50eea7456d83c9586f112ef96b43249372839dea.patch"; + hash = "sha256-m1FsBC37h2uuaEeYezPZJFsDR6Ix/FDIZnuZZiSAYcw="; + }) + + # Fix tests with libtiff 4.7.2 + # FAILED gcore/tiff_read.py::test_tiff_read_stripbytecounts_count_not_same_as_stripoffsets_count - + # AssertionError: assert '170' is None + (fetchpatch { + name = "0006-Internal-libtiff-resync-with-4.7.2rc3-and-adjust-tes.patch"; + url = "https://github.com/OSGeo/gdal/commit/06ffb0333fe557cde262aa1e81466dda42684c53.patch"; + hash = "sha256-teZ9cv8JQ2ua4tEWl3I8D9DYo8srGIBYIc2NfkgNMe4="; + includes = [ "autotest/gcore/tiff_read.py" ]; + }) ]; nativeBuildInputs = [ diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix index 0869a82c1d16..3ccee9419fc5 100644 --- a/pkgs/by-name/li/libffiReal/package.nix +++ b/pkgs/by-name/li/libffiReal/package.nix @@ -13,13 +13,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libffi"; - version = "3.5.2"; + version = "3.7.0"; src = fetchurl { url = with finalAttrs; "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz"; - hash = "sha256-86MIKiOzfCk6T80QUxR7Nx8v+R+n6hsqUuM1Z2usgtw="; + hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY="; }; # Note: this package is used for bootstrapping fetchurl, and thus @@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: { ./freebsd-tsan-pthread.patch ]; + # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file: + postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c"; + strictDeps = true; outputs = [ "out" diff --git a/pkgs/by-name/li/libmysofa/package.nix b/pkgs/by-name/li/libmysofa/package.nix index b32265cc07a7..ae140ada101d 100644 --- a/pkgs/by-name/li/libmysofa/package.nix +++ b/pkgs/by-name/li/libmysofa/package.nix @@ -8,13 +8,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libmysofa"; - version = "1.3.3"; + version = "1.3.4"; src = fetchFromGitHub { owner = "hoene"; repo = "libmysofa"; rev = "v${finalAttrs.version}"; - hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc="; + hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ="; }; outputs = [ diff --git a/pkgs/by-name/li/libseccomp/package.nix b/pkgs/by-name/li/libseccomp/package.nix index 222bda60e16a..64677eb94051 100644 --- a/pkgs/by-name/li/libseccomp/package.nix +++ b/pkgs/by-name/li/libseccomp/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch, getopt, util-linuxMinimal, which, @@ -13,31 +12,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libseccomp"; - version = "2.6.0"; + version = "2.6.1"; src = fetchurl { url = "https://github.com/seccomp/libseccomp/releases/download/v${finalAttrs.version}/libseccomp-${finalAttrs.version}.tar.gz"; - hash = "sha256-g7YIUjLRWIw3ncm5yuR7s3QHzyYubnSZPGG6ctKnhNw="; + hash = "sha256-UB9mxmciXVN5G5fh18+Fq3ZMKX0EiB9g849FHEsO4b4="; }; - patches = [ - # Remove when version > 2.6.0 - # Fixes test failures on big-endian archs - (fetchpatch { - name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch"; - url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch"; - hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw="; - }) - - # Remove when version > 2.6.0 - # Fixes OOB reads & tests on musl - (fetchpatch { - name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch"; - url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch"; - hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY="; - }) - ]; - outputs = [ "out" "lib" diff --git a/pkgs/by-name/li/libtiff/package.nix b/pkgs/by-name/li/libtiff/package.nix index 3b6ba2345148..ed35ef461bf8 100644 --- a/pkgs/by-name/li/libtiff/package.nix +++ b/pkgs/by-name/li/libtiff/package.nix @@ -37,13 +37,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libtiff"; - version = "4.7.1"; + version = "4.7.2"; src = fetchFromGitLab { owner = "libtiff"; repo = "libtiff"; rev = "v${finalAttrs.version}"; - hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI="; + hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA="; }; patches = [ diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix index ad04029c4b80..75cb3cc49134 100644 --- a/pkgs/by-name/tz/tzdata/package.nix +++ b/pkgs/by-name/tz/tzdata/package.nix @@ -8,16 +8,16 @@ stdenv.mkDerivation (finalAttrs: { pname = "tzdata"; - version = "2026b"; + version = "2026c"; srcs = [ (fetchurl { url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz"; - hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ="; + hash = "sha256-5KF4pEd/PQ6nfMMYKP9yqjj+/41hqhPn6Z4ULp2QK+Q="; }) (fetchurl { url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz"; - hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q="; + hash = "sha256-sc/8Os5MTHzQ77ovet2G7D0LedpIvPA1gmcf08j+rOg="; }) ]; diff --git a/pkgs/by-name/uv/uvwasi/package.nix b/pkgs/by-name/uv/uvwasi/package.nix index 8d48132e945e..5194fdc7ab07 100644 --- a/pkgs/by-name/uv/uvwasi/package.nix +++ b/pkgs/by-name/uv/uvwasi/package.nix @@ -8,6 +8,7 @@ stdenv, testers, validatePkgConfig, + static ? stdenv.hostPlatform.isStatic, # generates static libraries *only* }: stdenv.mkDerivation (finalAttrs: { @@ -21,6 +22,20 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-+vz/qTMRRDHV1VE4nny9vYYtarZHk1xoM4EZiah3jnY="; }; + patches = [ + # FIXME: remove when included in a release + (fetchpatch2 { + url = "https://github.com/nodejs/uvwasi/commit/0820128569533c855d60c0f6382acbb14aa62ad2.patch?full_index=1"; + hash = "sha256-psjivoarqisOuCdVJAWuFH0aITzwb/obmal3ewVXvG4="; + }) + ]; + postPatch = lib.optionalString static '' + substituteInPlace CMakeLists.txt --replace-fail 'TARGETS uvwasi_a uvwasi' 'TARGETS uvwasi_a' + ''; + cmakeFlags = [ + (lib.cmakeBool "UVWASI_BUILD_SHARED" (!static)) + ]; + outputs = [ "out" ]; diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix index 17cc2e9418ca..934fade5a795 100644 --- a/pkgs/by-name/xv/xvfb/package.nix +++ b/pkgs/by-name/xv/xvfb/package.nix @@ -38,14 +38,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "xvfb"; - # TODO: commented out for rebuild avoidance after xorg-server update. revert - # on staging. - # inherit (xorg-server) src version; - version = "21.1.23"; - src = fetchurl { - url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz"; - hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ="; - }; + inherit (xorg-server) src version; strictDeps = true; diff --git a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch new file mode 100644 index 000000000000..5e55d1242bb4 --- /dev/null +++ b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch @@ -0,0 +1,69 @@ +From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 19 Jun 2026 18:22:20 +0200 +Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf + +This makes the output more consistent (either failure or complete +output) and helps with systematic testing with varying buffer +sizes. + +Reviewed-by: Carlos O'Donell +Reviewed-by: Adhemerval Zanella +(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a) +--- + resolv/ns_print.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index cef2212fd2..cb680fb74e 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + switch (type) { + case ns_t_a: + if (rdlen != (size_t)NS_INADDRSZ) +- goto formerr; +- (void) inet_ntop(AF_INET, rdata, buf, buflen); ++ goto formerr; ++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + break; + +@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + } + + case ns_t_aaaa: +- if (rdlen != (size_t)NS_IN6ADDRSZ) +- goto formerr; +- (void) inet_ntop(AF_INET6, rdata, buf, buflen); ++ if (rdlen != (size_t)NS_IN6ADDRSZ) ++ goto formerr; ++ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + break; + +@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + goto formerr; + + /* Address. */ +- (void) inet_ntop(AF_INET, rdata, buf, buflen); ++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + rdata += NS_INADDRSZ; + +@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + if (rdata + pbyte >= edata) goto formerr; + memset(&a, 0, sizeof(a)); + memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); +- (void) inet_ntop(AF_INET6, &a, buf, buflen); ++ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + rdata += sizeof(a) - pbyte; + } +-- +2.54.0 + diff --git a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch new file mode 100644 index 000000000000..5b39165a43b0 --- /dev/null +++ b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch @@ -0,0 +1,134 @@ +From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 19 Jun 2026 18:22:20 +0200 +Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf + (CVE-2026-5435) + +Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy +implementations of