diff --git a/maintainers/github-teams.json b/maintainers/github-teams.json index 8c1abf72ed9e..5df1479fcfbf 100644 --- a/maintainers/github-teams.json +++ b/maintainers/github-teams.json @@ -65,6 +65,17 @@ }, "name": "Beam" }, + "boot-security": { + "description": "Maintain support for boot security technologies like Secure Boot", + "id": 18686947, + "maintainers": { + "emilazy": 18535642 + }, + "members": { + "ElvishJerricco": 1365692 + }, + "name": "Boot security" + }, "bootstrapping": { "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)", "id": 9141350, @@ -369,7 +380,9 @@ "maintainers": { "jtojnar": 705123 }, - "members": {}, + "members": { + "Hythera": 87016780 + }, "name": "Freedesktop" }, "geospatial": { diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/b4-review-mode/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/b4-review-mode/package.nix new file mode 100644 index 000000000000..ac762925fe75 --- /dev/null +++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/b4-review-mode/package.nix @@ -0,0 +1,19 @@ +{ + lib, + b4, + melpaBuild, +}: +melpaBuild { + pname = "b4-review-mode"; + inherit (b4) version; + + src = b4.src-misc; + sourceRoot = "${b4.src-misc.name}/misc/emacs"; + + meta = { + description = "Emacs major mode with highlighting for the b4 review reply editor"; + homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about"; + license = lib.licenses.gpl2Only; + maintainers = with lib.maintainers; [ fzakaria ]; + }; +} diff --git a/pkgs/applications/editors/jetbrains/builder/linux.nix b/pkgs/applications/editors/jetbrains/builder/linux.nix index a95b82f38f05..edaf0959e1fe 100644 --- a/pkgs/applications/editors/jetbrains/builder/linux.nix +++ b/pkgs/applications/editors/jetbrains/builder/linux.nix @@ -86,6 +86,8 @@ lib.extendMkDerivation { fontconfig libGL libx11 + # required for the bundled jcef-plugin + udev ]; nativeBuildInputs = nativeBuildInputs ++ [ @@ -186,6 +188,10 @@ lib.extendMkDerivation { runHook postInstall ''; + preFixup = '' + addAutoPatchelfSearchPath "${jdk.home}/lib" + ''; + preferLocalBuild = !(finalAttrs.meta.license.free or true); meta = meta // { diff --git a/pkgs/applications/editors/jetbrains/ides/clion.nix b/pkgs/applications/editors/jetbrains/ides/clion.nix index 063d2c752ad2..a3d191969cf3 100644 --- a/pkgs/applications/editors/jetbrains/ides/clion.nix +++ b/pkgs/applications/editors/jetbrains/ides/clion.nix @@ -21,20 +21,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.tar.gz"; - hash = "sha256-uOhFuDqVw3pxtqBvOQH+FpJTFrneaD/R0VcpJZRYD2o="; + url = "https://download.jetbrains.com/cpp/CLion-2026.2.0.1.tar.gz"; + hash = "sha256-3/SNgt6bpr0aIQWmTJnvkgftdZE0M5wcE/LDS1Hk4R0="; }; aarch64-linux = { - url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz"; - hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk="; + url = "https://download.jetbrains.com/cpp/CLion-2026.2.0.1-aarch64.tar.gz"; + hash = "sha256-IG2U2v9mTk+GCbB9jJVoX5hKju37+DfqRiMtxu8b8bo="; }; x86_64-darwin = { url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.dmg"; hash = "sha256-AJt+K1zv4eyjdzubUeFGwB9mqzvOeb3ffA2k0MajPBs="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg"; - hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ="; + url = "https://download.jetbrains.com/cpp/CLion-2026.2.0.1-aarch64.dmg"; + hash = "sha256-nkkJ80rc1bApEBMZT0ZjZQcnhkzAG3i1p9GhQUA4gT4="; }; }; # update-script-end: urls @@ -48,8 +48,8 @@ in product = "CLion"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.59"; + version = "2026.2.0.1"; + buildNumber = "262.8665.321"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/datagrip.nix b/pkgs/applications/editors/jetbrains/ides/datagrip.nix index dfe4ed7f7d3f..4b22ddfe9c81 100644 --- a/pkgs/applications/editors/jetbrains/ides/datagrip.nix +++ b/pkgs/applications/editors/jetbrains/ides/datagrip.nix @@ -12,20 +12,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.tar.gz"; - hash = "sha256-XxwvXiaWAfK318BjbzKPLVDeMBlOr5BFuD2bqU8+12o="; + url = "https://download.jetbrains.com/datagrip/datagrip-2026.2.1.tar.gz"; + hash = "sha256-t3ZYBjpQR11jRTJX5LQx4q6j+Nro6wEi4y0DXsY5ZkU="; }; aarch64-linux = { - url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.tar.gz"; - hash = "sha256-G+tinD/+qM5HVR4u2E0cNXtdVsbwgK8/PdZ3ic6hf4M="; + url = "https://download.jetbrains.com/datagrip/datagrip-2026.2.1-aarch64.tar.gz"; + hash = "sha256-m3XfF56WjiWyJjWg0wN0mCJ3oeBfZvy01V566xGUm3U="; }; x86_64-darwin = { url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.dmg"; hash = "sha256-vW2LEonl0D9S0VxbeJX4jRrwhELGBwlOXwiHslvh06E="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.dmg"; - hash = "sha256-Kyt3fYPXzwTVxPFVKd+atiHWb/i7gjGahz1MJ4iXxy8="; + url = "https://download.jetbrains.com/datagrip/datagrip-2026.2.1-aarch64.dmg"; + hash = "sha256-1sMqgNPSAGTE3qjT3Dbp5MKJ6mCif1LHjyjnk4ixDUY="; }; }; # update-script-end: urls @@ -39,8 +39,8 @@ mkJetBrainsProduct { product = "DataGrip"; # update-script-start: version - version = "2026.1.3"; - buildNumber = "261.24374.56"; + version = "2026.2.1"; + buildNumber = "262.8665.339"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/gateway.nix b/pkgs/applications/editors/jetbrains/ides/gateway.nix index 56370da57946..2a81499b618f 100644 --- a/pkgs/applications/editors/jetbrains/ides/gateway.nix +++ b/pkgs/applications/editors/jetbrains/ides/gateway.nix @@ -12,20 +12,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.tar.gz"; - hash = "sha256-HizogKH6goX1NdcI/Fj4YsCRzDWfFvQGYSaMM9wVDCA="; + url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.2.tar.gz"; + hash = "sha256-FdjMPo4SyWAojyqKm+FFdt3f7NuEfSFvH8I2ctygxjE="; }; aarch64-linux = { - url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.tar.gz"; - hash = "sha256-CSe04BBo4jS1cIhu4NfZqaSHMaNue2eFUPa+1gOxuoo="; + url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.2-aarch64.tar.gz"; + hash = "sha256-bYLMkv7/aNFyZOBLFp0SBFA44YCzFjqArTWEpJO+jmo="; }; x86_64-darwin = { url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.dmg"; hash = "sha256-WKwIP19y5EKO98JgEm468ofaRp/JO5z8lqNhtpsH4tY="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.dmg"; - hash = "sha256-AHY/lY0ARkW0VoSgy0t7LLNXA965PLooWBSWxBKBV5M="; + url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.2-aarch64.dmg"; + hash = "sha256-FUus7mjiYWAiyIihEjhpEILYupLAFdjrA8xClovJU2o="; }; }; # update-script-end: urls @@ -40,8 +40,8 @@ mkJetBrainsProduct { productShort = "Gateway"; # update-script-start: version - version = "2026.1.3"; - buildNumber = "261.25134.98"; + version = "2026.2"; + buildNumber = "262.8665.250"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/goland.nix b/pkgs/applications/editors/jetbrains/ides/goland.nix index 692e2ba49fc8..e7f740343c82 100644 --- a/pkgs/applications/editors/jetbrains/ides/goland.nix +++ b/pkgs/applications/editors/jetbrains/ides/goland.nix @@ -12,20 +12,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/go/goland-2026.1.4.tar.gz"; - hash = "sha256-pHSbmAZ+tSfa0wdtDp/3Ib/GNMP30OFNQlHWUfMwrW0="; + url = "https://download.jetbrains.com/go/goland-2026.2.0.1.tar.gz"; + hash = "sha256-nT/jmw0WFNwmtWR5be0KBUHJpM48phhYN7oUNOMCrok="; }; aarch64-linux = { - url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz"; - hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c="; + url = "https://download.jetbrains.com/go/goland-2026.2.0.1-aarch64.tar.gz"; + hash = "sha256-t6vH7fxtysgprc1EHH3XiIdHD6oCMcY/a1hu5aiYMxE="; }; x86_64-darwin = { url = "https://download.jetbrains.com/go/goland-2026.1.4.dmg"; hash = "sha256-RbvcLpLVyeL4B1DJ2/9Ub/6Cz6fJGXMPCHsJ705GsAo="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg"; - hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM="; + url = "https://download.jetbrains.com/go/goland-2026.2.0.1-aarch64.dmg"; + hash = "sha256-zrQAsOOR4OhAXnebwnRk3da4h4Gi0t8f+SIaEAiwM0Q="; }; }; # update-script-end: urls @@ -39,8 +39,8 @@ in product = "Goland"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.72"; + version = "2026.2.0.1"; + buildNumber = "262.8665.336"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/idea-oss.nix b/pkgs/applications/editors/jetbrains/ides/idea-oss.nix index 3654469d56ea..4eb704ac3204 100644 --- a/pkgs/applications/editors/jetbrains/ides/idea-oss.nix +++ b/pkgs/applications/editors/jetbrains/ides/idea-oss.nix @@ -70,5 +70,11 @@ mkJetBrainsProduct { ]; license = lib.licenses.asl20; sourceProvenance = [ lib.sourceTypes.fromSource ]; + knownVulnerabilities = [ + '' + This version of IDEA has multiple known security vulnerabilities, see NIXPKGS-2026-2269: https://tracker.security.nixos.org/issues/NIXPKGS-2026-2269. + The package `jetbrains.idea-oss` is currently not receiving updates in nixpkgs, consider using `jetbrains.idea`. + '' + ]; }; } diff --git a/pkgs/applications/editors/jetbrains/ides/idea.nix b/pkgs/applications/editors/jetbrains/ides/idea.nix index e77c6a800f61..c614154595d3 100644 --- a/pkgs/applications/editors/jetbrains/ides/idea.nix +++ b/pkgs/applications/editors/jetbrains/ides/idea.nix @@ -15,20 +15,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.tar.gz"; - hash = "sha256-MQTYXZUH/4ggZeP465UGQCtKgSkJLSaCZiu26cTwY/w="; + url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1.tar.gz"; + hash = "sha256-kU4x4xtOEoXVOM8/rlswCvCLz/NrwpisYgBQS74S8YA="; }; aarch64-linux = { - url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz"; - hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM="; + url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1-aarch64.tar.gz"; + hash = "sha256-HkRhBq1vh1iRjshmX+D9cT1iSRZk/NEz6YkTwWhKl0g="; }; x86_64-darwin = { url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.dmg"; hash = "sha256-8K+LiewiINP4S9eqV0kGWtfy2Ff/zvBwX89iX7mYZ78="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg"; - hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s="; + url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1-aarch64.dmg"; + hash = "sha256-vN2wVaM5V9H5Xnrjv9MIKT0PgSJQqrk5kWQWOqEYOZ8="; }; }; # update-script-end: urls @@ -43,8 +43,8 @@ mkJetBrainsProduct { productShort = "IDEA"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.65"; + version = "2026.2.0.1"; + buildNumber = "262.8665.337"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/mps.nix b/pkgs/applications/editors/jetbrains/ides/mps.nix index 52e18be29bcd..b1836760c11e 100644 --- a/pkgs/applications/editors/jetbrains/ides/mps.nix +++ b/pkgs/applications/editors/jetbrains/ides/mps.nix @@ -12,20 +12,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz"; - hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k="; + url = "https://download.jetbrains.com/mps/2026.1/MPS-2026.1.tar.gz"; + hash = "sha256-NbURKu1jTPoJQvV8FpMacBa+FehF7XfF6xZmIhFlb2A="; }; aarch64-linux = { - url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz"; - hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k="; + url = "https://download.jetbrains.com/mps/2026.1/MPS-2026.1.tar.gz"; + hash = "sha256-NbURKu1jTPoJQvV8FpMacBa+FehF7XfF6xZmIhFlb2A="; }; x86_64-darwin = { url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos.dmg"; hash = "sha256-whYAjKkF79mrknHflZnvOOy2bLosYUguelZDSuPt3uY="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos-aarch64.dmg"; - hash = "sha256-3HnEHOhRRI9IYjBhc5FO7h5j4jBBDtZTVkmO/S1fBEQ="; + url = "https://download.jetbrains.com/mps/2026.1/MPS-2026.1-macos-aarch64.dmg"; + hash = "sha256-5VtPS26/vCKa+mfDAQKgd9x5A+Cqv39Kz+2EKkgul+I="; }; }; # update-script-end: urls @@ -39,8 +39,8 @@ mkJetBrainsProduct { product = "MPS"; # update-script-start: version - version = "2025.3"; - buildNumber = "253.28294.432"; + version = "2026.1"; + buildNumber = "261.25134.779"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/phpstorm.nix b/pkgs/applications/editors/jetbrains/ides/phpstorm.nix index be56d33d23bc..39186df44326 100644 --- a/pkgs/applications/editors/jetbrains/ides/phpstorm.nix +++ b/pkgs/applications/editors/jetbrains/ides/phpstorm.nix @@ -12,20 +12,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.tar.gz"; - hash = "sha256-SF25D7dDn7b6AzcXEDLKwhpjTnCqYz1fEmvND5dl8Is="; + url = "https://download.jetbrains.com/webide/PhpStorm-2026.2.0.1.tar.gz"; + hash = "sha256-SZr1Qd3ISuTsMuuoLFc0O79kvPMrSz26PmLeKvRJLbQ="; }; aarch64-linux = { - url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz"; - hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ="; + url = "https://download.jetbrains.com/webide/PhpStorm-2026.2.0.1-aarch64.tar.gz"; + hash = "sha256-W+59PmLs47hhAtjbM+4ARb1WQS1MmPiL/GuIoQ887mU="; }; x86_64-darwin = { url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.dmg"; hash = "sha256-W7EwYu7S3hs1564tXq8H1Uok/Gwx/8QJO4brUGOfFY4="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg"; - hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY="; + url = "https://download.jetbrains.com/webide/PhpStorm-2026.2.0.1-aarch64.dmg"; + hash = "sha256-fI60xJ94onmXAzJBy3+GUHnJH+/ukQTCuU2j3s1ZI5o="; }; }; # update-script-end: urls @@ -39,8 +39,8 @@ mkJetBrainsProduct { product = "PhpStorm"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.71"; + version = "2026.2.0.1"; + buildNumber = "262.8665.325"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix b/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix index d8ef51c64488..68c8bd2b3357 100644 --- a/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix +++ b/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix @@ -63,6 +63,12 @@ in ]; license = lib.licenses.asl20; sourceProvenance = [ lib.sourceTypes.fromSource ]; + knownVulnerabilities = [ + '' + This version of PyCharm has multiple known security vulnerabilities, see NIXPKGS-2026-2269: https://tracker.security.nixos.org/issues/NIXPKGS-2026-2269. + The package `jetbrains.pycharm-oss` is currently not receiving updates in nixpkgs, consider using `jetbrains.pycharm`. + '' + ]; }; }).overrideAttrs pyCharmCommonOverrides diff --git a/pkgs/applications/editors/jetbrains/ides/pycharm.nix b/pkgs/applications/editors/jetbrains/ides/pycharm.nix index 4f418ef23a3b..c67b7f7e49a8 100644 --- a/pkgs/applications/editors/jetbrains/ides/pycharm.nix +++ b/pkgs/applications/editors/jetbrains/ides/pycharm.nix @@ -13,20 +13,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/python/pycharm-2026.1.4.tar.gz"; - hash = "sha256-RIufgZhg/n+D1uEdcDyYRjTDfh8Jicyz4h0B1kTbVXs="; + url = "https://download.jetbrains.com/python/pycharm-2026.2.tar.gz"; + hash = "sha256-rDb3wHQ0ZSFb+CJwebdycpRTOMSFwdprkk5WRoBGvVo="; }; aarch64-linux = { - url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz"; - hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE="; + url = "https://download.jetbrains.com/python/pycharm-2026.2-aarch64.tar.gz"; + hash = "sha256-O2PS9JDBTFQcmK/YUfIYBpo8iFzq7dm9sA5aByhc+AI="; }; x86_64-darwin = { url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg"; hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg"; - hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0="; + url = "https://download.jetbrains.com/python/pycharm-2026.2-aarch64.dmg"; + hash = "sha256-wiOQISfsvBnlpjeyzAPXUJfXOwYwrZ8nGoiRRvQ4YUY="; }; }; # update-script-end: urls @@ -40,8 +40,8 @@ in product = "PyCharm"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.68"; + version = "2026.2"; + buildNumber = "262.8665.309"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/rider.nix b/pkgs/applications/editors/jetbrains/ides/rider.nix index c962306f3389..544b4300b289 100644 --- a/pkgs/applications/editors/jetbrains/ides/rider.nix +++ b/pkgs/applications/editors/jetbrains/ides/rider.nix @@ -24,20 +24,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.tar.gz"; - hash = "sha256-K+X2M4idv+oDqC/dkbzMTX3W3zx0b0e8ZTsxkP7rAfI="; + url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2.tar.gz"; + hash = "sha256-7rvEnimFJJbLx/Y5nrR7VuipX8khxNrnwFzKay9tIqc="; }; aarch64-linux = { - url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz"; - hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo="; + url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2-aarch64.tar.gz"; + hash = "sha256-fvdgV1Q8gLgYB/ihrpukJW9DqLupZ45JGKad7vovAIo="; }; x86_64-darwin = { url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg"; hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg"; - hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE="; + url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2-aarch64.dmg"; + hash = "sha256-Y+hXTTMqHHGm5pJhQ8yepmZmAzkiF7ylOxroOa9BG6Q="; }; }; # update-script-end: urls @@ -51,8 +51,8 @@ in product = "Rider"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.60"; + version = "2026.2"; + buildNumber = "262.8665.328"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix b/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix index b4ab8c0b34c4..c32bdcd49867 100644 --- a/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix +++ b/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix @@ -12,20 +12,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.tar.gz"; - hash = "sha256-0EhtU4XKWI9i7ij+m5uvxHSYnbQaYJy8Sa6S1OW4CFU="; + url = "https://download.jetbrains.com/ruby/RubyMine-2026.2.tar.gz"; + hash = "sha256-k+T5QDCIcuqHWrjhoCGcym/Q9v4YBviacg9rnNFBIRM="; }; aarch64-linux = { - url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz"; - hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug="; + url = "https://download.jetbrains.com/ruby/RubyMine-2026.2-aarch64.tar.gz"; + hash = "sha256-2T6thTMYAlfb6yJKbpuIyVtj7Af/P3AjQAVl16H35nM="; }; x86_64-darwin = { url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.dmg"; hash = "sha256-BLo2weIJK8gQAcMtAiETM7FMdhw9aoFIGh5Yqjv3k7s="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg"; - hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k="; + url = "https://download.jetbrains.com/ruby/RubyMine-2026.2-aarch64.dmg"; + hash = "sha256-rgskPMKLtgPpdSbbENJcE4g75VzqeWPLzxoXqzln67k="; }; }; # update-script-end: urls @@ -39,8 +39,8 @@ mkJetBrainsProduct { product = "RubyMine"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.67"; + version = "2026.2"; + buildNumber = "262.8665.308"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/rust-rover.nix b/pkgs/applications/editors/jetbrains/ides/rust-rover.nix index 3f82ae6aea2e..cd9722396e25 100644 --- a/pkgs/applications/editors/jetbrains/ides/rust-rover.nix +++ b/pkgs/applications/editors/jetbrains/ides/rust-rover.nix @@ -18,20 +18,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.tar.gz"; - hash = "sha256-8x/AP6uKSVJavwjA9tYT1IM1xVspOZZzwmcwpGloIcw="; + url = "https://download.jetbrains.com/rustrover/RustRover-2026.2.tar.gz"; + hash = "sha256-xHg0d7wdlcXy3c/5STlWaeouV3rMBENRB1lLqZSulqE="; }; aarch64-linux = { - url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz"; - hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q="; + url = "https://download.jetbrains.com/rustrover/RustRover-2026.2-aarch64.tar.gz"; + hash = "sha256-WU+OeMZp9f8QkNbA2ZKYyYG5kt65KOvaA003SkskCow="; }; x86_64-darwin = { url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.dmg"; hash = "sha256-2BwgAD0xF9IxRJh+gW4vLzBW13rFQSzQPbEwdmQGvLU="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg"; - hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE="; + url = "https://download.jetbrains.com/rustrover/RustRover-2026.2-aarch64.dmg"; + hash = "sha256-/cdvXf0qYXxgIi+uh9O6I0KIAOV7Z7QQ+lV5Y2xUNy0="; }; }; # update-script-end: urls @@ -45,8 +45,8 @@ in product = "RustRover"; # update-script-start: version - version = "2026.1.4"; - buildNumber = "261.26222.73"; + version = "2026.2"; + buildNumber = "262.8665.323"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/jetbrains/ides/webstorm.nix b/pkgs/applications/editors/jetbrains/ides/webstorm.nix index 637302db7639..1deac76b69e0 100644 --- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix +++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix @@ -12,20 +12,20 @@ let # update-script-start: urls urls = { x86_64-linux = { - url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.tar.gz"; - hash = "sha256-lryIoVxoytyDyfgjnobQ3e94wIIohmIKL88fwf2I49w="; + url = "https://download.jetbrains.com/webstorm/WebStorm-2026.2.0.1.tar.gz"; + hash = "sha256-FEe4EDYWJwGt5hEdbf0A6g2+ZyIrX4ztzQYmZe5GZPg="; }; aarch64-linux = { - url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz"; - hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE="; + url = "https://download.jetbrains.com/webstorm/WebStorm-2026.2.0.1-aarch64.tar.gz"; + hash = "sha256-pt1MwGNXHT1QlePbVdtkwtYpenKlf53DGDG24+PM9tc="; }; x86_64-darwin = { - url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg"; - hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI="; + url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.dmg"; + hash = "sha256-SGdo6WYMCcCBuZUjvURcMTbJUqhZ4MzFlSLg6Zjr84I="; }; aarch64-darwin = { - url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg"; - hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI="; + url = "https://download.jetbrains.com/webstorm/WebStorm-2026.2.0.1-aarch64.dmg"; + hash = "sha256-WtvL7DLrchsKlMPrsYeluxoPo/sXBaUw0WO1mlxtHkc="; }; }; # update-script-end: urls @@ -39,8 +39,8 @@ mkJetBrainsProduct { product = "WebStorm"; # update-script-start: version - version = "2026.1.3"; - buildNumber = "261.25134.101"; + version = "2026.2.0.1"; + buildNumber = "262.8665.341"; # update-script-end: version src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}")); diff --git a/pkgs/applications/editors/vim/plugins/non-generated/b4-review-vim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/b4-review-vim/default.nix new file mode 100644 index 000000000000..f9de458f3f9b --- /dev/null +++ b/pkgs/applications/editors/vim/plugins/non-generated/b4-review-vim/default.nix @@ -0,0 +1,19 @@ +{ + lib, + vimUtils, + b4, +}: +vimUtils.buildVimPlugin { + pname = "b4-review-vim"; + inherit (b4) version; + + src = b4.src-misc; + sourceRoot = "${b4.src-misc.name}/misc/vim"; + + meta = { + description = "Vim syntax highlighting for the b4 review reply editor"; + homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about"; + license = lib.licenses.gpl2Only; + maintainers = with lib.maintainers; [ fzakaria ]; + }; +} diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index d945a0a3d063..3befbc5047e1 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -6,6 +6,7 @@ lndir, config, buildPackages, + gsettings-desktop-schemas, jq, xdg-utils, writeText, @@ -134,6 +135,12 @@ let ++ pkcs11Modules ++ lib.optionals (!isDarwin) gtk_modules; gtk_modules = lib.optionals (!isDarwin) [ libcanberra-gtk3 ]; + # strictDeps prevents buildInputs from populating GSETTINGS_SCHEMAS_PATH. + # Revert when https://github.com/NixOS/nixpkgs/pull/546281 hits stable. + gsettingsSchemaPaths = lib.optionals (!isDarwin) [ + "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" + "${browser.gtk3}/share/gsettings-schemas/${browser.gtk3.name}" + ]; # Darwin does not rename bundled binaries launcherName = "${applicationName}${lib.optionalString (!isDarwin) nameSuffix}"; @@ -339,6 +346,11 @@ let ":" "${adwaita-icon-theme}/share" + "--prefix" + "XDG_DATA_DIRS" + ":" + (lib.concatStringsSep ":" gsettingsSchemaPaths) + "--set-default" "MOZ_ENABLE_WAYLAND" "1" @@ -486,9 +498,6 @@ let mv "$executablePath" "$oldExe" fi '' - + lib.optionalString (!isDarwin) '' - appendToVar makeWrapperArgs --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" - '' + '' concatTo makeWrapperArgs oldWrapperArgs diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix index b846a1ed31aa..e697c17fe3df 100644 --- a/pkgs/applications/virtualization/virtualbox/default.nix +++ b/pkgs/applications/virtualization/virtualbox/default.nix @@ -72,9 +72,9 @@ let buildType = "release"; # Use maintainers/scripts/update.nix to update the version and all related hashes or # change the hashes in extpack.nix and guest-additions/default.nix as well manually. - virtualboxVersion = "7.2.12"; + virtualboxVersion = "7.2.14"; virtualboxSubVersion = ""; - virtualboxSha256 = "64a4843677e42010e7799e951883fbbefc56bf2bc162e4970edea04f142f8b25"; + virtualboxSha256 = "384f293184c52fd51bc941c17d753b4019446f53a6b07c828adfb3e61fe0a500"; kvmPatchVboxVersion = "7.2.6"; kvmPatchVersion = "20260201"; diff --git a/pkgs/applications/virtualization/virtualbox/extpack.nix b/pkgs/applications/virtualization/virtualbox/extpack.nix index c8580a091e6a..78593452f353 100644 --- a/pkgs/applications/virtualization/virtualbox/extpack.nix +++ b/pkgs/applications/virtualization/virtualbox/extpack.nix @@ -5,7 +5,7 @@ }: fetchurl rec { pname = "virtualbox-extpack"; - version = "7.2.12"; + version = "7.2.14"; name = "Oracle_VirtualBox_Extension_Pack-${version}.vbox-extpack"; url = "https://download.virtualbox.org/virtualbox/${version}/${name}"; sha256 = @@ -13,7 +13,7 @@ fetchurl rec { # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`. # Checksums can also be found at https://download.virtualbox.org/virtualbox/${version}/SHA256SUMS let - value = "ac461d67462e06a9e16e8b96623c1b1a8c692c7f78e3566584b47e2d2e533f76"; + value = "ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d"; in assert (builtins.stringLength value) == 64; value; diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix index a1abd7a1b18f..19e2128ad2a3 100644 --- a/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix +++ b/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix @@ -5,7 +5,7 @@ }: fetchurl { url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso"; - sha256 = "ae55a8a3b3934785a3a622f63483806e3228112eba57f86ca932958199b8f61b"; + sha256 = "4f51a073296de31cce53924860549149be5dc339f65dcd1dbf34fd7accefe8fb"; meta = { description = "Guest additions ISO for VirtualBox"; longDescription = '' diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix index fa4725a69a20..b6b11fd54bb0 100644 --- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix +++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix @@ -18,9 +18,9 @@ libx11, }: let - virtualboxVersion = "7.2.12"; + virtualboxVersion = "7.2.14"; virtualboxSubVersion = ""; - virtualboxSha256 = "64a4843677e42010e7799e951883fbbefc56bf2bc162e4970edea04f142f8b25"; + virtualboxSha256 = "384f293184c52fd51bc941c17d753b4019446f53a6b07c828adfb3e61fe0a500"; platform = if stdenv.hostPlatform.isAarch64 then diff --git a/pkgs/by-name/ad/adguardhome/package.nix b/pkgs/by-name/ad/adguardhome/package.nix index b5a8ed558ab8..c73bbc938c33 100644 --- a/pkgs/by-name/ad/adguardhome/package.nix +++ b/pkgs/by-name/ad/adguardhome/package.nix @@ -9,15 +9,15 @@ buildGoModule (finalAttrs: { pname = "adguardhome"; - version = "0.107.77"; + version = "0.107.78"; src = fetchFromGitHub { owner = "AdguardTeam"; repo = "AdGuardHome"; tag = "v${finalAttrs.version}"; - hash = "sha256-CwM8Zi5FXNwb+5gdESoP31Ja1O6PrnOgFfJaT8Yc890="; + hash = "sha256-u/fAvBgaoGph+BeTO/QzFtuFvJnnwaJRK3qmRhubj5w="; }; - vendorHash = "sha256-D91mHBG78LOG1O5oVlaA3T8HWIISPeKMB06VpWuxxqo="; + vendorHash = "sha256-+LqNok2kaHQnVJA5cVX1MB31uLFfNxb952lzZk8V8Z8="; dashboard = buildNpmPackage { inherit (finalAttrs) src version; diff --git a/pkgs/by-name/an/anubis/package.nix b/pkgs/by-name/an/anubis/package.nix index 903051ed27bb..7c9dbd0585a8 100644 --- a/pkgs/by-name/an/anubis/package.nix +++ b/pkgs/by-name/an/anubis/package.nix @@ -15,13 +15,13 @@ buildGoModule (finalAttrs: { pname = "anubis"; - version = "1.26.0"; + version = "1.26.2"; src = fetchFromGitHub { owner = "TecharoHQ"; repo = "anubis"; tag = "v${finalAttrs.version}"; - hash = "sha256-0ceF4Te0H5edBhvGJgGc/NLJxEAcDVGnnKlqHKnpW60="; + hash = "sha256-yY8dwWyQy/N3A32MYtxLWAJCmR9rtSyzaYUHBNXRm/0="; }; vendorHash = "sha256-+NPwL4p0p/s74m1Ld0z2GEcsWk5FqhcLbHrTNP3yEzk="; @@ -29,7 +29,7 @@ buildGoModule (finalAttrs: { npmDeps = fetchNpmDeps { name = "anubis-npm-deps"; inherit (finalAttrs) src; - hash = "sha256-6sj9C8GHm+RzFl/X5HIPhIDl5l8muBzDSXSRCHumGBs="; + hash = "sha256-SPoI66jy2XS4FM6BaJPt18dV1QM12nIOdeD5sAMaOzQ="; }; nativeBuildInputs = [ @@ -58,7 +58,10 @@ buildGoModule (finalAttrs: { ''; postPatch = '' - patchShebangs ./web/build.sh ./lib/challenge/preact/build.sh + patchShebangs \ + ./web/build.sh \ + ./lib/challenge/preact/build.sh \ + ./lib/challenge/proofofwork/build.sh ''; preBuild = '' diff --git a/pkgs/by-name/b4/b4/package.nix b/pkgs/by-name/b4/b4/package.nix index 102cb1dc904d..74d0441c3786 100644 --- a/pkgs/by-name/b4/b4/package.nix +++ b/pkgs/by-name/b4/b4/package.nix @@ -2,6 +2,7 @@ lib, python3Packages, fetchPypi, + fetchgit, patatt, }: @@ -31,6 +32,15 @@ python3Packages.buildPythonApplication (finalAttrs: { textual ]; + passthru = { + src-misc = fetchgit { + url = "https://git.kernel.org/pub/scm/utils/b4/b4.git"; + rev = "v${finalAttrs.version}"; + hash = "sha256-NjYL3RKQpjDkU98qbXyl/cvLTJYVAfIowm8E2Rg8AgI="; + fetchSubmodules = false; + }; + }; + meta = { homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about"; license = lib.licenses.gpl2Only; diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix index f42a60bd89b2..0b0a483ca026 100644 --- a/pkgs/by-name/br/brave/package.nix +++ b/pkgs/by-name/br/brave/package.nix @@ -3,24 +3,24 @@ let pname = "brave"; - version = "1.92.139"; + version = "1.92.144"; allArchives = { aarch64-linux = { url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb"; - hash = "sha256-CkCpXgP4InjfjuhKqG66OjuZcqq7VLLK3/n+7fXpMj0="; + hash = "sha256-Z9uUJRaMx+P35oXtvAnjHyOQOXt8mW5oyyEtnD754x8="; }; x86_64-linux = { url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb"; - hash = "sha256-UFQV8iBsa6HdUhGGngpi341o41yRoenkxbG2M90O62A="; + hash = "sha256-no/KD+3EB6CqvVWEmDB/8k2rv1wau469FBXMNWN7z6k="; }; aarch64-darwin = { url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip"; - hash = "sha256-65qGzjXZfY5eTWbxTA9R3jN2F0CdkXnHXGVfw3spujo="; + hash = "sha256-YidWCVGP36wn1goAulSbVrKFoHI1NA/pLtfPjIXBO48="; }; x86_64-darwin = { url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip"; - hash = "sha256-XPKKB/X8w5Neuxeluc5OFZVN1thqZ0Cf/pFTP4GY2/o="; + hash = "sha256-fP+TPE2+Whqe6kpH3GG441fQQ5YX42bwdkSDoTGgYwk="; }; }; diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix index df6b082a92bc..c4052964cd91 100644 --- a/pkgs/by-name/ca/cacert/package.nix +++ b/pkgs/by-name/ca/cacert/package.nix @@ -20,7 +20,7 @@ let lib.concatStringsSep "\n\n" extraCertificateStrings ); - version = "3.125"; + version = "3.126"; meta = { homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers"; description = "Bundle of X.509 certificates of public Certificate Authorities (CA)"; @@ -52,7 +52,7 @@ stdenv.mkDerivation { "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}" "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}" ]; - hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0="; + hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg="; }; unpackPhase = '' diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix index 401df7d6762b..9c86d318fa57 100644 --- a/pkgs/by-name/du/duckdb/package.nix +++ b/pkgs/by-name/du/duckdb/package.nix @@ -152,11 +152,12 @@ stdenv.mkDerivation (finalAttrs: { ); LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH"; in + # FIXME: do something about the excessive logging on x86_64-linux (> 250 MiB). '' runHook preInstallCheck (($(ulimit -n) < 1024)) && ulimit -n 1024 - HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes} + HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null"} runHook postInstallCheck ''; diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix index 344d7db401f6..b366fa8f131f 100644 --- a/pkgs/by-name/el/element-desktop/package.nix +++ b/pkgs/by-name/el/element-desktop/package.nix @@ -30,13 +30,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "element-desktop"; - version = "1.12.23"; + version = "1.12.24"; src = fetchFromGitHub { owner = "element-hq"; repo = "element-web"; tag = "v${finalAttrs.version}"; - hash = "sha256-IdQZqwGk05APb38hEoin74/5FeRgjCLrdli+R6iaoUA="; + hash = "sha256-VSnhOPjlMuQRy5RsLN5IdRVyjmghTuAoRSffOFL6fns="; }; pnpmDeps = fetchPnpmDeps { @@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: { ; inherit pnpm; fetcherVersion = 4; - hash = "sha256-WVQaq7kqlEdKodOkErUCeYLh0xnH1NTHzgNyjn1+1y0="; + hash = "sha256-dicE2mDba0mgu3iTbevowW6fRhqMytBQacQa4aSP47M="; }; env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; diff --git a/pkgs/by-name/el/element-web-unwrapped/package.nix b/pkgs/by-name/el/element-web-unwrapped/package.nix index 45dd152435f0..8e01cf535582 100644 --- a/pkgs/by-name/el/element-web-unwrapped/package.nix +++ b/pkgs/by-name/el/element-web-unwrapped/package.nix @@ -25,13 +25,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "element-web"; - version = "1.12.23"; + version = "1.12.24"; src = fetchFromGitHub { owner = "element-hq"; repo = "element-web"; tag = "v${finalAttrs.version}"; - hash = "sha256-IdQZqwGk05APb38hEoin74/5FeRgjCLrdli+R6iaoUA="; + hash = "sha256-VSnhOPjlMuQRy5RsLN5IdRVyjmghTuAoRSffOFL6fns="; }; pnpmDeps = fetchPnpmDeps { @@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: { inherit (finalAttrs) version src; inherit pnpm; fetcherVersion = 4; - hash = "sha256-WVQaq7kqlEdKodOkErUCeYLh0xnH1NTHzgNyjn1+1y0="; + hash = "sha256-dicE2mDba0mgu3iTbevowW6fRhqMytBQacQa4aSP47M="; }; nativeBuildInputs = [ diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix index dbe9e1dad928..9b044e3a3324 100644 --- a/pkgs/by-name/fo/forgejo-runner/package.nix +++ b/pkgs/by-name/fo/forgejo-runner/package.nix @@ -55,14 +55,14 @@ let in buildGoModule (finalAttrs: { pname = "forgejo-runner"; - version = "12.13.1"; + version = "12.13.2"; src = fetchFromGitea { domain = "code.forgejo.org"; owner = "forgejo"; repo = "runner"; rev = "v${finalAttrs.version}"; - hash = "sha256-f2YVcb2bq1//A0SX1bfLLkGfp04REHgzg8o3dsN1Kh0="; + hash = "sha256-6i87t8LXYYXyQ8UzyUiEOvQ+9wuRz4xeUBivk0VJ0S4="; }; vendorHash = "sha256-du7fXehcxZ70Lsr5VCkz646G0Us/XwM4Sl98HXimoao="; diff --git a/pkgs/by-name/gd/gdal/package.nix b/pkgs/by-name/gd/gdal/package.nix index 208ad867955f..7a0b90e22c44 100644 --- a/pkgs/by-name/gd/gdal/package.nix +++ b/pkgs/by-name/gd/gdal/package.nix @@ -116,6 +116,24 @@ stdenv.mkDerivation (finalAttrs: { url = "https://github.com/OSGeo/gdal/commit/7b8b8de28bbd200b0fd3b09147fdc68b5bf5ce20.patch"; hash = "sha256-BxWMpiUwM3h7Vo9vxJ4H4A8aQfE3jcSRfRYwaLw/60w="; }) + + # Fix stack buffer overflow in netCDF driver + # https://github.com/OSGeo/gdal/issues/14594 + (fetchpatch { + name = "0005-netcdf-avoid-reading-attributes-without-checking-length.patch"; + url = "https://github.com/OSGeo/gdal/commit/50eea7456d83c9586f112ef96b43249372839dea.patch"; + hash = "sha256-m1FsBC37h2uuaEeYezPZJFsDR6Ix/FDIZnuZZiSAYcw="; + }) + + # Fix tests with libtiff 4.7.2 + # FAILED gcore/tiff_read.py::test_tiff_read_stripbytecounts_count_not_same_as_stripoffsets_count - + # AssertionError: assert '170' is None + (fetchpatch { + name = "0006-Internal-libtiff-resync-with-4.7.2rc3-and-adjust-tes.patch"; + url = "https://github.com/OSGeo/gdal/commit/06ffb0333fe557cde262aa1e81466dda42684c53.patch"; + hash = "sha256-teZ9cv8JQ2ua4tEWl3I8D9DYo8srGIBYIc2NfkgNMe4="; + includes = [ "autotest/gcore/tiff_read.py" ]; + }) ]; nativeBuildInputs = [ diff --git a/pkgs/by-name/gi/gitea/package.nix b/pkgs/by-name/gi/gitea/package.nix index 1191c645692f..191debfcf551 100644 --- a/pkgs/by-name/gi/gitea/package.nix +++ b/pkgs/by-name/gi/gitea/package.nix @@ -53,13 +53,13 @@ let in buildGoModule (finalAttrs: { pname = "gitea"; - version = "1.27.0"; + version = "1.27.1"; src = fetchFromGitHub { owner = "go-gitea"; repo = "gitea"; tag = "v${finalAttrs.version}"; - hash = "sha256-Pn1V4U43d4lTKRO7AftgKDDWls2z+3IeZgPBaKZlbow="; + hash = "sha256-OCThp8432WAD+9v7c7phY2u4JndXAfve4XRbJTLdn6g="; }; proxyVendor = true; diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix index f74e3a2575d9..50191ac86634 100644 --- a/pkgs/by-name/h2/h2o/package.nix +++ b/pkgs/by-name/h2/h2o/package.nix @@ -4,33 +4,36 @@ fetchFromGitHub, pkg-config, cmake, - makeWrapper, + makeBinaryWrapper, ninja, perl, perlPackages, - brotli, openssl, libcap, libuv, wslay, zlib, + withBrotli ? true, + brotli, withMruby ? true, bison, ruby, withUring ? stdenv.hostPlatform.isLinux, liburing, + withZstandard ? true, + zstd, nixosTests, }: stdenv.mkDerivation (finalAttrs: { pname = "h2o"; - version = "2.3.0-rolling-2026-05-15"; + version = "2.3.0-rolling-2026-06-29"; src = fetchFromGitHub { owner = "h2o"; repo = "h2o"; - rev = "9e7f283e5801bd0707cc5d48d0188c4c162fe7b3"; - hash = "sha256-8FdUQLX67E+7f4HyoH6atLDxYzniVEFqc+jbjzTytFM="; + rev = "edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1"; + hash = "sha256-WQy+v4zpwzgbMxT43+Nd33+YPynyZIwqzVTaknqjCmE="; }; outputs = [ @@ -43,15 +46,17 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ pkg-config cmake - makeWrapper + makeBinaryWrapper ninja perlPackages.JSON ] + ++ lib.optional withBrotli