From 776374ef65f935959637ecc63d58c662fb945c4f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 25 Oct 2025 06:16:57 +0000 Subject: [PATCH 01/24] jdk: 21.0.9+8 -> 21.0.9+10 (cherry picked from commit e730dc907eaea35d0073db118a251b14f73524d2) --- pkgs/development/compilers/openjdk/21/source.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/openjdk/21/source.json b/pkgs/development/compilers/openjdk/21/source.json index 438a484ff2b6..a43dec0d9066 100644 --- a/pkgs/development/compilers/openjdk/21/source.json +++ b/pkgs/development/compilers/openjdk/21/source.json @@ -1,6 +1,6 @@ { - "hash": "sha256-NgunrSUchIlHkaXM9h75U4xcf44ukCuhhPPHHGVOKXo=", + "hash": "sha256-VYTitbgKgd9co9LXVnneaaKjMwAXFmscYp9McJV01Jg=", "owner": "openjdk", "repo": "jdk21u", - "rev": "refs/tags/jdk-21.0.9+8" + "rev": "refs/tags/jdk-21.0.9+10" } From 1d8ef5fde84158e8036642b3ab95c4423e799ac6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 18 Sep 2025 16:42:46 +0000 Subject: [PATCH 02/24] unbound-with-systemd: 1.23.1 -> 1.24.0 (cherry picked from commit c3257a3e30c1a775078e813083ed9a2da4cf4dc2) --- pkgs/by-name/un/unbound/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix index fe24b22775b1..99fcaf1497c4 100644 --- a/pkgs/by-name/un/unbound/package.nix +++ b/pkgs/by-name/un/unbound/package.nix @@ -56,13 +56,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "unbound"; - version = "1.23.1"; + version = "1.24.0"; src = fetchFromGitHub { owner = "NLnetLabs"; repo = "unbound"; tag = "release-${finalAttrs.version}"; - hash = "sha256-65bv/AYQ3Dxwuwv49dU2UuA2imZFbUWnQEJESJvqC6w="; + hash = "sha256-M5gn18HTgcpqsOZGtxPoQbQd5tPW3T4r0YeMK5Mwgls="; }; outputs = [ From cd525dd017a3ecd74a31c46115280f9259f77b44 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 22 Oct 2025 12:32:17 +0000 Subject: [PATCH 03/24] unbound-full: 1.24.0 -> 1.24.1 (cherry picked from commit ab8f45a27939f00179a02ea18e98be5f848c7bc1) --- pkgs/by-name/un/unbound/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix index 99fcaf1497c4..62657e2f4c36 100644 --- a/pkgs/by-name/un/unbound/package.nix +++ b/pkgs/by-name/un/unbound/package.nix @@ -56,13 +56,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "unbound"; - version = "1.24.0"; + version = "1.24.1"; src = fetchFromGitHub { owner = "NLnetLabs"; repo = "unbound"; tag = "release-${finalAttrs.version}"; - hash = "sha256-M5gn18HTgcpqsOZGtxPoQbQd5tPW3T4r0YeMK5Mwgls="; + hash = "sha256-meWgu1UGhR9d8wVb8guqbnGE3UHs6uJHR20iDFnIThQ="; }; outputs = [ From d81c0d0ae3c0518b1ffd4e0589e55146ce4ba873 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sat, 1 Nov 2025 22:02:08 +0100 Subject: [PATCH 04/24] glib: apply patch for CVE-2025-7039 Not-cherry-picked-because: unstable will be bumped to 2.86.0 as part of the GNOME 49 upgrade. --- pkgs/by-name/gl/glib/package.