TSIG, fixing bug 34033, and partially +fixing bug 34069. + +Reviewed-by: Carlos O'Donell +Reviewed-by: Adhemerval Zanella +(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72) +--- + resolv/ns_print.c | 96 ----------------------------------------------- + 1 file changed, 96 deletions(-) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index cb680fb74e..8c876b147e 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + break; + } + +- case ns_t_cert: { +- u_int c_type, key_tag, alg; +- int n; +- unsigned int siz; +- char base64_cert[8192], tmp[40]; +- const char *leader; +- +- c_type = ns_get16(rdata); rdata += NS_INT16SZ; +- key_tag = ns_get16(rdata); rdata += NS_INT16SZ; +- alg = (u_int) *rdata++; +- +- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg)); +- T(addstr(tmp, len, &buf, &buflen)); +- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */ +- if (siz > sizeof(base64_cert) * 3/4) { +- const char *str = "record too long to print"; +- T(addstr(str, strlen(str), &buf, &buflen)); +- } +- else { +- len = b64_ntop(rdata, edata-rdata, base64_cert, siz); +- +- if (len < 0) +- goto formerr; +- else if (len > 15) { +- T(addstr(" (", 2, &buf, &buflen)); +- leader = "\n\t\t"; +- spaced = 0; +- } +- else +- leader = " "; +- +- for (n = 0; n < len; n += 48) { +- T(addstr(leader, strlen(leader), +- &buf, &buflen)); +- T(addstr(base64_cert + n, MIN(len - n, 48), +- &buf, &buflen)); +- } +- if (len > 15) +- T(addstr(" )", 2, &buf, &buflen)); +- } +- break; +- } +- +- case ns_t_tkey: { +- /* KJD - need to complete this */ +- u_long t; +- int mode, err, keysize; +- +- /* Algorithm name. */ +- T(addname(msg, msglen, &rdata, origin, &buf, &buflen)); +- T(addstr(" ", 1, &buf, &buflen)); +- +- /* Inception. */ +- t = ns_get32(rdata); rdata += NS_INT32SZ; +- len = SPRINTF((tmp, "%lu ", t)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* Expiration. */ +- t = ns_get32(rdata); rdata += NS_INT32SZ; +- len = SPRINTF((tmp, "%lu ", t)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* Mode , Error, Key Size. */ +- /* Priority, Weight, Port. */ +- mode = ns_get16(rdata); rdata += NS_INT16SZ; +- err = ns_get16(rdata); rdata += NS_INT16SZ; +- keysize = ns_get16(rdata); rdata += NS_INT16SZ; +- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* XXX need to dump key, print otherdata length & other data */ +- break; +- } +- +- case ns_t_tsig: { +- /* BEW - need to complete this */ +- int n; +- +- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen)); +- T(addstr(" ", 1, &buf, &buflen)); +- rdata += 8; /*%< time */ +- n = ns_get16(rdata); rdata += INT16SZ; +- rdata += n; /*%< sig */ +- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */ +- sprintf(buf, "%d", ns_get16(rdata)); +- rdata += INT16SZ; +- addlen(strlen(buf), &buf, &buflen); +- break; +- } +- + case ns_t_a6: { + struct in6_addr a; + int pbyte, pbit; +@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + break; + } + +- case ns_t_opt: { +- len = SPRINTF((tmp, "%u bytes", class)); +- T(addstr(tmp, len, &buf, &buflen)); +- break; +- } +- + default: + snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type); + comment = errbuf; +-- +2.54.0 + diff --git a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch new file mode 100644 index 000000000000..8bde49f159e0 --- /dev/null +++ b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch @@ -0,0 +1,66 @@ +From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 19 Jun 2026 18:22:20 +0200 +Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf + (CVE-2026-6238) + +Check that the RDATA payload does not require more than RDATALEN +bytes while processing it. The fixes cover A6, LOC records. +(CERT, TKEY, TSIG were fixed before, by switching to the generic +formatter.) + +The vulnerable LOC record handling was first introduced before +glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. + +CERT, TSIG, TKEY handling came with commit +b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. + +A6 record handling was introduced in commit +91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c +(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc +2.7. + +This fixes bug 34069. + +Reviewed-by: Carlos O'Donell +Reviewed-by: Adhemerval Zanella +(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a) +--- + resolv/ns_print.