brotli ++ lib.optionals withMruby [ bison ruby ] - ++ lib.optional withUring liburing; + ++ lib.optional withUring liburing + ++ lib.optional withZstandard zstd; buildInputs = [ brotli @@ -61,10 +66,14 @@ stdenv.mkDerivation (finalAttrs: { perl zlib wslay - ]; + ] + ++ lib.optional withBrotli brotli + ++ lib.optional withZstandard zstd; cmakeFlags = [ + "-DWITH_BROTLI=${if withBrotli then "ON" else "OFF"}" "-DWITH_MRUBY=${if withMruby then "ON" else "OFF"}" + "-DWITH_ZSTD=${if withZstandard then "ON" else "OFF"}" ]; postInstall = '' diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix index 0869a82c1d16..3ccee9419fc5 100644 --- a/pkgs/by-name/li/libffiReal/package.nix +++ b/pkgs/by-name/li/libffiReal/package.nix @@ -13,13 +13,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libffi"; - version = "3.5.2"; + version = "3.7.0"; src = fetchurl { url = with finalAttrs; "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz"; - hash = "sha256-86MIKiOzfCk6T80QUxR7Nx8v+R+n6hsqUuM1Z2usgtw="; + hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY="; }; # Note: this package is used for bootstrapping fetchurl, and thus @@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: { ./freebsd-tsan-pthread.patch ]; + # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file: + postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c"; + strictDeps = true; outputs = [ "out" diff --git a/pkgs/by-name/li/libmysofa/package.nix b/pkgs/by-name/li/libmysofa/package.nix index b32265cc07a7..ae140ada101d 100644 --- a/pkgs/by-name/li/libmysofa/package.nix +++ b/pkgs/by-name/li/libmysofa/package.nix @@ -8,13 +8,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libmysofa"; - version = "1.3.3"; + version = "1.3.4"; src = fetchFromGitHub { owner = "hoene"; repo = "libmysofa"; rev = "v${finalAttrs.version}"; - hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc="; + hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ="; }; outputs = [ diff --git a/pkgs/by-name/li/libseccomp/package.nix b/pkgs/by-name/li/libseccomp/package.nix index 222bda60e16a..64677eb94051 100644 --- a/pkgs/by-name/li/libseccomp/package.nix +++ b/pkgs/by-name/li/libseccomp/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch, getopt, util-linuxMinimal, which, @@ -13,31 +12,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libseccomp"; - version = "2.6.0"; + version = "2.6.1"; src = fetchurl { url = "https://github.com/seccomp/libseccomp/releases/download/v${finalAttrs.version}/libseccomp-${finalAttrs.version}.tar.gz"; - hash = "sha256-g7YIUjLRWIw3ncm5yuR7s3QHzyYubnSZPGG6ctKnhNw="; + hash = "sha256-UB9mxmciXVN5G5fh18+Fq3ZMKX0EiB9g849FHEsO4b4="; }; - patches = [ - # Remove when version > 2.6.0 - # Fixes test failures on big-endian archs - (fetchpatch { - name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch"; - url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch"; - hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw="; - }) - - # Remove when version > 2.6.0 - # Fixes OOB reads & tests on musl - (fetchpatch { - name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch"; - url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch"; - hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY="; - }) - ]; - outputs = [ "out" "lib" diff --git a/pkgs/by-name/li/libtiff/package.nix b/pkgs/by-name/li/libtiff/package.nix index 3b6ba2345148..ed35ef461bf8 100644 --- a/pkgs/by-name/li/libtiff/package.nix +++ b/pkgs/by-name/li/libtiff/package.nix @@ -37,13 +37,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libtiff"; - version = "4.7.1"; + version = "4.7.2"; src = fetchFromGitLab { owner = "libtiff"; repo = "libtiff"; rev = "v${finalAttrs.version}"; - hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI="; + hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA="; }; patches = [ diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix index 7d96af03f96f..1b5f6193612a 100644 --- a/pkgs/by-name/li/limine/package.nix +++ b/pkgs/by-name/li/limine/package.nix @@ -47,14 +47,14 @@ in # as bootloader for various platforms and corresponding binary and helper files. stdenv.mkDerivation (finalAttrs: { pname = "limine"; - version = "12.4.1"; + version = "12.5.1"; # We don't use the Git source but the release tarball, as the source has a # `./bootstrap` script performing network access to download resources. # Packaging that in Nix is very cumbersome. src = fetchurl { url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz"; - hash = "sha256-LcpQkn1WTYCiRvLEmk31ii1KN62jHINb0oAoiF9t5V8="; + hash = "sha256-aGdx+IynrVBtI3Z5Zic/e5aVNWQeAFsxXr8xjIV1MTM="; }; enableParallelBuilding = true; diff --git a/pkgs/by-name/ma/mastodon/gemset.nix b/pkgs/by-name/ma/mastodon/gemset.nix index d2e16e05e7fa..f74aae9b8752 100644 --- a/pkgs/by-name/ma/mastodon/gemset.nix +++ b/pkgs/by-name/ma/mastodon/gemset.nix @@ -355,10 +355,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "074awkbb7rs9332vvxifxndrjambxf1bkj8w8hwj5krazk5l5h09"; + sha256 = "1zhj444iybzs1ikw1p4arv3zayw9xkk1ifnsb6g3r2j6p0h34gpf"; type = "gem"; }; - version = "3.252.0"; + version = "3.254.0"; }; aws-sdk-kms = { dependencies = [ @@ -384,10 +384,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "04k5wasssinx66vws2jn4vhzfisg30mkhbdmcs3m99dhp66kmcnl"; + sha256 = "0gjm1xbdjssjjhwhn4fm7jlj000vs43q3zm658x73ab8s33gcrc8"; type = "gem"; }; - version = "1.225.1"; + version = "1.228.1"; }; aws-sigv4 = { dependencies = [ "aws-eventstream" ]; @@ -1783,10 +1783,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1anz6a6n33x4s3906s0bz6x161kk1ns3h7xxsn3rpxkfsw7k2m33"; + sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v"; type = "gem"; }; - version = "2.19.8"; + version = "2.19.9"; }; json-canonicalization = { groups = [ "default" ]; @@ -2117,10 +2117,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl"; + sha256 = "062r891hxis58j5q735kk9sj5srxx0rv813f8m95bilsjm3gf1r0"; type = "gem"; }; - version = "2.25.1"; + version = "2.25.2"; }; mail = { dependencies = [ @@ -3421,10 +3421,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98"; + sha256 = "1hi25xz5ijz3kjx4vsiywqbq05mlkas7di8pwc3p6mhyn34sg5z7"; type = "gem"; }; - version = "1.7.0"; + version = "1.7.1"; }; rails-i18n = { dependencies = [ @@ -4843,10 +4843,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs"; + sha256 = "0ij19k6034x0c4hw0ywa7wnk5s912r8aq0hhjss10d5z36q5dicp"; type = "gem"; }; - version = "0.8.1"; + version = "0.8.2"; }; websocket-extensions = { groups = [ diff --git a/pkgs/by-name/ma/mastodon/source.nix b/pkgs/by-name/ma/mastodon/source.nix index 7d292595b1b4..1b13853c4904 100644 --- a/pkgs/by-name/ma/mastodon/source.nix +++ b/pkgs/by-name/ma/mastodon/source.nix @@ -5,17 +5,17 @@ patches ? [ ], }: let - version = "4.6.3"; + version = "4.6.4"; in applyPatches { src = fetchFromGitHub { owner = "mastodon"; repo = "mastodon"; rev = "v${version}"; - hash = "sha256-NMeI8Ev0CSIf0dfbjqVAmFuTU9MFC8Y3qO9gI3p8Y+4="; + hash = "sha256-lqtAsCIC+v161BH14wbyKfIN7jVVqJ6fi2pyFfX5ONg="; passthru = { inherit version; - yarnHash = "sha256-G1keSWDDpp0vBAOqQI8y8n7bmAeo9Hrdbo7R+cVZQwE="; + yarnHash = "sha256-VlOG91ZuO+1UXTbtwIrYUbqHjmSfPSfLhrf4TxCJqJ0="; yarnMissingHashes = ./missing-hashes.json; }; }; diff --git a/pkgs/by-name/mo/mozillavpn/package.nix b/pkgs/by-name/mo/mozillavpn/package.nix index 1b8102686852..365d85d8fff1 100644 --- a/pkgs/by-name/mo/mozillavpn/package.nix +++ b/pkgs/by-name/mo/mozillavpn/package.nix @@ -24,13 +24,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "mozillavpn"; - version = "2.38.0"; + version = "2.39.0"; src = fetchFromGitHub { owner = "mozilla-mobile"; repo = "mozilla-vpn-client"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; - hash = "sha256-IaMmW9ODlac/7Kqp9tEalVvLkUHaK786+HnTOqWVAk8="; + hash = "sha256-XEEvH+FBYZVUva8KwPSubFd6+bhdwqxrYk/tBgJve6g="; }; patches = [ ]; @@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: { cargoDeps = rustPlatform.fetchCargoVendor { inherit (finalAttrs) src patches; - hash = "sha256-Y4Y2ZZh9Kdj6zZCHgvLNdfB0ehaF5nDJSOjTLelmYrE="; + hash = "sha256-+CdJtFsmjS/y2oMv8mV317alc2oM0eUVj6aTuVMhv64="; }; buildInputs = [ diff --git a/pkgs/by-name/op/opengist/package.nix b/pkgs/by-name/op/opengist/package.nix index d2c0dac50ad5..fe22f29e9708 100644 --- a/pkgs/by-name/op/opengist/package.nix +++ b/pkgs/by-name/op/opengist/package.nix @@ -13,13 +13,13 @@ buildGoModule (finalAttrs: { pname = "opengist"; - version = "1.13.1"; + version = "1.14.0"; src = fetchFromGitHub { owner = "thomiceli"; repo = "opengist"; tag = "v${finalAttrs.version}"; - hash = "sha256-jMB6TudICAjX0DGw62qP8X39q3OOT2Bvg70LJbFWqkE="; + hash = "sha256-glKhgETje+TRmwnSWJ+fVla0hsyljZLnRKcM4xi+zQ8="; }; frontend = buildNpmPackage { @@ -36,10 +36,10 @@ buildGoModule (finalAttrs: { cp -R public $out ''; - npmDepsHash = "sha256-Ci25S0kgT5C46xTzNTs0kn8QEvYqJuj/yU33Ymfci68="; + npmDepsHash = "sha256-Zz6qoqTV/O73OrBL7ry1VXK9nF6Eb6QeqcefLpyMN1c="; }; - vendorHash = "sha256-MRY677UiZg7j5HTFejvuzIJwEMczbhi6sIbGYjRnWeM="; + vendorHash = "sha256-J4JMOCj7S8N0kX7VBZmrAiPuXjWur+MIkS8pMVmkLbs="; tags = [ "fs_embed" ]; diff --git a/pkgs/by-name/ou/outline/package.nix b/pkgs/by-name/ou/outline/package.nix index