From 83b4cf10a8da36df3525200c298b3e09d3479e0d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 21 Nov 2024 21:32:59 +0100 Subject: [PATCH 01/11] nss_latest: 3.106 -> 3.107 https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/WH8hT2HA7RM (cherry picked from commit 29dd200c1b480a5a1ce173eb0448e6136468cfed) --- pkgs/development/libraries/nss/latest.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix index a6c5e3dd4c2b..fcc739b1c567 100644 --- a/pkgs/development/libraries/nss/latest.nix +++ b/pkgs/development/libraries/nss/latest.nix @@ -5,6 +5,6 @@ # Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert import ./generic.nix { - version = "3.106"; - hash = "sha256-j8B5RgEdBbtqPmIUniNF8ToGPIrPJ8gVTMplcv72fD0="; + version = "3.107"; + hash = "sha256-c6ks/pBvZHipNkmBy784s96zMYP+D9q3VlVrPVSohLw="; } From 327c6bb7c72db7ea9d6edfe6f6b8be72b3c5a842 Mon Sep 17 00:00:00 2001 From: Shawn8901 Date: Fri, 22 Nov 2024 19:40:55 +0100 Subject: [PATCH 02/11] linux_xanmod: 6.6.62 -> 6.6.63 (cherry picked from commit b9cad220769848a6865d94ef7b5fa256831a9a37) --- pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix index 1d2ba4547f95..81f4f0dc0c35 100644 --- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix +++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix @@ -13,8 +13,8 @@ let # kernel config in the xanmod version commit variants = { lts = { - version = "6.6.62"; - hash = "sha256-KbD5YaaZLDDsp5wuEkenUe+/KrFjOgUomXtLKHtQzvs="; + version = "6.6.63"; + hash = "sha256-P4B6r3p+Buu1Hf+RQsw5h2oUANVvQvQ4e/2gQcZ0vKw="; }; main = { From 1f4b198a86906740ded2c9009b4a4a87e7704959 Mon Sep 17 00:00:00 2001 From: Shawn8901 Date: Fri, 22 Nov 2024 19:44:28 +0100 Subject: [PATCH 03/11] linux_xanmod_latest: 6.11.9 -> 6.11.10 (cherry picked from commit 8f89eb9e52fa80e76e782618ec7ab1a5add811c4) --- pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix index 81f4f0dc0c35..c603f0194374 100644 --- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix +++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix @@ -18,8 +18,8 @@ let }; main = { - version = "6.11.9"; - hash = "sha256-lR7GXFy3eYq75+LwVlXScPYWbdVW6wAV+He0YZ+5AF4="; + version = "6.11.10"; + hash = "sha256-WNzMM+P8c8Mv+FdrwcEPHwv/ppvgN2fiM+SHMmlAPYw="; }; }; From 9864311a24ed43d584c86453c88b8a036d35bacd Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Thu, 21 Nov 2024 10:36:36 +0100 Subject: [PATCH 04/11] element-desktop: 1.11.85 -> 1.11.86 https://github.com/element-hq/element-desktop/releases/tag/v1.11.86 Electron version got bumped to 33 in https://github.com/element-hq/element-desktop/commit/cecea312c68d766be98958126bfa8c6c6b6638dc (cherry picked from commit 6d86d77aaed803300892bd52f4e0fd5bfb689e8f) --- .../instant-messengers/element/element-desktop.nix | 3 ++- .../networking/instant-messengers/element/pin.nix | 10 +++++----- pkgs/top-level/all-packages.nix | 1 - 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix index db8a8be7a871..441f37aa5e0e 100644 --- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix +++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix @@ -8,7 +8,7 @@ , nodejs , fetchYarnDeps , jq -, electron +, electron_33 , element-web , sqlcipher , callPackage @@ -25,6 +25,7 @@ let executableName = "element-desktop"; keytar = callPackage ./keytar { inherit Security AppKit; }; seshat = callPackage ./seshat { inherit CoreServices; }; + electron = electron_33; in stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // { pname = "element-desktop"; diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix index 6b0ac73be531..d8ffd2b40a77 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.nix +++ b/pkgs/applications/networking/instant-messengers/element/pin.nix @@ -1,9 +1,9 @@ { - "version" = "1.11.85"; + "version" = "1.11.86"; "hashes" = { - "desktopSrcHash" = "sha256-KNt7UgQBKoieV3IV/qFjk6PKYlgjHk4tLA8cZZlYtIw="; - "desktopYarnHash" = "1wh867yw7ic3nx623c5dknn9wk4zgq9b000p9mdf79spfp57lqlw"; - "webSrcHash" = "sha256-JR7kA2thttBle+BT/zH8QjIjp5mJPsRMYx8nd/I3IEw="; - "webYarnHash" = "0f38gizj9cnb7dqj10wljxkbjfabznh3s407n9vsl7ig0hm91zf9"; + "desktopSrcHash" = "sha256-GP5KnXL63J0076cVu0OpodlNT7Ypeso4iGrQNKq/17M="; + "desktopYarnHash" = "0bcq89nmx03h106hp875mv482d4r1xahdsimw3cs5c592zl50kx2"; + "webSrcHash" = "sha256-cqB77ffTbFLoNsGjXUOb2tdlXhSIS3X1/oDXOzOn99s="; + "webYarnHash" = "1cwj77a997lb4229ngry0b6kip1ggs82b9v126rzfgzavvwh9k1v"; }; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1610cafc6031..9f76934581a4 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5067,7 +5067,6 @@ with pkgs; element-desktop = callPackage ../applications/networking/instant-messengers/element/element-desktop.nix { inherit (darwin.apple_sdk.frameworks) Security AppKit CoreServices; - electron = electron_32; }; element-desktop-wayland = writeScriptBin "element-desktop" '' #!/bin/sh From 2749a242500f472858ec8dbda36bb065657fb13c Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Wed, 20 Nov 2024 15:15:30 +0000 Subject: [PATCH 05/11] raycast: 1.85.2 -> 1.86.0 Changelog: https://www.raycast.com/changelog/1-86-0 (cherry picked from commit be92b059e929e63dcdf9342eab715dea5f6435b3) --- pkgs/by-name/ra/raycast/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix index 46b680bb845d..a963e4451c0c 100644 --- a/pkgs/by-name/ra/raycast/package.nix +++ b/pkgs/by-name/ra/raycast/package.nix @@ -11,12 +11,12 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "raycast"; - version = "1.85.2"; + version = "1.86.0"; src = fetchurl { name = "Raycast.dmg"; url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal"; - hash = "sha256-pmzoRZ0EMEA0kU37skGuEDu6ggBuUdFYCLRpZty5kgs="; + hash = "sha256-UvMPRLCaGgunpVwoF0Nbz+7Gma7zQP+nMMh5Cvqn0MA="; }; dontPatch = true; From 653c0217c38c3ebcd2201d92bbb0a4ca28a2aff3 Mon Sep 17 00:00:00 2001 From: Felix Buehler Date: Sat, 23 Nov 2024 17:06:58 +0100 Subject: [PATCH 06/11] nixos/mackerel-agent: fix pkgs (cherry picked from commit ae94b60d543bd178e2a5aeb8eed030d2d1fd6ce6) --- nixos/modules/services/monitoring/mackerel-agent.