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index 8c876b147e..6832255a25 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + case ns_t_loc: { + char t[255]; + +- /* XXX protocol format checking? */ ++ if (rdlen != 16) ++ goto formerr; + (void) loc_ntoa(rdata, t); + T(addstr(t, strlen(t), &buf, &buflen)); + break; +@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + + /* address suffix: provided only when prefix len != 128 */ + if (pbit < 128) { +- if (rdata + pbyte >= edata) goto formerr; ++ unsigned int bytelen = sizeof(a) - pbyte; ++ if (edata - rdata < bytelen) goto formerr; + memset(&a, 0, sizeof(a)); +- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); ++ memcpy(&a.s6_addr[pbyte], rdata, bytelen); + if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) + return -1; + addlen(strlen(buf), &buf, &buflen); +- rdata += sizeof(a) - pbyte; ++ rdata += bytelen; + } + + /* prefix name: provided only when prefix len > 0 */ +-- +2.54.0 + diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index b6c6a6c86445..577682f7cd96 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -116,6 +116,15 @@ stdenv.mkDerivation ( # enable parallel & reproducible build of glibcLocales ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch ./0002-Makeconfig-make-inst_complocaledir-overridable.patch + + # Security fixes. + # + # Can be dropped on 2.44. The first patch is only to make it + # easier to backport the fix for CVE-2026-6238 and it seems + # useful in its own right anyhow. + ./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch + ./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch + ./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch ] /* NVCC does not support ARM intrinsics. Since is pulled in by almost diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix index 9c531daf1486..b40675d820b4 100644 --- a/pkgs/development/libraries/gstreamer/good/default.nix +++ b/pkgs/development/libraries/gstreamer/good/default.nix @@ -95,6 +95,26 @@ stdenv.mkDerivation (finalAttrs: { (replaceVars ./souploader.diff { nixLibSoup3Path = "${lib.getLib libsoup_3}/lib"; }) + # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11262 + (fetchpatch { + name = "GStreamer-SA-2026-0021-1.patch"; + url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/35a905a92f4cfc85941c6c820009ac9219f755b2.patch"; + sha256 = "sha256-1SgQo+wb2Adcgrz3zn6/qn248vnBdPuk2oJ1v9+Dbzo="; + stripLen = 2; + }) + (fetchpatch { + name = "GStreamer-SA-2026-0021-2.patch"; + url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0d819ceb654b06bbdd54381da5363c16751758a2.patch"; + sha256 = "sha256-a8P1YxLNMkYka01+8MhBO+uSzGbR186sumlQk5LuGfY="; + stripLen = 2; + }) + # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11263 + (fetchpatch { + name = "GStreamer-SA-2026-0022.patch"; + url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6db6dd058ebc3607452311b7dc47b0359b40b293.patch"; + sha256 = "sha256-gaBUpEdZB0PrnI1IR53jtM0kecHpUIzavUdADN1NNlQ="; + stripLen = 2; + }) ]; strictDeps = true; diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix index b5ed5a969db7..40ae39918d8c 100644 --- a/pkgs/development/libraries/silgraphite/graphite2.nix +++ b/pkgs/development/libraries/silgraphite/graphite2.nix @@ -2,7 +2,7 @@ lib, stdenv, llvmPackages, - fetchpatch, + python3, fetchurl, pkg-config, freetype, @@ -12,14 +12,14 @@ }: stdenv.mkDerivation (finalAttrs: { - version = "1.3.14"; + version = "1.3.15"; pname = "graphite2"; src = fetchurl { url = with finalAttrs; "https://github.com/silnrsi/graphite/releases/download/${version}/${pname}-${version}.tgz"; - sha256 = "1790ajyhk0ax8xxamnrk176gc9gvhadzy78qia4rd8jzm89ir7gr"; + hash = "sha256-xryLQlJyRmUpf3ytDFWJcoXGc/m45ts1IqzoM1k/4LE="; }; outputs = [ @@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ pkg-config + (python3.withPackages (ps: [ ps.fonttools ])) cmake ]; buildInputs = [ @@ -40,14 +41,7 @@ stdenv.mkDerivation (finalAttrs: { } ); - patches = [ - # Fix build with gcc15 - (fetchpatch { - url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch"; - hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw="; - }) - ] - ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ]; + patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ]; postPatch = '' # disable broken 'nametabletest' test, fails on gcc-13: # https://github.com/silnrsi/graphite/pull/74 @@ -61,22 +55,6 @@ stdenv.mkDerivation (finalAttrs: { # headers are located in the dev output: substituteInPlace CMakeLists.txt \ --replace-fail ' ''${CMAKE_INSTALL_PREFIX}/include' " ${placeholder "dev"}/include" - - # Fix the build with CMake 4. - # - # See: - badCmakeFiles=( - CMakeLists.txt - src/CMakeLists.txt - tests/{bittwiddling,json,sparsetest,utftest}/CMakeLists.txt - gr2fonttest/CMakeLists.txt - ) - for file in "''${badCmakeFiles[@]}"; do - substituteInPlace "$file" \ - --replace-fail \ - 'CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0 FATAL_ERROR)' \ - 'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)' - done ''; cmakeFlags = lib.optionals static [ diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix index 2cbdfd2fa593..87d2946e6160 100644 --- a/pkgs/tools/text/gawk/default.nix +++ b/pkgs/tools/text/gawk/default.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchurl, + fetchpatch, removeReferencesTo, runtimeShellPackage, texinfo, @@ -25,13 +26,23 @@ assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null; stdenv.mkDerivation rec { pname = "gawk" + lib.optionalString interactive "-interactive"; - version = "5.4.0"; + version = "5.4.1"; src = fetchurl { url = "mirror://gnu/gawk/gawk-${version}.tar.xz"; - hash = "sha256-PdQw8M07RCjGw/avwCG5zTwfjJP3pojcJoykKKkLSsE="; + hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc="; }; + patches = [ + # When building gawk without gmp and mpfr, gawk 5.4.1 causes build failures + # in downstream packages such as GCC and libpng. + # Discussion on bug-gawk: + # https://lists.gnu.org/archive/html/bug-gawk/2026-07/msg00013.html + # Vendored since we can't use fetchpatch: + # https://gitweb.git.savannah.gnu.org/gitweb/?p=gawk.git;a=commit;h=bf85f8a3175af703597082d4c7e0abc2066a44d3 + ./node-struct-without-gmp-mpfr.patch + ]; + # When we do build separate interactive version, it makes sense to always include man. outputs = [ "out" diff --git a/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch b/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch new file mode 100644 index 000000000000..01f660c191e8 --- /dev/null +++ b/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch @@ -0,0 +1,79 @@ +From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Tue, 14 Jul 2026 10:14:50 +0300 +Subject: [PATCH] Workaround fix for systems without MPFR and GMP. + +--- + ChangeLog | 8 ++++++++ + awk.h | 23 ++++++++++++++--------- + 2 files changed, 22 insertions(+), 9 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index 6a955eed..42bd2c48 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -3,6 +3,14 @@ + * builtin.c (do_dump_node): Add the size of each object to + the printout. + ++ Unrelated: Make things works when built on systems without ++ the GMP and MPFR libraries. Thanks to Thomas Trepl ++ and Bruce Dubbs for the reports. ++ ++ * awk.h (struct exp_node): Add alignment padding when we don't ++ have MPFR. This is a hack, pending a total refactoring of ++ the NODE structure. ++ + 2026-07-08 Arnold D. Robbins + + * 5.4.1: Release tar ball made. +diff --git a/awk.h b/awk.h +index dbad0d81..f4a84300 100644 +--- a/awk.h ++++ b/awk.h +@@ -406,17 +406,24 @@ typedef struct exp_node { + } nodep; + + struct { +-#ifdef HAVE_MPFR + union { + AWKNUM fltnum; ++#ifdef HAVE_MPFR + mpfr_t mpnum; + mpz_t mpi; +- } nm; +- int rndmode; + #else +- AWKNUM fltnum; +- int for_alignment_only; // especially on 32-bit +-#endif ++ // 7/2026: ++ // This is a workaround for systems that build ++ // gawk without MPFR and GMP. The NODE struct ++ // desperately needs to be refactored. ++#if SIZEOF_VOID_P == 4 ++ char alignment[28]; ++#else // SIZEOF_VOID_P != 4 ++ char alignment[48]; ++#endif // SIZEOF_VOID_P != 4 ++#endif // HAVE_MPFR ++ } nm; ++ int rndmode; // only used for MPFR. + char *sp; + size_t slen; + int idx; +@@ -561,10 +568,8 @@ typedef struct exp_node { + #ifdef HAVE_MPFR + #define mpg_numbr sub.val.nm.mpnum + #define mpg_i sub.val.nm.mpi +-#define numbr sub.val.nm.fltnum +-#else +-#define numbr sub.val.fltnum + #endif ++#define numbr sub.val.nm.fltnum + #define typed_re sub.val.typre + + /* +-- +2.54.0 +