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix index 763bb75f6956..a24f89f13418 100644 --- a/pkgs/by-name/gl/glib/package.nix +++ b/pkgs/by-name/gl/glib/package.nix @@ -3,6 +3,7 @@ lib, stdenv, fetchurl, + fetchpatch, gettext, meson, ninja, @@ -99,6 +100,12 @@ stdenv.mkDerivation (finalAttrs: { ./gobject_init_on_demand.patch ] ++ [ + (fetchpatch { + name = "CVE-2025-7039.patch"; + url = "https://gitlab.gnome.org/GNOME/glib/-/commit/61e963284889ddb4544e6f1d5261c16120f6fcc3.patch"; + hash = "sha256-g0TIvKk5XEb4+iiDsDBkDH62ldlQ/jjGsMhHORD806k="; + }) + # This patch lets GLib's GDesktopAppInfo API watch and notice changes # to the Nix user and system profiles. That way, the list of available # applications shown by the desktop environment is immediately updated From c0ea3dfb77f329ee99167c61075c98b985e2684f Mon Sep 17 00:00:00 2001 From: K900 Date: Sun, 2 Nov 2025 11:04:39 +0300 Subject: [PATCH 05/24] qt5: 5.15.17 -> 5.15.18 tfw no webengine (cherry picked from commit ab4e5da85c1270fae5dbcbb0048983e5416a2bae) --- .../libraries/qt-5/5.15/srcs-generated.json | 160 +++++++++--------- pkgs/development/libraries/qt-5/5.15/srcs.nix | 2 +- 2 files changed, 81 insertions(+), 81 deletions(-) diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json index 47b8a3495b70..fd5fcefbff34 100644 --- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json +++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json @@ -1,202 +1,202 @@ { "qt3d": { "url": "https://invent.kde.org/qt/qt/qt3d.git", - "rev": "73c1dda553f338c5a3b9ebbfd0e7de114f0c93dc", - "sha256": "0szrqm745b541bamwsbbnl7w6yx0hcaj6jsb3v7kxhvb8kfb1jbm" + "rev": "208f5835e6c2415c9dc5cbe92bba83aa28bab7ea", + "sha256": "0zqvdq5y25b1w7agx5wlr16p1wrx54086r0xcdfg9wx8dayhh1md" }, "qtactiveqt": { "url": "https://invent.kde.org/qt/qt/qtactiveqt.git", - "rev": "df401a62879521f3fd47097205a440d5b173b524", - "sha256": "1zv5a2ywgvv4k3mgz2bbp5696751azf20pxk3xd1dr4dicr2lxf6" + "rev": "e4c93bc7cac45bac6bccda3310947e8fe026a9ed", + "sha256": "1qq6jvqkl4ff7sw20pi1mawh5pypv7vxmj56d38z6p06r1azkvls" }, "qtandroidextras": { "url": "https://invent.kde.org/qt/qt/qtandroidextras.git", - "rev": "484bbac0978eccc9031cbf1bf804a81a6bfb1247", - "sha256": "0h3x582q3m8cpll5f54h2cqngyd7j1mx0j1jqrjcf4mbg5n9y0i5" + "rev": "4928bd58dbc1cdcf44a7e454e3d4654c3c2016f1", + "sha256": "02rsh60lyl6bn2jhx0ajn43safbi904nhwvdpikanrmdbg0z6dpp" }, "qtbase": { "url": "https://invent.kde.org/qt/qt/qtbase.git", - "rev": "128a1d2861ca5693e43e8b79fbd4278dcd451fbc", - "sha256": "1jd2my6az2a9l7d1v6f03ygv5m16dij2mmb73jchgrz20h1an7nz