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/monitoring/mackerel-agent.nix b/nixos/modules/services/monitoring/mackerel-agent.nix index d218c18c4354..0908ea9ca68e 100644 --- a/nixos/modules/services/monitoring/mackerel-agent.nix +++ b/nixos/modules/services/monitoring/mackerel-agent.nix @@ -98,7 +98,7 @@ in { RuntimeDirectory = "mackerel-agent"; StateDirectory = "mackerel-agent"; ExecStart = "${pkgs.mackerel-agent}/bin/mackerel-agent supervise"; - ExecStopPost = mkIf cfg.autoRetirement "${pkg.mackerel-agent}/bin/mackerel-agent retire -force"; + ExecStopPost = mkIf cfg.autoRetirement "${pkgs.mackerel-agent}/bin/mackerel-agent retire -force"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; LimitNOFILE = mkDefault 65536; LimitNPROC = mkDefault 65536; From 4a4b56934103fa59d33ff0668595d140028eee60 Mon Sep 17 00:00:00 2001 From: Felix Buehler Date: Sun, 24 Nov 2024 12:28:39 +0100 Subject: [PATCH 07/11] nixos/haka: fix assert (cherry picked from commit 5c99958613ddf26480115c2ff2846f0a7ca02c86) --- nixos/modules/services/security/haka.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/security/haka.nix b/nixos/modules/services/security/haka.nix index 66666a57fd8e..4a6325d65ad1 100644 --- a/nixos/modules/services/security/haka.nix +++ b/nixos/modules/services/security/haka.nix @@ -124,7 +124,7 @@ in { assertion = cfg.pcap != cfg.nfqueue; message = "either pcap or nfqueue can be enabled, not both."; } - { assertion = cfg.nfqueue -> !dump.enable; + { assertion = cfg.nfqueue -> !cfg.dump.enable; message = "dump can only be used with nfqueue."; } { assertion = cfg.interfaces != []; From 2268d1246d2eb8905487049f64b3aa7605ce6868 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 27 Oct 2024 23:22:07 +0000 Subject: [PATCH 08/11] apacheHttpdPackages.php: 8.2.24 -> 8.2.25 (cherry picked from commit c59e45ce4254d0ec97072629958980b4693d24e7) --- pkgs/development/interpreters/php/8.2.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix index 50f70617fe1c..e1b8d2201e57 100644 --- a/pkgs/development/interpreters/php/8.2.nix +++ b/pkgs/development/interpreters/php/8.2.nix @@ -2,8 +2,8 @@ let base = callPackage ./generic.nix (_args // { - version = "8.2.24"; - hash = "sha256-TMduxkTu6X0XySv+jQ6EcU/t8pmlOLffrcBjndDcQy8="; + version = "8.2.25"; + hash = "sha256-B7QcXpbGDAllEORfAvgYQU0RvdDV2htoQN26K6colAE="; }); in base.withExtensions ({ all, ... }: with all; ([ From 24310d19566f13bbcb9ff5a12e6d6f568336246a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 24 Nov 2024 01:50:45 +0000 Subject: [PATCH 09/11] php82: 8.2.25 -> 8.2.26 (cherry picked from commit c9ac44d1f1a304a6e671d6be82d06dff6ae328c3) --- pkgs/development/interpreters/php/8.2.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix index e1b8d2201e57..4fdcf60354f5 100644 --- a/pkgs/development/interpreters/php/8.2.nix +++ b/pkgs/development/interpreters/php/8.2.nix @@ -2,8 +2,8 @@ let base = callPackage ./generic.nix (_args // { - version = "8.2.25"; - hash = "sha256-B7QcXpbGDAllEORfAvgYQU0RvdDV2htoQN26K6colAE="; + version = "8.2.26"; + hash = "sha256-vlfDR9RRyQW8tDNoMqhk2ZKN0OIJibhycF/qC6ZHbGs="; }); in base.withExtensions ({ all, ... }: with all; ([ From 4ba1283c6cdb4a7831e01f65fd994a1f608cf547 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 24 Nov 2024 19:24:37 +0100 Subject: [PATCH 10/11] php83: 8.3.13 -> 8.3.14 Fixes * CVE-2024-8932 * CVE-2024-8929 * CVE-2024-11236 * CVE-2024-11234 * CVE-2024-11233 * GHSA-4w77-75f9-2c8w ChangeLog: https://www.php.net/ChangeLog-8.php#8.3.14 (cherry picked from commit 6f6d0f283887fc8bcc466473e9d9bdc4997715cb) --- pkgs/development/interpreters/php/8.3.