From 85c2858b9faa1c7b0417951ee0dca688b686527a Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 26 Jun 2026 19:38:06 +0200 Subject: [PATCH 1/6] incus: backport 7.2 security fixes Based on commit f1f19a90e66c7829957216c805f02849790462d9. --- pkgs/by-name/in/incus/package.nix | 50 +++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix index 002afd910114..04c959bb701f 100644 --- a/pkgs/by-name/in/incus/package.nix +++ b/pkgs/by-name/in/incus/package.nix @@ -98,6 +98,56 @@ import ./generic.nix { url = "https://github.com/lxc/incus/commit/a6012422b45c86f3b1956788cff5d75c604ad838.patch?full_index=1"; hash = "sha256-u3NLKE8Rh8i6HMbJ0KNhH7gbuwIpJ1SPqiyVoiuw9Sc="; }) + (fetchpatch2 { + name = "incusd-instances_Check-source-instance-access-on-copy.patch"; + url = "https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb.patch?full_index=1"; + hash = "sha256-1foxIu1rWcK1QbpmAPoQ46Tl1mrPvoctPnDhKRTWbd0="; + }) + (fetchpatch2 { + name = "incusd-storage_Check-source-volume-access-on-copy.patch"; + url = "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28.patch?full_index=1"; + hash = "sha256-FP9v/8V0ZFLgy1tODKLJlw5f/6qJ8AMP/yme2YhYSaA="; + }) + (fetchpatch2 { + name = "incusd-images_Validate-fingerprint-on-direct-download.patch"; + url = "https://github.com/lxc/incus/commit/46d6ef232186df5535c49ca9f3597cab381f9b86.patch?full_index=1"; + hash = "sha256-R8gsvdmb7KVC6W1vFH1CojzhrGNgNiFOOTYbCrDAajg="; + }) + (fetchpatch2 { + name = "shared-validate_Reject-compression-algorithm-arguments.patch"; + url = "https://github.com/lxc/incus/commit/873a032a461df6b09b7586435b592873863a4e88.patch?full_index=1"; + hash = "sha256-QvxGxwHvswUZFst71zA12ZdxNIErl1LkaNyQdcPiglI="; + }) + (fetchpatch2 { + name = "incusd-instance_Confine-template-access-to-instance-root.patch"; + url = "https://github.com/lxc/incus/commit/cbefa31ae0da8fd96361178aed3a3c631e098fef.patch?full_index=1"; + hash = "sha256-ZOHqnlIG6LyIUO6WP76SZJKTeqoiw9qj2YByGxqGP+E="; + }) + (fetchpatch2 { + name = "incusd-instance_Enforce-project-restrictions-on-snapshot-restore.patch"; + url = "https://github.com/lxc/incus/commit/3fe3bc99891940fcd3e758d49f65a853104fcd6b.patch?full_index=1"; + hash = "sha256-j+lTbDaUjnZRY0lmaOSH4oKNAeIe5GXTwd1oM50it+Y="; + }) + (fetchpatch2 { + name = "incusd-exec_Reject-exec-output-symlink.patch"; + url = "https://github.com/lxc/incus/commit/e109655d642c7cb7c9039b7c06323000407f76dd.patch?full_index=1"; + hash = "sha256-v/H12n8u+aqm9+ZxrarBxQEQSMN1gpX13oyummGWXl8="; + }) + (fetchpatch2 { + name = "incusd_Reject-rootfs-symlink-for-instances.patch"; + url = "https://github.com/lxc/incus/commit/7e58425ca7ffeb21bb116869e71a0d002dae9e72.patch?full_index=1"; + hash = "sha256-MU+Khx+DhYQWUVs71D05PnJGamrhRXxsahtdXZeSfvU="; + }) + (fetchpatch2 { + name = "shared-logger_Add-WarnOnError-helper.patch"; + url = "https://github.com/lxc/incus/commit/1bc4d3feb8cd3bd005b7406c0d44ad3ea59400bf.patch?full_index=1"; + hash = "sha256-ima4IGl0CyL30yZVdQ2pmp9SukIzrdBftGkO/GUPB3g="; + }) + (fetchpatch2 { + name = "incus-0001-incusd-daemon_images-Add-missing-import.patch"; + url = "https://raw.githubusercontent.com/zabbly/incus/a7fd42d2f5115c4e6893b23e64209db511fff828/patches/incus-0001-incusd-daemon_images-Add-missing-import.patch"; + hash = "sha256-xtuuASy9bck+BgXbea9goNhrMV8Yme9cmFp4WNrkIdI="; + }) ]; nixUpdateExtraArgs = [ "--override-filename=pkgs/by-name/in/incus/package.nix" From eb0a771fb55200b5b76387afcdc74c2854c04c43 Mon Sep 17 00:00:00 2001 From: networkException Date: Fri, 26 Jun 2026 23:03:16 +0200 Subject: [PATCH 2/6] chromium,chromedriver: 149.0.7827.196 -> 149.0.7827.200 https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html This update includes 3 security fixes. CVEs: CVE-2026-13281 CVE-2026-13282 CVE-2026-13283 (cherry picked from commit b94af336c06215e59b48d1867940ac4d84b349b3) --- .../networking/browsers/chromium/info.