From ca5fcfa95951c29f7d45eddbba9cd1f282434da3 Mon Sep 17 00:00:00 2001 From: OTABI Tomoya Date: Sun, 22 Oct 2023 23:51:40 +0900 Subject: [PATCH 1/7] Merge pull request #262695 from LudovicoPiero/armcord/3.2.5 [Backport release-23.05] armcord: 3.2.4-libwebp -> 3.2.5 --- .../instant-messengers/armcord/default.nix | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/armcord/default.nix b/pkgs/applications/networking/instant-messengers/armcord/default.nix index 46f69464f6ba..c26da089e3a0 100644 --- a/pkgs/applications/networking/instant-messengers/armcord/default.nix +++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix @@ -20,7 +20,6 @@ , glib , gtk3 , libappindicator-gtk3 -, libdbusmenu , libdrm , libnotify , libpulseaudio @@ -39,7 +38,7 @@ stdenv.mkDerivation rec { pname = "armcord"; - version = "3.2.4"; + version = "3.2.5"; src = let @@ -47,12 +46,12 @@ stdenv.mkDerivation rec { in { x86_64-linux = fetchurl { - url = "${base}/v${version}/ArmCord_${version}_amd64.deb"; - hash = "sha256-IUHcDHIJeGx7QKjxl3fUFHqUfs1JdIFxesvDXt3mVw0="; + url = "${base}/v${version}/ArmCord_${builtins.head (lib.splitString "-" version)}_amd64.deb"; + hash = "sha256-6zlYm4xuYpG+Bgsq5S+B/Zt9TRB2GZnueKAg2ywYLE4="; }; aarch64-linux = fetchurl { - url = "${base}/v${version}/ArmCord_${version}_arm64.deb"; - hash = "sha256-TWVlEjakdRyZmOuBq9HLO+R7y5jmgstFtyEHjf8nxxM="; + url = "${base}/v${version}/ArmCord_${builtins.head (lib.splitString "-" version)}_arm64.deb"; + hash = "sha256-HJu1lRa3zOTohsPMe23puHxg1VMWNR2aOjDQJqc4TqE="; }; }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}"); @@ -137,6 +136,5 @@ stdenv.mkDerivation rec { license = licenses.osl3; maintainers = with maintainers; [ ludovicopiero wrmilling ]; platforms = [ "x86_64-linux" "aarch64-linux" ]; - knownVulnerabilities = [ "CVE-2023-4863" ]; }; } From eb29ef605a8f4199ae64eeb5537e5ae0440c920c Mon Sep 17 00:00:00 2001 From: Vincent Haupert Date: Tue, 24 Oct 2023 11:44:49 +0200 Subject: [PATCH 2/7] github-runner: 2.310.2 -> 2.311.0 (cherry picked from commit 05bd5e12bd62067c3f63aa4209f7ad9fc8f4254f) --- .../tools/continuous-integration/github-runner/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix index 9bee0babd23d..650de5fe4117 100644 --- a/pkgs/development/tools/continuous-integration/github-runner/default.nix +++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix @@ -17,13 +17,13 @@ }: buildDotnetModule rec { pname = "github-runner"; - version = "2.310.2"; + version = "2.311.0"; src = fetchFromGitHub { owner = "actions"; repo = "runner"; rev = "v${version}"; - hash = "sha256-cOHA4VjccIJmCgCxRrBFzBFnh4SGQ3LpcTvtGuogHQU="; + hash = "sha256-71SwPuX1XZygT/TdAHECudxFxsQuXrl/tcAYVAxfxfI="; leaveDotGit = true; postFetch = '' git -C $out rev-parse --short HEAD > $out/.git-revision From 545d20eb7d363155a14f355d61789334765ee7f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felix=20Schr=C3=B6ter?= Date: Wed, 25 Oct 2023 21:15:56 +0200 Subject: [PATCH 3/7] mullvad-browser: 13.0 -> 13.0.1 (cherry picked from commit 9e136592738f0d016e20bb44239e62d30f219fa3) --- .../networking/browsers/mullvad-browser/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/mullvad-browser/default.nix b/pkgs/applications/networking/browsers/mullvad-browser/default.nix index c95ff68af6dc..faeb53683a83 100644 --- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix +++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix @@ -78,7 +78,7 @@ let ++ lib.optionals mediaSupport [ ffmpeg ] ); - version = "13.0"; + version = "13.0.1"; sources = { x86_64-linux = fetchurl { @@ -90,7 +90,7 @@ let "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz" "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz" ]; - hash = "sha256-YtkGgSnQVJ9wtamDOtLROufhPJ9KizV8j5kK26iJ+ZY="; + hash = "sha256-VYkRHWyTAAt5P7jnNuf4s2bOv36LuqcTMMKOLRGE9FQ="; }; }; From 3299034e8dd45311de9278ffbd73c71d558e8abc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felix=20Schr=C3=B6ter?