b8ed986bc21b..be0800e50df1 100644 --- a/pkgs/by-name/ou/outline/package.nix +++ b/pkgs/by-name/ou/outline/package.nix @@ -10,13 +10,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "outline"; - version = "1.9.1"; + version = "1.9.2"; src = fetchFromGitHub { owner = "outline"; repo = "outline"; rev = "v${finalAttrs.version}"; - hash = "sha256-F9JdeCuzmYeV2hxk0b1thQgo4cRl+aeUbBjK0MLzKH8="; + hash = "sha256-6w4Pso7I0ojbsbACEZrYuJsW9J2W38jY9uiErMQNeXE="; }; patches = [ @@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: { offlineCache = yarn-berry_4.fetchYarnBerryDeps { inherit (finalAttrs) src missingHashes patches; - hash = "sha256-xj6IBvANRQr2C/R47KrsSacPXqwtrAGv4ZeidJ4T5Hc="; + hash = "sha256-7nREE+sGd6ZUGfZ+YSIIGUaysMSEdap189koFQcV+hs="; }; buildPhase = '' diff --git a/pkgs/by-name/qu/quickjs/package.nix b/pkgs/by-name/qu/quickjs/package.nix index 344f873f03b3..6bad55b66e82 100644 --- a/pkgs/by-name/qu/quickjs/package.nix +++ b/pkgs/by-name/qu/quickjs/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "quickjs"; - version = "2025-09-13-2"; + version = "2026-06-04"; src = fetchurl { url = "https://bellard.org/quickjs/quickjs-${finalAttrs.version}.tar.xz"; - hash = "sha256-mWxrUBj8lVrU0GQm0OnLcTaFoAyCWqXAQYvVP334sLQ="; + hash = "sha256-s3boObMil4MT2Sn9IGY7EbpYt131pGwSbdGeovpwrSo="; }; outputs = [ @@ -121,11 +121,5 @@ stdenv.mkDerivation (finalAttrs: { maintainers = [ ]; mainProgram = "qjs"; platforms = lib.platforms.all; - # Pending upstream fix: https://github.com/bellard/quickjs/pull/483 - knownVulnerabilities = [ - "CVE-2026-1144" - "CVE-2026-1145" - "CVE-2026-3979" - ]; }; }) diff --git a/pkgs/by-name/ra/radicle-desktop/package.nix b/pkgs/by-name/ra/radicle-desktop/package.nix index 280879f22948..25e83ab44e24 100644 --- a/pkgs/by-name/ra/radicle-desktop/package.nix +++ b/pkgs/by-name/ra/radicle-desktop/package.nix @@ -26,13 +26,13 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "radicle-desktop"; - version = "0.13.0"; + version = "0.14.0"; src = fetchFromRadicle { seed = "seed.radicle.dev"; repo = "z4D5UCArafTzTQpDZNQRuqswh3ury"; tag = "releases/${finalAttrs.version}"; - hash = "sha256-XpzOzyUwAGLF/klXXbBFX5oLRSURB+AsL8n9WWv5x7s="; + hash = "sha256-yT51MCHt00JEUbuC6rcXN3L4Vul3aBa8YCgpGVzM5rQ="; leaveDotGit = true; postFetch = '' git -C $out rev-parse --short HEAD > $out/.git_head @@ -53,10 +53,10 @@ rustPlatform.buildRustPackage (finalAttrs: { npmDeps = fetchNpmDeps { inherit (finalAttrs) src; - hash = "sha256-EigvRDUmiuz/wt5vZ3NSxovxjvxHVGrHdA9HIod/fO8="; + hash = "sha256-HsPz3S2TL7TJzDU7c7IWgT7kO+FkloMsAWc8g5ZKofw="; }; - cargoHash = "sha256-HInTwQYuLVFnRCbQq2hNRPGJP1I9gBRQZQ9ul3DWtBQ="; + cargoHash = "sha256-BTSmfMrxNwAdoPuYn4hbx9C9myE1wJh+1FXPG78IgeU="; twemojiAssets = fetchFromGitHub { owner = "twitter"; diff --git a/pkgs/by-name/ta/talosctl/package.nix b/pkgs/by-name/ta/talosctl/package.nix index 42acc5a2119a..57bac41477a6 100644 --- a/pkgs/by-name/ta/talosctl/package.nix +++ b/pkgs/by-name/ta/talosctl/package.nix @@ -9,16 +9,16 @@ buildGoModule (finalAttrs: { pname = "talosctl"; - version = "1.13.5"; + version = "1.13.7"; src = fetchFromGitHub { owner = "siderolabs"; repo = "talos"; tag = "v${finalAttrs.version}"; - hash = "sha256-woMLG4m7snKD3naTZWYEu78zC/eK5lDxd+uLyXdkzMo="; + hash = "sha256-KT8ln7i3YkNS8GzMeNo+7ENXL5jAc+ZgyVL+7Ke4NDE="; }; - vendorHash = "sha256-98jQJ7M/3ki5L6YQAxtk3bBnixfXhLX4WXY7DN4hsQ4="; + vendorHash = "sha256-8v4xJT4HfE3tTFPPxXeqKMHNE/kKUVGE73flW17zXKM="; ldflags = [ "-s" diff --git a/pkgs/by-name/te/technitium-dns-server-library/package.nix b/pkgs/by-name/te/technitium-dns-server-library/package.nix index c5db4bfb27f8..0f1f5ddcc550 100644 --- a/pkgs/by-name/te/technitium-dns-server-library/package.nix +++ b/pkgs/by-name/te/technitium-dns-server-library/package.nix @@ -5,16 +5,17 @@ dotnetCorePackages, nix-update-script, }: -buildDotnetModule rec { +buildDotnetModule (finalAttrs: { pname = "technitium-dns-server-library"; version = "15.3.0"; + __structuredAttrs = true; + src = fetchFromGitHub { owner = "TechnitiumSoftware"; repo = "TechnitiumLibrary"; - tag = "dns-server-v${version}"; + tag = "dns-server-v${finalAttrs.version}"; hash = "sha256-BQWDzMEiChY8uX1wUUZNWFDomGqUyDrZ6+UEncC5G5U="; - name = "${pname}-${version}"; }; dotnet-sdk = dotnetCorePackages.sdk_10_0; @@ -41,4 +42,4 @@ buildDotnetModule rec { ]; platforms = lib.platforms.linux; }; -} +}) diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix index 6ddd88f61f89..812d429995a2 100644 --- a/pkgs/by-name/te/technitium-dns-server/package.nix +++ b/pkgs/by-name/te/technitium-dns-server/package.nix @@ -8,16 +8,17 @@ nixosTests, nix-update-script, }: -buildDotnetModule rec { +buildDotnetModule (finalAttrs: { pname = "technitium-dns-server"; version = "15.3.0"; + __structuredAttrs = true; + src = fetchFromGitHub { owner = "TechnitiumSoftware"; repo = "DnsServer"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-nopmnQpozvN0p/SyUCH3Yej/oAhDvNdfJssUA1JyGsk="; - name = "${pname}-${version}"; }; dotnet-sdk = dotnetCorePackages.sdk_10_0; @@ -59,4 +60,4 @@ buildDotnetModule rec { ]; platforms = lib.platforms.linux; }; -} +}) diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix index b5c1f90efce5..58c98c626a42 100644 --- a/pkgs/by-name/te/tectonic-unwrapped/package.nix +++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix @@ -28,16 +28,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "tectonic"; - version = "0.16.9"; + version = "0.17.0"; src = fetchFromGitHub { owner = "tectonic-typesetting"; repo = "tectonic"; rev = "tectonic@${finalAttrs.version}"; - sha256 = "sha256-5yphhmrrfgFwQ952eWpToyGfIJVJfV6y5w0BgznSOe0="; + sha256 = "sha256-7CdPo/tZSbBjRNCSr6IYLDsKjnzQzAsXbKBcFGCTfZg="; }; - cargoHash = "sha256-22Hy51zCzY2DRytcYHgwkI9+e/g52o1jy4eosvEm3KY="; + cargoHash = "sha256-5Vx5rwRHNGQXg3WmUQO+612YqxxwHp4R72P4agWI8Kk="; nativeBuildInputs = [ pkg-config diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix index ad04029c4b80..75cb3cc49134 100644 --- a/pkgs/by-name/tz/tzdata/package.nix +++ b/pkgs/by-name/tz/tzdata/package.nix @@ -8,16 +8,16 @@ stdenv.mkDerivation (finalAttrs: { pname = "tzdata"; - version = "2026b"; + version = "2026c"; srcs = [ (fetchurl { url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz"; - hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ="; + hash = "sha256-5KF4pEd/PQ6nfMMYKP9yqjj+/41hqhPn6Z4ULp2QK+Q="; }) (fetchurl { url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz"; - hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q="; + hash = "sha256-sc/8Os5MTHzQ77ovet2G7D0LedpIvPA1gmcf08j+rOg="; }) ]; diff --git a/pkgs/by-name/uv/uvwasi/package.nix b/pkgs/by-name/uv/uvwasi/package.nix index 8d48132e945e..5194fdc7ab07 100644 --- a/pkgs/by-name/uv/uvwasi/package.nix +++ b/pkgs/by-name/uv/uvwasi/package.nix @@ -8,6 +8,7 @@ stdenv, testers, validatePkgConfig, + static ? stdenv.hostPlatform.isStatic, # generates static libraries *only* }: stdenv.mkDerivation (finalAttrs: { @@ -21,6 +22,20 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-+vz/qTMRRDHV1VE4nny9vYYtarZHk1xoM4EZiah3jnY="; }; + patches = [ + # FIXME: remove when included in a release + (fetchpatch2 { + url = "https://github.com/nodejs/uvwasi/commit/0820128569533c855d60c0f6382acbb14aa62ad2.patch?full_index=1"; + hash = "sha256-psjivoarqisOuCdVJAWuFH0aITzwb/obmal3ewVXvG4="; + }) + ]; + postPatch = lib.optionalString static '' + substituteInPlace CMakeLists.txt --replace-fail 'TARGETS uvwasi_a uvwasi' 'TARGETS uvwasi_a' + ''; + cmakeFlags = [ + (lib.cmakeBool "UVWASI_BUILD_SHARED" (!static)) + ]; + outputs = [ "out" ]; diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix index 17cc2e9418ca..934fade5a795 100644 --- a/pkgs/by-name/xv/xvfb/package.nix +++ b/pkgs/by-name/xv/xvfb/package.nix @@ -38,14 +38,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "xvfb"; - # TODO: commented out for rebuild avoidance after xorg-server update. revert - # on staging. - # inherit (xorg-server) src version; - version = "21.1.23"; - src = fetchurl { - url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz"; - hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ="; - }; + inherit (xorg-server) src version; strictDeps = true; diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix index c22987044c21..41188be3c3c7 100644 --- a/pkgs/by-name/zo/zoom-us/package.nix +++ b/pkgs/by-name/zo/zoom-us/package.nix @@ -54,25 +54,25 @@ let # Zoom versions are released at different times per platform and often with different versions. # We write them on three lines like this (rather than using {}) so that the updater script can # find where to edit them. - versions.aarch64-darwin = "7.0.5.81138"; - versions.x86_64-darwin = "7.0.5.81138"; + versions.aarch64-darwin = "7.1.5.84650"; + versions.x86_64-darwin = "7.1.5.84650"; # This is the fallback version so that evaluation can produce a meaningful result. - versions.x86_64-linux = "7.0.5.3034"; + versions.x86_64-linux = "7.1.5.4332"; srcs = { aarch64-darwin = fetchurl { url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64"; name = "zoomusInstallerFull.pkg"; - hash = "sha256-uFnwBVZn5iUTIHNYG2WqiULA8siGWJaqY0BcRCoU6gg="; + hash = "sha256-Sc9wr2dBdvNwi507UZ9YVCTEQsz3RP2WWTJ5Z5ccgnk="; }; x86_64-darwin = fetchurl { url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg"; - hash = "sha256-ZeTgrqkpYumSGlbv/O8/GKALns4bNaFJR3CgV4Mswb4="; + hash = "sha256-YvawpkcIS02m+uw6aF387hK5Akxqm1GyXFEzM4qXqQI="; }; x86_64-linux = fetchurl { url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz"; - hash = "sha256-eHJIkY1qRC7z3+k6AMog2wlby8Wgupy48A5O7UKRiVU="; + hash = "sha256-5znZNrySgRrs9I5zhqN5p5dPfXpEHXKf8o2dWeYTPso="; }; }; diff --git a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch new file mode 100644 index 000000000000..5e55d1242bb4 --- /dev/null +++ b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch @@ -0,0 +1,69 @@ +From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 19 Jun 2026 18:22:20 +0200 +Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf + +This makes the output more consistent (either failure or complete +output) and helps with systematic testing with varying buffer +sizes. + +Reviewed-by: Carlos O'Donell +Reviewed-by: Adhemerval Zanella +(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a) +--- + resolv/ns_print.