" + "rev": "bebdfd54917e25d1c100e6bd9f5dd53c2e645fd8", + "sha256": "0bg36lxngkq2k11bhqdyfvbc1qyqaghwsi446zfn67vxvyxya3hx" }, "qtcharts": { "url": "https://invent.kde.org/qt/qt/qtcharts.git", - "rev": "aaf04515611203a32cef866cce9bfeaa4cef20b6", - "sha256": "0q0qglksgl50kjq5pqigfvww4rks3ig8xwcz72d0h58ga1i3kgid" + "rev": "1093fb53ced126100d14af30a8adffd29b7ef855", + "sha256": "0cnlg59l743milkki8mjbrfd4cx5ycbqw73apcrnrsag9dqdbw41" }, "qtconnectivity": { "url": "https://invent.kde.org/qt/qt/qtconnectivity.git", - "rev": "15961348aa26b73248432a0a274b332c36cd0054", - "sha256": "020vh62m098zn8fl43xnd5hhvixfr0q21ziq30jqml0j3slx4adx" + "rev": "f1be05c8efeb65b77a8bfd21763ab55bb5c04906", + "sha256": "1vl7wfw9sd8qfl8ixzl5wz4v5km5zdf9bii53q3pw4f2lplsralq" }, "qtdatavis3d": { "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git", - "rev": "a57e633b675d7886c3e5c64441f50ffe831f2de8", - "sha256": "0w0cv80sa9w42wgw3yji228wyhwc3c8lz9r3296crq136aykyy87" + "rev": "d9b988d3c5f9f34b97f3a9ac1347bfb55464cd60", + "sha256": "09jk32kw7wgcrd117a9lsm5w7jszsdhdslk10qn631wz203zbs4i" }, "qtdeclarative": { "url": "https://invent.kde.org/qt/qt/qtdeclarative.git", - "rev": "11ea94fc8ea95d0ba95745a021a1b139283b8b36", - "sha256": "0xw15d7syqw0z6xjnkgckh53rhg7n20j67dm1bhf429ma1cqawqm" + "rev": "1189557a50f11e7bc5716467a149cd09987a9f88", + "sha256": "0cd89d8i8chy1j1yanp1cq5s7467qr24b9c7cx9qw0nb0rf6f8qr" }, "qtdoc": { "url": "https://invent.kde.org/qt/qt/qtdoc.git", - "rev": "36ae30d632c978b795bf40aa1c50abaae7c8ac4d", - "sha256": "10vwkk2b4ysx6i9nyqnl1g7q7rckp5xppwdawd6avlkxhfjayan7" + "rev": "ddb2afda6f713259fc8d95fb22a1c96bb448c36a", + "sha256": "0nk2vwl0ppix794xzj8nqrhsc333v8v4vr1rmwddymwlrdqlqd5d" }, "qtgamepad": { "url": "https://invent.kde.org/qt/qt/qtgamepad.git", - "rev": "fb2191db07738c9a954a77c2fb15dcb925a4c361", - "sha256": "1061ad1350bi0jr2vzpsmk6cgwyhv63d67nb8np1nr2j1iy2ncp7" + "rev": "269fc0731f6838a1c02877a83c0ada23659c69fc", + "sha256": "06jhby671yzbj753yb0lnk4bv2r0nxxibq7fq1yljxdms0rc72iz" }, "qtgraphicaleffects": { "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git", - "rev": "fed60f95ddb75103f83cf67bf2c9f471e49576fe", - "sha256": "0ja113vz261farf6c1bilxww4ypzzsnkz7xl37xr1pmxy9hx7lw8" + "rev": "dfb2e7b2c98a9b7185c300d0b92b4048f5d89ba5", + "sha256": "1sn46lmq0y56mw0q11sgaijr2vg1wpp6lj237finp6vr3bji2816" }, "qtimageformats": { "url": "https://invent.kde.org/qt/qt/qtimageformats.git", - "rev": "f86afca95741b9c06202fd13c2b8c01d922a0e24", - "sha256": "1qql5zc2691iazx94s7arnkmk46y8f4p20is0asjfycs30x5cmp5" + "rev": "c91e4c63c1eaf1e23806d9df10e3d5a9ae353c1d", + "sha256": "0q0vcymiqfyz8sfs9wdkhhwff55acj2rsmrb8w6yikmwcmcxp2a3" }, "qtlocation": { "url": "https://