= Date: Wed, 25 Oct 2023 21:10:29 +0200 Subject: [PATCH 4/7] tor-browser: 13.0 -> 13.0.1 (cherry picked from commit de2ced25d80d8bf8d5b9e3a2b4848d7fb0edefba) --- .../networking/browsers/tor-browser-bundle-bin/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix index 83c946ce2fe9..b811715a5d82 100644 --- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix +++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix @@ -86,7 +86,7 @@ lib.warnIf (useHardenedMalloc != null) ffmpeg ]; - version = "13.0"; + version = "13.0.1"; sources = { x86_64-linux = fetchurl { @@ -96,7 +96,7 @@ lib.warnIf (useHardenedMalloc != null) "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" ]; - hash = "sha256-zdmPbmJo5FDoOjob+9TDCvCgKgLHvLi3bOMhcZg8DVM="; + hash = "sha256-ORa973US2VY9Can4Nr35YSpZrYGqBP4I/S/ulsbRJLc="; }; i686-linux = fetchurl { @@ -106,7 +106,7 @@ lib.warnIf (useHardenedMalloc != null) "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" ]; - hash = "sha256-Hlvx2C4DF/wcHo9ES+g9UUgNFGDokW5OAX3FeOvR+fY="; + hash = "sha256-OBUleXLTNFG+aFuftnphgBtQCfyoIWDcoVFs5elJ0tA="; }; }; From cf513685cee6ebba2275fb8fe161d5ea7113eb53 Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Thu, 26 Oct 2023 17:56:07 +0200 Subject: [PATCH 5/7] vencord: 1.5.8 -> 1.6.0 Signed-off-by: Sefa Eyeoglu (cherry picked from commit df44b52336f82def62d8f79710ccf70eb7fed7d5) --- pkgs/misc/vencord/default.nix | 8 +++---- pkgs/misc/vencord/package-lock.json | 33 ++++++++++++++++++----------- 2 files changed, 25 insertions(+), 16 deletions(-) diff --git a/pkgs/misc/vencord/default.nix b/pkgs/misc/vencord/default.nix index 0fa670faf61e..02c4025ba463 100644 --- a/pkgs/misc/vencord/default.nix +++ b/pkgs/misc/vencord/default.nix @@ -5,8 +5,8 @@ , buildWebExtension ? false }: let - version = "1.5.8"; - gitHash = "544edce"; + version = "1.6.0"; + gitHash = "ffe6bb1"; in buildNpmPackage rec { pname = "vencord"; @@ -16,7 +16,7 @@ buildNpmPackage rec { owner = "Vendicated"; repo = "Vencord"; rev = "v${version}"; - hash = "sha256-cJ+8CKCET7Z2MebyrW5OQr50tvbDM3mkvEQQm3zSbdU="; + hash = "sha256-t4+8ybPzqcCtTSukBBgvbD7HiKG4K51WPVnJg0RQbs8="; }; ESBUILD_BINARY_PATH = lib.getExe (esbuild.overrideAttrs (final: _: { @@ -34,7 +34,7 @@ buildNpmPackage rec { npmRebuildFlags = [ "|| true" ]; makeCacheWritable = true; - npmDepsHash = "sha256-JeJjjrCfJMuxP9sVVkKJQ7bRCGu0jbGfiw78jS0r2Sg="; + npmDepsHash = "sha256-H2f6xdAa7fNETbQhIv+InCB7+O4nq0bx+RILjGjqXdY="; npmFlags = [ "--legacy-peer-deps" ]; npmBuildScript = if buildWebExtension then "buildWeb" else "build"; npmBuildFlags = [ "--" "--standalone" "--disable-updater" ]; diff --git a/pkgs/misc/vencord/package-lock.json b/pkgs/misc/vencord/package-lock.json index 3c06525bb5bb..ad21cfc0c858 100644 --- a/pkgs/misc/vencord/package-lock.json +++ b/pkgs/misc/vencord/package-lock.json @@ -1,12 +1,12 @@ { "name": "vencord", - "version": "1.5.8", + "version": "1.6.