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index cef2212fd2..cb680fb74e 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + switch (type) { + case ns_t_a: + if (rdlen != (size_t)NS_INADDRSZ) +- goto formerr; +- (void) inet_ntop(AF_INET, rdata, buf, buflen); ++ goto formerr; ++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + break; + +@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + } + + case ns_t_aaaa: +- if (rdlen != (size_t)NS_IN6ADDRSZ) +- goto formerr; +- (void) inet_ntop(AF_INET6, rdata, buf, buflen); ++ if (rdlen != (size_t)NS_IN6ADDRSZ) ++ goto formerr; ++ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + break; + +@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + goto formerr; + + /* Address. */ +- (void) inet_ntop(AF_INET, rdata, buf, buflen); ++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + rdata += NS_INADDRSZ; + +@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + if (rdata + pbyte >= edata) goto formerr; + memset(&a, 0, sizeof(a)); + memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); +- (void) inet_ntop(AF_INET6, &a, buf, buflen); ++ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + rdata += sizeof(a) - pbyte; + } +-- +2.54.0 + diff --git a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch new file mode 100644 index 000000000000..5b39165a43b0 --- /dev/null +++ b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch @@ -0,0 +1,134 @@ +From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 19 Jun 2026 18:22:20 +0200 +Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf + (CVE-2026-5435) + +Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy +implementations of TSIG, fixing bug 34033, and partially +fixing bug 34069. + +Reviewed-by: Carlos O'Donell +Reviewed-by: Adhemerval Zanella +(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72) +--- + resolv/ns_print.c | 96 ----------------------------------------------- + 1 file changed, 96 deletions(-) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index cb680fb74e..8c876b147e 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + break; + } + +- case ns_t_cert: { +- u_int c_type, key_tag, alg; +- int n; +- unsigned int siz; +- char base64_cert[8192], tmp[40]; +- const char *leader; +- +- c_type = ns_get16(rdata); rdata += NS_INT16SZ; +- key_tag = ns_get16(rdata); rdata += NS_INT16SZ; +- alg = (u_int) *rdata++; +- +- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg)); +- T(addstr(tmp, len, &buf, &buflen)); +- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */ +- if (siz > sizeof(base64_cert) * 3/4) { +- const char *str = "record too long to print"; +- T(addstr(str, strlen(str), &buf, &buflen)); +- } +- else { +- len = b64_ntop(rdata, edata-rdata, base64_cert, siz); +- +- if (len < 0) +- goto formerr; +- else if (len > 15) { +- T(addstr(" (", 2, &buf, &buflen)); +- leader = "\n\t\t"; +- spaced = 0; +- } +- else +- leader = " "; +- +- for (n = 0; n < len; n += 48) { +- T(addstr(leader, strlen(leader), +- &buf, &buflen)); +- T(addstr(base64_cert + n, MIN(len - n, 48), +- &buf, &buflen)); +- } +- if (len > 15) +- T(addstr(" )", 2, &buf, &buflen)); +- } +- break; +- } +- +- case ns_t_tkey: { +- /* KJD - need to complete this */ +- u_long t; +- int mode, err, keysize; +- +- /* Algorithm name. */ +- T(addname(msg, msglen, &rdata, origin, &buf, &buflen)); +- T(addstr(" ", 1, &buf, &buflen)); +- +- /* Inception. */ +- t = ns_get32(rdata); rdata += NS_INT32SZ; +- len = SPRINTF((tmp, "%lu ", t)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* Expiration. */ +- t = ns_get32(rdata); rdata += NS_INT32SZ; +- len = SPRINTF((tmp, "%lu ", t)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* Mode , Error, Key Size. */ +- /* Priority, Weight, Port. */ +- mode = ns_get16(rdata); rdata += NS_INT16SZ; +- err = ns_get16(rdata); rdata += NS_INT16SZ; +- keysize = ns_get16(rdata); rdata += NS_INT16SZ; +- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* XXX need to dump key, print otherdata length & other data */ +- break; +- } +- +- case ns_t_tsig: { +- /* BEW - need to complete this */ +- int n; +- +- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen)); +- T(addstr(" ", 1, &buf, &buflen)); +- rdata += 8; /*%< time */ +- n = ns_get16(rdata); rdata += INT16SZ; +- rdata += n; /*%< sig */ +- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */ +- sprintf(buf, "%d", ns_get16(rdata)); +- rdata += INT16SZ; +- addlen(strlen(buf), &buf, &buflen); +- break; +- } +- + case ns_t_a6: { + struct in6_addr a; + int pbyte, pbit; +@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + break; + } + +- case ns_t_opt: { +- len = SPRINTF((tmp, "%u bytes", class)); +- T(addstr(tmp, len, &buf, &buflen)); +- break; +- } +- + default: + snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type); + comment = errbuf; +-- +2.54.0 + diff --git a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch new file mode 100644 index 000000000000..8bde49f159e0 --- /dev/null +++ b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch @@ -0,0 +1,66 @@ +From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 19 Jun 2026 18:22:20 +0200 +Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf + (CVE-2026-6238) + +Check that the RDATA payload does not require more than RDATALEN +bytes while processing it. The fixes cover A6, LOC records. +(CERT, TKEY, TSIG were fixed before, by switching to the generic +formatter.) + +The vulnerable LOC record handling was first introduced before +glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. + +CERT, TSIG, TKEY handling came with commit +b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. + +A6 record handling was introduced in commit +91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c +(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc +2.7. + +This fixes bug 34069. + +Reviewed-by: Carlos O'Donell +Reviewed-by: Adhemerval Zanella +(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a) +--- + resolv/ns_print.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index 8c876b147e..6832255a25 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + case ns_t_loc: { + char t[255]; + +- /* XXX protocol format checking? */ ++ if (rdlen != 16) ++ goto formerr; + (void) loc_ntoa(rdata, t); + T(addstr(t, strlen(t), &buf, &buflen)); + break; +@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + + /* address suffix: provided only when prefix len != 128 */ + if (pbit < 128) { +- if (rdata + pbyte >= edata) goto formerr; ++ unsigned int bytelen = sizeof(a) - pbyte; ++ if (edata - rdata < bytelen) goto formerr; + memset(&a, 0, sizeof(a)); +- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); ++ memcpy(&a.s6_addr[pbyte], rdata, bytelen); + if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) + return -1; + addlen(strlen(buf), &buf, &buflen); +- rdata += sizeof(a) - pbyte; ++ rdata += bytelen; + } + + /* prefix name: provided only when prefix len > 0 */ +-- +2.54.0 + diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index b6c6a6c86445..577682f7cd96 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -116,6 +116,15 @@ stdenv.mkDerivation ( # enable parallel & reproducible build of glibcLocales ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch ./0002-Makeconfig-make-inst_complocaledir-overridable.patch + + # Security fixes. + # + # Can be dropped on 2.44. The first patch is only to make it + # easier to backport the fix for CVE-2026-6238 and it seems + # useful in its own right anyhow. + ./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch + ./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch + ./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch ] /* NVCC does not support ARM intrinsics. Since is pulled in by almost diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix index 9c531daf1486..b40675d820b4 100644 --- a/pkgs/development/libraries/gstreamer/good/default.nix +++ b/pkgs/development/libraries/gstreamer/good/default.nix @@ -95,6 +95,26 @@ stdenv.mkDerivation (finalAttrs: { (replaceVars ./souploader.diff { nixLibSoup3Path = "${lib.getLib libsoup_3}/lib"; }) + # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11262 + (fetchpatch { + name = "GStreamer-SA-2026-0021-1.patch"; + url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/35a905a92f4cfc85941c6c820009ac9219f755b2.patch"; + sha256 = "sha256-1SgQo+wb2Adcgrz3zn6/qn248vnBdPuk2oJ1v9+Dbzo="; + stripLen = 2; + }) + (fetchpatch { + name = "GStreamer-SA-2026-0021-2.patch"; + url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0d819ceb654b06bbdd54381da5363c16751758a2.patch"; + sha256 = "sha256-a8P1YxLNMkYka01+8MhBO+uSzGbR186sumlQk5LuGfY="; + stripLen = 2; + }) + # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11263 + (fetchpatch { + name = "GStreamer-SA-2026-0022.patch"; + url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6db6dd058ebc3607452311b7dc47b0359b40b293.patch"; + sha256 = "sha256-gaBUpEdZB0PrnI1IR53jtM0kecHpUIzavUdADN1NNlQ="; + stripLen = 2; + }) ]; strictDeps = true; diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix index b5ed5a969db7..40ae39918d8c 100644 --- a/pkgs/development/libraries/silgraphite/graphite2.nix +++ b/pkgs/development/libraries/silgraphite/graphite2.nix @@ -2,7 +2,7 @@ lib, stdenv, llvmPackages, - fetchpatch, + python3, fetchurl, pkg-config, freetype, @@ -12,14 +12,14 @@ }: stdenv.mkDerivation (finalAttrs: { - version = "1.3.14"; + version = "1.3.15"; pname = "graphite2"; src = fetchurl { url = with finalAttrs; "https://github.com/silnrsi/graphite/releases/download/${version}/${pname}-${version}.tgz"; - sha256 = "1790ajyhk0ax8xxamnrk176gc9gvhadzy78qia4rd8jzm89ir7gr"; + hash = "sha256-xryLQlJyRmUpf3ytDFWJcoXGc/m45ts1IqzoM1k/4LE="; }; outputs = [ @@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ pkg-config + (python3.withPackages (ps: [ ps.fonttools ])) cmake ]; buildInputs = [ @@ -40,14 +41,7 @@ stdenv.mkDerivation (finalAttrs: { } ); - patches = [ - # Fix build with gcc15 - (fetchpatch { - url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch"; - hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw="; - }) - ] - ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ]; + patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ]; postPatch = '' # disable broken 'nametabletest' test, fails on gcc-13: # https://github.com/silnrsi/graphite/pull/74 @@ -61,22 +55,6 @@ stdenv.mkDerivation (finalAttrs: { # headers are located in the dev output: substituteInPlace CMakeLists.txt \ --replace-fail ' ''${CMAKE_INSTALL_PREFIX}/include' " ${placeholder "dev"}/include" - - # Fix the build with CMake 4. - # - # See: - badCmakeFiles=( - CMakeLists.txt - src/CMakeLists.txt - tests/{bittwiddling,json,sparsetest,utftest}/CMakeLists.txt - gr2fonttest/CMakeLists.txt - ) - for file in "''${badCmakeFiles[@]}"; do - substituteInPlace "$file" \ - --replace-fail \ - 'CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0 FATAL_ERROR)' \ - 'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)' - done ''; cmakeFlags = lib.optionals static [ diff --git a/pkgs/development/python-modules/quickjs/0002-Update-for-QuickJS-2026-06-04-release.patch b/pkgs/development/python-modules/quickjs/0002-Update-for-QuickJS-2026-06-04-release.patch new file mode 100644 index 000000000000..fde39064e8c2 --- /dev/null +++ b/pkgs/development/python-modules/quickjs/0002-Update-for-QuickJS-2026-06-04-release.patch @@ -0,0 +1,20 @@ +--- a/test_quickjs.py ++++ b/test_quickjs.py +@@ -119,7 +119,7 @@ + """ + self.context.eval(code) + self.context.set_memory_limit(1000) +- with self.assertRaisesRegex(quickjs.JSException, "null"): ++ with self.assertRaisesRegex(quickjs.JSException, "out of memory"): + self.context.eval(code) + self.context.set_memory_limit(1000000) + self.context.eval(code) +@@ -508,7 +508,7 @@ + """) + + self.assertEqual(f(100), 100) +- limit = 1500 ++ limit = 3000 + with self.assertRaises(quickjs.StackOverflow): + f(limit) + f.set_max_stack_size(2000 * limit) diff --git a/pkgs/development/python-modules/quickjs/default.nix b/pkgs/development/python-modules/quickjs/default.nix index 1d5726bee259..3be0bd06a147 100644 --- a/pkgs/development/python-modules/quickjs/default.nix +++ b/pkgs/development/python-modules/quickjs/default.nix @@ -24,7 +24,11 @@ buildPythonPackage rec { hash = "sha256-nLloXJWOuaK/enZfwXJI94IcsAMYrkBtG4i3gmxuhfw="; }; - patches = [ ./0001-Update-for-QuickJS-2025-04-26-release.patch ]; + patches = [ + ./0001-Update-for-QuickJS-2025-04-26-release.patch + # Refreshes two stale resource-limit test expectations for the newer quickjs nixpkgs de-vendors + ./0002-Update-for-QuickJS-2026-06-04-release.patch + ]; # Upstream uses Git submodules; let's de-vendor and use Nix, so that we gain security fixes like # https://github.com/NixOS/nixpkgs/pull/407469 diff --git a/pkgs/development/tools/build-managers/gradle/update-deps.nix b/pkgs/development/tools/build-managers/gradle/update-deps.nix index 814aa888960b..b31a5c755667 100644 --- a/pkgs/development/tools/build-managers/gradle/update-deps.nix +++ b/pkgs/development/tools/build-managers/gradle/update-deps.nix @@ -37,6 +37,7 @@ lib.makeOverridable ( ]; gradleScript = writeShellScript "gradle-commands.sh" '' set -eo pipefail + if [ -e "''${NIX_ATTRS_SH_FILE:-}" ]; then . "$NIX_ATTRS_SH_FILE"; fi export http_proxy="$MITM_CACHE_ADDRESS" export https_proxy="$MITM_CACHE_ADDRESS" export SSL_CERT_FILE="$MITM_CACHE_CA" diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index df3b586a2b0f..5d9aaeea6438 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,7 +1,7 @@ { "testing": { - "version": "7.2-rc4", - "hash": "sha256:02qab36m7xzfwqdrylpacvlkjaxfa0mlnmk38fix6anqi3hgjq3q", + "version": "7.2-rc5", + "hash": "sha256:05vi7q57qj4nybk3m38araknj6yxaaqjdd0cnw07c07qrjcd2lm7", "lts": false }, "6.1": { diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix index 2cbdfd2fa593..87d2946e6160 100644 --- a/pkgs/tools/text/gawk/default.nix +++ b/pkgs/tools/text/gawk/default.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchurl, + fetchpatch, removeReferencesTo, runtimeShellPackage, texinfo, @@ -25,13 +26,23 @@ assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null; stdenv.mkDerivation rec { pname = "gawk" + lib.optionalString interactive "-interactive"; - version = "5.4.0"; + version = "5.4.1"; src = fetchurl { url = "mirror://gnu/gawk/gawk-${version}.tar.xz"; - hash = "sha256-PdQw8M07RCjGw/avwCG5zTwfjJP3pojcJoykKKkLSsE="; + hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc="; }; + patches = [ + # When building gawk without gmp and mpfr, gawk 5.4.1 causes build failures + # in downstream packages such as GCC and libpng. + # Discussion on bug-gawk: + # https://lists.gnu.org/archive/html/bug-gawk/2026-07/msg00013.html + # Vendored since we can't use fetchpatch: + # https://gitweb.git.savannah.gnu.org/gitweb/?p=gawk.git;a=commit;h=bf85f8a3175af703597082d4c7e0abc2066a44d3 + ./node-struct-without-gmp-mpfr.patch + ]; + # When we do build separate interactive version, it makes sense to always include man. outputs = [ "out" diff --git a/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch b/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch new file mode 100644 index 000000000000..01f660c191e8 --- /dev/null +++ b/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch @@ -0,0 +1,79 @@ +From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Tue, 14 Jul 2026 10:14:50 +0300 +Subject: [PATCH] Workaround fix for systems without MPFR and GMP. + +--- + ChangeLog | 8 ++++++++ + awk.h | 23 ++++++++++++++--------- + 2 files changed, 22 insertions(+), 9 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index 6a955eed..42bd2c48 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -3,6 +3,14 @@ + * builtin.c (do_dump_node): Add the size of each object to + the printout. + ++ Unrelated: Make things works when built on systems without ++ the GMP and MPFR libraries. Thanks to Thomas Trepl ++ and Bruce Dubbs for the reports. ++ ++ * awk.h (struct exp_node): Add alignment padding when we don't ++ have MPFR. This is a hack, pending a total refactoring of ++ the NODE structure. ++ + 2026-07-08 Arnold D. Robbins + + * 5.4.1: Release tar ball made. +diff --git a/awk.h b/awk.h +index dbad0d81..f4a84300 100644 +--- a/awk.h ++++ b/awk.h +@@ -406,17 +406,24 @@ typedef struct exp_node { + } nodep; + + struct { +-#ifdef HAVE_MPFR + union { + AWKNUM fltnum; ++#ifdef HAVE_MPFR + mpfr_t mpnum; + mpz_t mpi; +- } nm; +- int rndmode; + #else +- AWKNUM fltnum; +- int for_alignment_only; // especially on 32-bit +-#endif ++ // 7/2026: ++ // This is a workaround for systems that build ++ // gawk without MPFR and GMP. The NODE struct ++ // desperately needs to be refactored. ++#if SIZEOF_VOID_P == 4 ++ char alignment[28]; ++#else // SIZEOF_VOID_P != 4 ++ char alignment[48]; ++#endif // SIZEOF_VOID_P != 4 ++#endif // HAVE_MPFR ++ } nm; ++ int rndmode; // only used for MPFR. + char *sp; + size_t slen; + int idx; +@@ -561,10 +568,8 @@ typedef struct exp_node { + #ifdef HAVE_MPFR + #define mpg_numbr sub.val.nm.mpnum + #define mpg_i sub.val.nm.mpi +-#define numbr sub.val.nm.fltnum +-#else +-#define numbr sub.val.fltnum + #endif ++#define numbr sub.val.nm.fltnum + #define typed_re sub.val.typre + + /* +-- +2.54.0 +