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix index 43dbc2ce033d..c51dd4d01415 100644 --- a/pkgs/development/interpreters/php/8.3.nix +++ b/pkgs/development/interpreters/php/8.3.nix @@ -2,8 +2,8 @@ let base = callPackage ./generic.nix (_args // { - version = "8.3.13"; - hash = "sha256-x3kcguGlVMyvhKQLpxzBQXupr2f7Wzl4CDf9fH628SQ="; + version = "8.3.14"; + hash = "sha256-9W+mac5MAUUqKSH0ADTXedjCuX0HSUk61HgYE7kiHPg="; }); in base.withExtensions ({ all, ... }: with all; ([ From 714f870cfd23b2b55413df343a80acc89394ee32 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 24 Nov 2024 19:34:52 +0100 Subject: [PATCH 11/11] php81: 8.1.30 -> 8.1.31 Fixes * CVE-2024-8932 * CVE-2024-8929 * CVE-2024-11236 * CVE-2024-11234 * CVE-2024-11233 * GHSA-4w77-75f9-2c8w ChangeLog: https://www.php.net/ChangeLog-8.php#8.1.31 (cherry picked from commit 211a54292cfd75b7a893152fff7344fe300cd86b) --- pkgs/development/interpreters/php/8.1.nix | 12 ++---------- pkgs/top-level/php-packages.nix | 12 ------------ 2 files changed, 2 insertions(+), 22 deletions(-) diff --git a/pkgs/development/interpreters/php/8.1.nix b/pkgs/development/interpreters/php/8.1.nix index 3938ca414524..51610fb40985 100644 --- a/pkgs/development/interpreters/php/8.1.nix +++ b/pkgs/development/interpreters/php/8.1.nix @@ -2,16 +2,8 @@ let base = callPackage ./generic.nix ((removeAttrs _args [ "fetchpatch" ]) // { - version = "8.1.30"; - hash = "sha256-yxYl5axJuRA3R34+d2e7BiQ0OXGuuZL0eRthivVx0j4="; - extraPatches = [ - # Fix build with libxml 2.12+. - # Patch from https://github.com/php/php-src/commit/0a39890c967aa57225bb6bdf4821aff7a3a3c082 - (fetchpatch { - url = "https://github.com/php/php-src/commit/0a39890c967aa57225bb6bdf4821aff7a3a3c082.patch"; - hash = "sha256-HvpTL7aXO9gr4glFdhqUWQPrG8TYTlvbNINq33M3zS0="; - }) - ]; + version = "8.1.31"; + hash = "sha256-CzmCizRRUcrxt5XZ9LkjyYhyMXdsMwdt/J2QpEOQ0Nw="; }); in base.withExtensions ({ all, ... }: with all; ([ diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix index e008dbc23320..de28c0ac66da 100644 --- a/pkgs/top-level/php-packages.nix +++ b/pkgs/top-level/php-packages.nix @@ -382,18 +382,6 @@ in { configureFlags = [ "--enable-dom" ]; - # Add a PHP lower version bound constraint to avoid applying the patch on older PHP versions. - patches = lib.optionals ((lib.versions.majorMinor php.version == "8.2" && lib.versionOlder php.version "8.2.14" && lib.versionAtLeast php.version "8.2.7") || (lib.versions.majorMinor php.version == "8.1" && lib.versionAtLeast php.version "8.1.27")) [ - # Fix tests with libxml 2.12 - # Part of 8.3.1RC1+, 8.2.14RC1+ - (fetchpatch { - url = "https://github.com/php/php-src/commit/061058a9b1bbd90d27d97d79aebcf2b5029767b0.patch"; - hash = "sha256-0hOlAG+pOYp/gUU0MUMZvzWpgr0ncJi5GB8IeNxxyEU="; - excludes = [ - "NEWS" - ]; - }) - ]; } { name = "enchant";