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "vencord", - "version": "1.5.8", + "version": "1.6.0", "license": "GPL-3.0-or-later", "dependencies": { "@sapphi-red/web-noise-suppressor": "0.3.3", @@ -694,9 +694,9 @@ } }, "node_modules/@eslint-community/regexpp": { - "version": "4.9.1", - "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.9.1.tgz", - "integrity": "sha512-Y27x+MBLjXa+0JWDhykM3+JE+il3kHKAEqabfEWq3SDhZjLYb6/BHL/JKFnH3fe207JaXkyDo685Oc2Glt6ifA==", + "version": "4.10.0", + "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.10.0.tgz", + "integrity": "sha512-Cu96Sd2By9mCNTx2iyKOmq10v22jUVQv0lQnlGNy16oE9589yE+QADPbrMGCkA51cKZSg3Pu/aTJVTGfL/qjUA==", "dev": true, "engines": { "node": "^12.0.0 || ^14.0.0 || >=16.0.0" @@ -893,10 +893,13 @@ "dev": true }, "node_modules/@types/node": { - "version": "18.18.6", - "resolved": "https://registry.npmjs.org/@types/node/-/node-18.18.6.tgz", - "integrity": "sha512-wf3Vz+jCmOQ2HV1YUJuCWdL64adYxumkrxtc+H1VUQlnQI04+5HtH+qZCOE21lBE7gIrt+CwX2Wv8Acrw5Ak6w==", - "dev": true + "version": "18.18.7", + "resolved": "https://registry.npmjs.org/@types/node/-/node-18.18.7.tgz", + "integrity": "sha512-bw+lEsxis6eqJYW8Ql6+yTqkE6RuFtsQPSe5JxXbqYRFQEER5aJA9a5UH9igqDWm3X4iLHIKOHlnAXLM4mi7uQ==", + "dev": true, + "dependencies": { + "undici-types": "~5.26.4" + } }, "node_modules/@types/normalize-package-data": { "version": "2.4.3", @@ -911,9 +914,9 @@ "dev": true }, "node_modules/@types/react": { - "version": "18.2.31", - "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.31.tgz", - "integrity": "sha512-c2UnPv548q+5DFh03y8lEDeMfDwBn9G3dRwfkrxQMo/dOtRHUUO57k6pHvBIfH/VF4Nh+98mZ5aaSe+2echD5g==", + "version": "18.2.33", + "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.33.tgz", + "integrity": "sha512-v+I7S+hu3PIBoVkKGpSYYpiBT1ijqEzWpzQD62/jm4K74hPpSP7FF9BnKG6+fg2+62weJYkkBWDJlZt5JO/9hg==", "dev": true, "dependencies": { "@types/prop-types": "*", @@ -5549,6 +5552,12 @@ "through": "^2.3.8" } }, + "node_modules/undici-types": { + "version": "5.26.5", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz", + "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==", + "dev": true + }, "node_modules/union-value": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz", From 1b7cd3298d630d336ee53cbb5ef28b2a6bae621b Mon Sep 17 00:00:00 2001 From: Jeremy Kolb Date: Fri, 27 Oct 2023 15:25:46 -0400 Subject: [PATCH 6/7] open-vm-tools: Address CVE-2023-34058 https://github.com/vmware/open-vm-tools/blob/CVE-2023-34058.patch/README.md --- .../virtualization/open-vm-tools/default.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix index f60c9626c553..102d0bffc89c 100644 --- a/pkgs/applications/virtualization/open-vm-tools/default.nix +++ b/pkgs/applications/virtualization/open-vm-tools/default.nix @@ -1,5 +1,6 @@ { stdenv , lib +, fetchpatch , fetchFromGitHub , makeWrapper , autoreconfHook @@ -90,6 +91,15 @@ stdenv.mkDerivation rec { libXtst ]; + patches = [ + (fetchpatch { + name = "CVE-2023-34058.patch"; + url = "https://raw.githubusercontent.com/vmware/open-vm-tools/CVE-2023-34058.patch/CVE-2023-34058.patch"; + hash = "sha256-KC99LzGcWTXUhtOLQ6UbqxGJ+0Uj4QLWyuRYeGle3a4="; + stripLen = 1; + }) + ]; + postPatch = '' sed -i Makefile.am \ -e 's,etc/vmware-tools,''${prefix}/etc/vmware-tools,' From ba1c1f67011cbc77d452f5b36597fefc59af1403 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Sun, 10 Sep 2023 13:43:45 +0200 Subject: [PATCH 7/7] nixos/nginx: add `application/javascript` to `compressMimeTypes` Although deprecated, this MIME type is still used by various applications and web frameworks which are potentially proxied by nginx. Examples: - Apps based on ASP.NET Core - Apps based on http.server (Python) (cherry picked from commit 7ce5fa1a82414b1b1cff16da0a781b87cdc5b168) --- nixos/modules/services/web-servers/nginx/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index f5fa2ef5f866..da2114b265b1 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -35,6 +35,7 @@ let compressMimeTypes = [ "application/atom+xml" "application/geo+json" + "application/javascript" # Deprecated by IETF RFC 9239, but still widely used "application/json" "application/ld+json" "application/manifest+json"