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json index fc3ece2ce796..4b9c865f726f 100644 --- a/pkgs/applications/networking/browsers/chromium/info.json +++ b/pkgs/applications/networking/browsers/chromium/info.json @@ -1,10 +1,10 @@ { "chromium": { - "version": "149.0.7827.196", + "version": "149.0.7827.200", "chromedriver": { - "version": "149.0.7827.197", - "hash_darwin": "sha256-tN7s6s/pbfAGRCMcoT3QWYHD8QRq2gcHfFSXoSG9V5Y=", - "hash_darwin_aarch64": "sha256-DZ8CZ4Obp67Zo2m4iyqUnShyhTK8+/75cJ/WmZZqQhE=" + "version": "149.0.7827.201", + "hash_darwin": "sha256-MHCcid+7wdYm8uIdrUIlXrk8ADHNUUXzPyMPFGP98WY=", + "hash_darwin_aarch64": "sha256-Gwmdo9qNyV/BnCj18f0BFpNgDf28e8vjNF98e5/vVjQ=" }, "deps": { "depot_tools": { @@ -21,8 +21,8 @@ "DEPS": { "src": { "url": "https://chromium.googlesource.com/chromium/src.git", - "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a", - "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=", + "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a", + "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=", "recompress": true }, "src/third_party/clang-format/script": { From 5361550f002f75096b3aae875e845a67b47e6a08 Mon Sep 17 00:00:00 2001 From: networkException Date: Fri, 26 Jun 2026 23:05:03 +0200 Subject: [PATCH 3/6] ungoogled-chromium: 149.0.7827.196-1 -> 149.0.7827.200-1 https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html This update includes 3 security fixes. CVEs: CVE-2026-13281 CVE-2026-13282 CVE-2026-13283 (cherry picked from commit 53a21295bc575b2c11209aae94c575729993920c) --- .../networking/browsers/chromium/info.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json index 4b9c865f726f..c87e4a647a90 100644 --- a/pkgs/applications/networking/browsers/chromium/info.json +++ b/pkgs/applications/networking/browsers/chromium/info.json @@ -823,7 +823,7 @@ } }, "ungoogled-chromium": { - "version": "149.0.7827.196", + "version": "149.0.7827.200", "deps": { "depot_tools": { "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90", @@ -835,16 +835,16 @@ "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04=" }, "ungoogled-patches": { - "rev": "149.0.7827.196-1", - "hash": "sha256-nRcMTP+su+mFP/JkyLBIDrG+dKYhvPANFw0Y8qVWzrA=" + "rev": "149.0.7827.200-1", + "hash": "sha256-D7c1ToAoUzAMpXoe60YPimRqe6/LRe0T95TduXUeTFo=" }, "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg=" }, "DEPS": { "src": { "url": "https://chromium.googlesource.com/chromium/src.git", - "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a", - "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=", + "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a", + "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=", "recompress": true }, "src/third_party/clang-format/script": { From 7189c0e76735ecc59aecb0c8fe07bf238c301529 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Sat, 27 Jun 2026 10:37:47 +0000 Subject: [PATCH 4/6] linux_7_1: 7.1.1 -> 7.1.2 (cherry picked from commit 0899fedf44910c9dd259a937e744a69a3e96d874) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index c71350cfe8a5..c174666c5609 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -40,8 +40,8 @@ "lts": false }, "7.1": { - "version": "7.1.1", - "hash": "sha256:0z8x6wafxzc5vkim9jh8wpycdkk9y5bpxgsirmdpyznw84szl5aj", + "version": "7.1.2", + "hash": "sha256:0gw8nnq6nix9xk2dhb1jwmhnqjayrn3bn2akzg4lgqkvfa9qq69p", "lts": false } } From 6b9f35bda4881e3462b50fb3b70c926ffedf13a1 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Sat, 27 Jun 2026 10:38:00 +0000 Subject: [PATCH 5/6] linux_7_0: 7.0.13 -> 7.0.14 (cherry picked from commit ae05d822afa333fd35d417b399beb1da0ebb689d) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index c174666c5609..6f0585da2022 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -35,8 +35,8 @@ "lts": true }, "7.0": { - "version": "7.0.13", - "hash": "sha256:04wrz38ldls7pv1yxa1m7p2hqn1731l93xnz93fs7b0nyz8fv09w", + "version": "7.0.14", + "hash": "sha256:160ggaq9rh50a39gz02fpia8maq85bwxhqlwsc03yafjhjvrk6fy", "lts": false }, "7.1": { From f51e81f48aa76bff00ba8ef23e542537a581f85b Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Sat, 27 Jun 2026 10:38:13 +0000 Subject: [PATCH 6/6] linux_6_18: 6.18.36 -> 6.18.37 (cherry picked from commit 77ea4e37f84a559c32e38391066198989e9f1b32) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 6f0585da2022..e861cafff263 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -30,8 +30,8 @@ "lts": true }, "6.18": { - "version": "6.18.36", - "hash": "sha256:0kn4r43lnd5nb5c298b30030qyaxv05s7k40n9si1j3iyk4qdazv", + "version": "6.18.37", + "hash": "sha256:0maj2ap1m09bxl6a3g9wc65h9sdr6y8rwc5qcqlbavb4wq0d4g58", "lts": true }, "7.0": {