invent.kde.org/qt/qt/qtlocation.git", - "rev": "c6e6c63e8566fc75551cb901c3b5939b39e7a25c", - "sha256": "1n7wmsmy33v0fihivs18cafrh51bl0sa6gai6mlid0lx4izbs44f" + "rev": "ba48a8b5cedd157d972c08d371ac2581db166bf7", + "sha256": "00kwv405qq9q8fcwar33s2wvs1dm10fb8plxbz1q0jqcjs2ips6x" }, "qtlottie": { "url": "https://invent.kde.org/qt/qt/qtlottie.git", - "rev": "76bc48eedf60c5f98ff9eb378fc8ce16b053bc32", - "sha256": "00ps9rl4yykbqqqhgnph8090rbq816kj90fb7nyrlr76f6zkjwnh" + "rev": "27ed5a3c95a0810a96fac2a8661ea94d8ea3c44e", + "sha256": "04ivyxnn8d3pkjsbx0gwyj3f5if4m4cih6wyavm8bd2m2kkszx35" }, "qtmacextras": { "url": "https://invent.kde.org/qt/qt/qtmacextras.git", - "rev": "4ebefe8d375054d2244ad7197868cb004c5f99d5", - "sha256": "0006gajlv8mn3gfp83jiy7pg9am86fa2yncn4fqrlv7q4ikqym3b" + "rev": "fc7e9f41d9cec2df05c1d38d6e55d3a0d501dd25", + "sha256": "07q1arvdjwmbrayp2b213b8gqm4psczhx9z1m83invwmbs8iqj07" }, "qtmultimedia": { "url": "https://invent.kde.org/qt/qt/qtmultimedia.git", - "rev": "d342547886448dacf38d2933cd40322c7435ee86", - "sha256": "1fyrwbcn9dh6hsqk4z48g4f00aizankjr63ah7nvnzv8y8wcz62p" + "rev": "ff83d119c75cd8406f73ccc08958fe36747e7390", + "sha256": "09jadnvphilcxxy85dlsr8a6x5w32r1c2hrbh93qbvvf9zlg60ld" }, "qtnetworkauth": { "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git", - "rev": "2653044915b3fb1941aa0f8b25af50343efcbff7", - "sha256": "183cbrwxnp2c7shdqlbjmx4vvb097m67mh3m1mqb0d4xc8fggwa4" + "rev": "510687fa4fdee84dd3d6d166e8f080c484016199", + "sha256": "0a8abmql94wxpfvdj5a1rnh3xsd49c5z8x93hm311sgjkd0aajx7" }, "qtpurchasing": { "url": "https://invent.kde.org/qt/qt/qtpurchasing.git", - "rev": "062778d6f80df1ba45b8697720eb781bd477c292", - "sha256": "1hakq5aam1x9fpnnj8wavmr4f3bdm0q2kflix0ap9197hj7bvzhy" + "rev": "8e9a5ec9f68639162c85c198b28e072e7150883c", + "sha256": "04pmwqnw907dg0hpas0pdrh2fxcqn2mvqz82b1vkviksg8ny3saw" }, "qtquick3d": { "url": "https://invent.kde.org/qt/qt/qtquick3d.git", - "rev": "de6e8026c116a47029f4307fd8a62b5f630f33bf", - "sha256": "0w4i0ii7an8z6xiqg1v0i5dm6rp3mi08mhg99mys10996r8f67yr" + "rev": "47a325358078b72016081a86be628411df2728a9", + "sha256": "18h309g6ni6y4bcss930g04z8ymhl2nfm3sv5s4h2fz3dl0xsqwr" }, "qtquickcontrols": { "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git", - "rev": "37ee5e07e82296e24cc02c8bf6f31cb6bd8846b1", - "sha256": "1xq1a9ci7qvlp5f0ydfx86yw1pk14zdm9262nw65bc1z4nx3qfhw" + "rev": "0c3c18bf8bdac1ef1afdb8aade903edb5c2bc041", + "sha256": "0h8bhrbgfcf7nbfppah8lxnhvygc09983qrvp935r5sw7251km4d" }, "qtquickcontrols2": { "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git", - "rev": "9bdcebd1c093b6f0886e3a739711470cc37b1adb", - "sha256": "0ihwjw70cb59qvzbdyz9462n7d8f8mcnidkaph3qyqyblnx5rc6b" + "rev": "e464888c53a641ee44a34ff2350cfb156c8ed59f", + "sha256": "08lnqz6v48j1hi6dpll7a052p6r5qfb32md16fppqzn6g5jg9ir2" }, "qtquicktimeline": { "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git", - "rev": "c4f13dd78d6cf2df83335ad0328b892ce4b2ef70", - "sha256": "075q6z6dd1aazpyf03bjmxn6j7lr5g8gjx02jgg2h077h9bdkw9j" + "rev": "43130f2681b76a8d743a04704465b716b6b2faee", + "sha256": "1z1avxxq9d9nzqyxy5pq5maj73cf6dvsn5k83p3sf5kq3x0y75cj" }, "qtremoteobjects": { "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git", - "rev": "e060a0990380134c054bde675d47db048fd3192f", - "sha256": "0qsgixxy6rk8zv8kssfa19asg742y9syl9hc9dkqw0shywi6rm4k" + "rev": "b2740a7c7f5b6ac810240404a947ca5cff9de5f7", + "sha256": "1jxlwc2y165fxdalcr4iqq55gsg5x4nxqd8wdq3dc1824yfnzm6i" }, "qtscxml": { "url": "https://invent.kde.org/qt/qt/qtscxml.git", - "rev": "2b7b19239671784fbf79d6dbc0e985da044ff9dd", - "sha256": "1a67ihj2z4fc6r3y3z18244wswvhf5hshw72z7z9lmmcznls7921" + "rev": "57491f554bc53bd020978b5744437b7ac7e56a27", + "sha256": "00mvwgb3xr116nl7649zq7ai2074clzw760c140sy91zqgqkjsx4" }, "qtsensors": { "url": "https://invent.kde.org/qt/qt/qtsensors.git", - "rev": "79ed5db98f36b8ca70b077edef46fc793debb3ab", - "sha256": "1dzbcqsrl5wlc1r54jgz63i516iaj73g2g4476m8va6ip4zrxxnp" + "rev": "50a61b360877e7c1300df76b5aabf8d75554a398", + "sha256": "0giqwn4grg9999y31avh7ajsv9gkcfzf0xndx8bvv79si0wp59g6" }, "qtserialbus": { "url": "https://invent.kde.org/qt/qt/qtserialbus.git", - "rev": "971adee604b772d79686126fe8b1e333824f67dc", - "sha256": "0fdr81xj9mhyy7il3x2h87gv5qbjjy5rlps372s5qz97z8jdazy6" + "rev": "c23069351ec31563c9ea9fcdce42ccdba95ea518", + "sha256": "1qgxlgnl53gabrfqihxwygdbdiqjvn2hfajmwb3h44srpq0srk33" }, "qtserialport": { "url": "https://invent.kde.org/qt/qt/qtserialport.git", - "rev": "9bb2b66259413ac4eda1ddf64209ef44412aa55d", - "sha256": "1kpqjmipa2giv1rv1kg25knir9299pnh6gh8l87immnakwnp7q3n" + "rev": "b64a7eeda9b6a65b5ed01b1b40b07177f0aa4c0f", + "sha256": "134mn0njfvmzgrf325bikazkiq4xdn5wjhj56kxh1hhaz3q25hyp" }, "qtspeech": { "url": "https://invent.kde.org/qt/qt/qtspeech.git", - "rev": "088b86a0e53ebb714c1276d041ab2c06fee58e6e", - "sha256": "0qjpr91wlxq25n72yp5026hdwy560g35xk5419r7hz1snggbly4s" + "rev": "aa2376f9b1302222edcd16b4641bbd7004318c00", + "sha256": "0vcxgkymzhaw01f26zlny4bka9k829rwzkwk95rr3dfq7wlyxshz" }, "qtsvg": { "url": "https://invent.kde.org/qt/qt/qtsvg.git", - "rev": "9c149213f46b844607cf7db8f800d906db3a682f", - "sha256": "14ww7c66fs224gfkawjbb8gfrjfcj1ww90887c01504k7ipvlbwb" + "rev": "b74f7291f343dcbcb487b020868f042d8fe83098", + "sha256": "1n0sjn8h5k2sh8p2a85cxdpqbnd63gz4rf9wwbshhd13w623f9s8" }, "qttools": { "url": "https://invent.kde