From d995cbf84eece5ddcb5a5350b88d083418d0b83e Mon Sep 17 00:00:00 2001 From: Diogo Correia Date: Wed, 29 Jul 2026 21:34:25 +0100 Subject: [PATCH] dawarich: bump rails to 8.0.5.1 to fix CVE-2026-66066 Not-cherry-picked-because: dawarich on stable is outdated and needs a different patch --- .../dawarich/0002-rails-CVE-2026-66066.diff | 179 ++++++++++++++++++ pkgs/by-name/da/dawarich/gemset.nix | 52 ++--- pkgs/by-name/da/dawarich/package.nix | 4 + 3 files changed, 209 insertions(+), 26 deletions(-) create mode 100644 pkgs/by-name/da/dawarich/0002-rails-CVE-2026-66066.diff diff --git a/pkgs/by-name/da/dawarich/0002-rails-CVE-2026-66066.diff b/pkgs/by-name/da/dawarich/0002-rails-CVE-2026-66066.diff new file mode 100644 index 000000000000..011429a5d070 --- /dev/null +++ b/pkgs/by-name/da/dawarich/0002-rails-CVE-2026-66066.diff @@ -0,0 +1,179 @@ +diff --git a/Gemfile b/Gemfile +index 6359ed40..830de072 100644 +--- a/Gemfile ++++ b/Gemfile +@@ -44,7 +44,7 @@ gem 'puma' + gem 'pundit', '>= 2.5.1' + gem 'rack-attack' + gem 'rack-session', '>= 2.1.2' +-gem 'rails', '~> 8.0' ++gem 'rails', '~> 8.0.5.1' + gem 'rails_icons' + gem 'redis' + gem 'resolv-replace', '~> 0.2.0' +diff --git a/Gemfile.lock b/Gemfile.lock +index d8d04266..3eab812e 100644 +--- a/Gemfile.lock ++++ b/Gemfile.lock +@@ -10,29 +10,29 @@ GIT + GEM + remote: https://rubygems.org/ + specs: +- actioncable (8.0.3) +- actionpack (= 8.0.3) +- activesupport (= 8.0.3) ++ actioncable (8.0.5.1) ++ actionpack (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + nio4r (~> 2.0) + websocket-driver (>= 0.6.1) + zeitwerk (~> 2.6) +- actionmailbox (8.0.3) +- actionpack (= 8.0.3) +- activejob (= 8.0.3) +- activerecord (= 8.0.3) +- activestorage (= 8.0.3) +- activesupport (= 8.0.3) ++ actionmailbox (8.0.5.1) ++ actionpack (= 8.0.5.1) ++ activejob (= 8.0.5.1) ++ activerecord (= 8.0.5.1) ++ activestorage (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + mail (>= 2.8.0) +- actionmailer (8.0.3) +- actionpack (= 8.0.3) +- actionview (= 8.0.3) +- activejob (= 8.0.3) +- activesupport (= 8.0.3) ++ actionmailer (8.0.5.1) ++ actionpack (= 8.0.5.1) ++ actionview (= 8.0.5.1) ++ activejob (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + mail (>= 2.8.0) + rails-dom-testing (~> 2.2) +- actionpack (8.0.3) +- actionview (= 8.0.3) +- activesupport (= 8.0.3) ++ actionpack (8.0.5.1) ++ actionview (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + nokogiri (>= 1.8.5) + rack (>= 2.2.4) + rack-session (>= 1.0.1) +@@ -40,38 +40,38 @@ GEM + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + useragent (~> 0.16) +- actiontext (8.0.3) +- actionpack (= 8.0.3) +- activerecord (= 8.0.3) +- activestorage (= 8.0.3) +- activesupport (= 8.0.3) ++ actiontext (8.0.5.1) ++ actionpack (= 8.0.5.1) ++ activerecord (= 8.0.5.1) ++ activestorage (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + globalid (>= 0.6.0) + nokogiri (>= 1.8.5) +- actionview (8.0.3) +- activesupport (= 8.0.3) ++ actionview (8.0.5.1) ++ activesupport (= 8.0.5.1) + builder (~> 3.1) + erubi (~> 1.11) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) +- activejob (8.0.3) +- activesupport (= 8.0.3) ++ activejob (8.0.5.1) ++ activesupport (= 8.0.5.1) + globalid (>= 0.3.6) +- activemodel (8.0.3) +- activesupport (= 8.0.3) +- activerecord (8.0.3) +- activemodel (= 8.0.3) +- activesupport (= 8.0.3) ++ activemodel (8.0.5.1) ++ activesupport (= 8.0.5.1) ++ activerecord (8.0.5.1) ++ activemodel (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + timeout (>= 0.4.0) + activerecord-postgis-adapter (11.0.0) + activerecord (~> 8.0.0) + rgeo-activerecord (~> 8.0.0) +- activestorage (8.0.3) +- actionpack (= 8.0.3) +- activejob (= 8.0.3) +- activerecord (= 8.0.3) +- activesupport (= 8.0.3) ++ activestorage (8.0.5.1) ++ actionpack (= 8.0.5.1) ++ activejob (= 8.0.5.1) ++ activerecord (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + marcel (~> 1.0) +- activesupport (8.0.3) ++ activesupport (8.0.5.1) + base64 + benchmark (>= 0.3) + bigdecimal +@@ -436,20 +436,20 @@ GEM + rack (>= 1.3) + rackup (2.3.1) + rack (>= 3) +- rails (8.0.3) +- actioncable (= 8.0.3) +- actionmailbox (= 8.0.3) +- actionmailer (= 8.0.3) +- actionpack (= 8.0.3) +- actiontext (= 8.0.3) +- actionview (= 8.0.3) +- activejob (= 8.0.3) +- activemodel (= 8.0.3) +- activerecord (= 8.0.3) +- activestorage (= 8.0.3) +- activesupport (= 8.0.3) ++ rails (8.0.5.1) ++ actioncable (= 8.0.5.1) ++ actionmailbox (= 8.0.5.1) ++ actionmailer (= 8.0.5.1) ++ actionpack (= 8.0.5.1) ++ actiontext (= 8.0.5.1) ++ actionview (= 8.0.5.1) ++ activejob (= 8.0.5.1) ++ activemodel (= 8.0.5.1) ++ activerecord (= 8.0.5.1) ++ activestorage (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + bundler (>= 1.15.0) +- railties (= 8.0.3) ++ railties (= 8.0.5.1) + rails-dom-testing (2.3.0) + activesupport (>= 5.0.0) + minitest +@@ -460,9 +460,9 @@ GEM + rails_icons (1.4.0) + nokogiri (~> 1.16, >= 1.16.4) + rails (> 6.1) +- railties (8.0.3) +- actionpack (= 8.0.3) +- activesupport (= 8.0.3) ++ railties (8.0.5.1) ++ actionpack (= 8.0.5.1) ++ activesupport (= 8.0.5.1) + irb (~> 1.13) + rackup (>= 1.0.0) + rake (>= 12.2) +@@ -722,7 +722,7 @@ DEPENDENCIES + pundit (>= 2.5.1) + rack-attack + rack-session (>= 2.1.2) +- rails (~> 8.0) ++ rails (~> 8.0.5.1) + rails_icons + redis + resolv-replace (~> 0.2.0) diff --git a/pkgs/by-name/da/dawarich/gemset.nix b/pkgs/by-name/da/dawarich/gemset.nix index 569b6969fe74..07b73ca2f594 100644 --- a/pkgs/by-name/da/dawarich/gemset.nix +++ b/pkgs/by-name/da/dawarich/gemset.nix @@ -11,10 +11,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "14vlhzrgfgmz0fvrvd81j9xfw8ig091yiwq496firapgxffd7jpq"; + sha256 = "1iypfwdaakl6bh2mjakqmk7g1m8cl9npmp47ixigfzjsc0671nss"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; actionmailbox = { dependencies = [ @@ -29,10 +29,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0bxxqqflmczwl4ivcqjwwsnrhljcalk1i2hj02qisr3wjgw4811a"; + sha256 = "1mmfxqwk3ska8fz0l601l2hgbaqj619zdlgjz1fjhgivynnjxdzq"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; actionmailer = { dependencies = [ @@ -47,10 +47,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "08y7ihafq71879ncq963rwi541b0gafqx8h5ba26zab521qc7h3d"; + sha256 = "00w4q1p3gwmqgik2mz5bnxp57cpwjxm7i68nyljym28rdvwv7ln3"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; actionpack = { dependencies = [ @@ -73,10 +73,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1lsspr8nffzn8qpfmj654w1qja1915x6bnzzhpbjj1cy235j2g6n"; + sha256 = "1sx1r9qp72gygvgr1qaj6w6pd5y8g2mnafadvi6qhs2dhafmqnd5"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; actiontext = { dependencies = [ @@ -91,10 +91,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1x4xd8h5sdwdm3rc8h2pxxmq4a0i0wa0gk6c56zq58pzc3xgsihw"; + sha256 = "1ci545zafa5q6dljcvqj2gfmnza2fs3nbvyc33y16hzbbz9r03ip"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; actionview = { dependencies = [ @@ -113,10 +113,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0rnfn44g217n9hgvn4ga7l0hl149b91djnl07nzra7kxy1pr8wai"; + sha256 = "0h0lrfwi0lh8y1bcaj0zh1srhqay0hlb02gzqd55qaf2kj5i0aj7"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; activejob = { dependencies = [ @@ -127,10 +127,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1dm1vc5vvk5pwq4x7sfh3g6qzzwbyac37ggh1mm1rzraharxv7j6"; + sha256 = "1038583pm2fd8lcdi57bk01c99cfq4d13jljvmnvqg3c3fi0f90l"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; activemodel = { dependencies = [ "activesupport" ]; @@ -141,10 +141,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0z565q17fmhj4b9j689r0xx1s26w1xcw8z0qyb6h8v0wb8j0fsa0"; + sha256 = "197lvykj2v9j25n2gxwn5z9fpa888mnr5vqaxsivf3f4m4mf76sm"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; activerecord = { dependencies = [ @@ -159,10 +159,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1a6fng58lria02wlwiqjgqway0nx1wq31dsxn5xvbk7958xwd5cv"; + sha256 = "19zf3qmmbmjq8qmy7vld5xzicwnl82j9h9092zmpaka0rs7rcllj"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; activerecord-postgis-adapter = { dependencies = [ @@ -190,10 +190,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0plck0b57b9ni8n52hj5slv5n8i7w3nfwq6r47nkb2hjbpmsskjg"; + sha256 = "1wj5yy7diais0bg7pzb847d3cniqpnfqiq3ms7mg1p1g5f9l55r3"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; activesupport = { dependencies = [ @@ -219,10 +219,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "08vqq5y6vniz30p747xa8yfqb3cz8scqd8r65wij62v661gcw4d7"; + sha256 = "0447k5nm211n1ghhb8fv55wm450bigr9vjz2i8rwzkzvqj0456ij"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; addressable = { dependencies = [ "public_suffix" ]; @@ -2295,10 +2295,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0igxnfy4xckvk2b6x17zrwa8xwnkxnpv36ca4wma7bhs5n1c10sx"; + sha256 = "15d41gg62hjb0gbirfy6c1yx51drdqjf1db7pvfpc64872zyy769"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; rails-dom-testing = { dependencies = [ @@ -2372,10 +2372,10 @@ platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1lpiazaaq8di4lz9iqjqdrsnha6kfq6k35kd9nk9jhhksz51vqxc"; + sha256 = "1iym8kbdzpkjk70h7w9pbmqj7czsywzinwpqla8ldc6sv7hmh6fs"; type = "gem"; }; - version = "8.0.3"; + version = "8.0.5.1"; }; rainbow = { groups = [ diff --git a/pkgs/by-name/da/dawarich/package.nix b/pkgs/by-name/da/dawarich/package.nix index acd55e201bc0..4ffe44db3c60 100644 --- a/pkgs/by-name/da/dawarich/package.nix +++ b/pkgs/by-name/da/dawarich/package.nix @@ -35,6 +35,10 @@ stdenv.mkDerivation (finalAttrs: { patches = [ # bundix and bundlerEnv fail with system-specific gems ./0001-build-ffi-gem.diff + # Fix for CVE-2026-66066 + # https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm + # Bumps rails to 8.0.5.1 + ./0002-rails-CVE-2026-66066.diff ]; postPatch = '' substituteInPlace ./Gemfile \