.org/qt/qt/qttools.git", - "rev": "e02ce0dfa692913bd5dcc50917f7e21f5a41cd2b", - "sha256": "0dmv4y2lzdkzj9in3w1cchn0hb637280zl17vnzzgcpj4jmyxm3b" + "rev": "fa40a2d3373b89be0cd0a43fe0c1d047e3d34058", + "sha256": "06kr88gmwc7xh1whdbcg84y1naak5rv99jkscjbhzyz3z91xy7hl" }, "qttranslations": { "url": "https://invent.kde.org/qt/qt/qttranslations.git", - "rev": "fd567a42c1b566f22f339db758d29925fd2a8c60", - "sha256": "14cxna8ql87b68wriqkda9bdrympv827cpng7pazjzglgk4lp97y" + "rev": "3cbcceb8e3e2e63a4022f1be946c7118c527a83e", + "sha256": "15lw5snqfkwwcsazh02lhiia39gy08nfijdpkzvll2qvg4b58zkn" }, "qtvirtualkeyboard": { "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git", - "rev": "0d229d587e578fb4a5144594b926d5d3138c407e", - "sha256": "0q7xv7cg4i5aliwaydw7xshwcv1a1icbg58rlwv77vzla7vsyyga" + "rev": "859d2a6ee329cc08414410b2ef8c0af77a6853d3", + "sha256": "06sdpcanzp1a71d99rjivrbjp780mvwssc4w1sap2gskcmmgkwbs" }, "qtwayland": { "url": "https://invent.kde.org/qt/qt/qtwayland.git", - "rev": "c1ac089f3f37ab172d8010b0fabf4007d62d1812", - "sha256": "16wy4xml5k7bg48ai8777h95clny436lkr9vfcjzsbdlw17mgylw" + "rev": "df49b9f3badce793a0a9ea850cf1a02cc5bafef6", + "sha256": "01xm2r1pv7kxb4aj72ldfzmax6d799h6bj4h2xhpcii812wf5lda" }, "qtwebchannel": { "url": "https://invent.kde.org/qt/qt/qtwebchannel.git", - "rev": "85ba097de9759efe5563156e43de1ad8473d5d54", - "sha256": "0wkd2fvnwi3hpqpy95mjhkj0msi447302srrfxr9j4xp435dpp9p" + "rev": "2a157921861e651f43456cb7941b250c89feb736", + "sha256": "1w58b602f20mppd0zfr9yvfdn1xwfkfclnjs0p5mgymq6d946dyk" }, "qtwebglplugin": { "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git", - "rev": "adb24841f9fc2eea94f1d2636070411fcb6254b4", - "sha256": "0ra0906g3cqavkl18qp79jghy5n9avwqwf4vqn9jsci5may1bmv5" + "rev": "b9aaac72d0853ba48f6bfd710a43df94d83d4701", + "sha256": "07zx55f52jgk31bm6c68iydknrih245ndnvz714l6kxw66fv4rjq" }, "qtwebsockets": { "url": "https://invent.kde.org/qt/qt/qtwebsockets.git", - "rev": "db9cb84499229143506a9692fc65d3cb223b3978", - "sha256": "1kp6gmzh00b07cdpsm062npgf10540aasyhmdqjh4zv9ggnf6dm6" + "rev": "0f910acb737cefc889ce1088fc60d15bc18efe9c", + "sha256": "1ba9ll28hznd6qpjjiqvc2z6gaz2qgq7105dd0w810xpbaiixy0a" }, "qtwebview": { "url": "https://invent.kde.org/qt/qt/qtwebview.git", - "rev": "f16dadb6d147c46565537ede46518a352cdd87c9", - "sha256": "0jm0wxblrlab3yizyrcip1s9n56mavpygfjivj27nmqwsycs8sfp" + "rev": "34342073a59f3a27ef3de02f6b21337c4f8db6cf", + "sha256": "1h6n7dkd6mjclxllyw2brz8wv4d68dx2ykckbwb3bkxyd6rmg1f6" }, "qtwinextras": { "url": "https://invent.kde.org/qt/qt/qtwinextras.git", - "rev": "03d72f7b7df7892024f7a5a380305ad0347c1141", - "sha256": "164q0d4dhpb3w1qks26qc79ph3y3h4diihcgc41d4kgmc7gi75s6" + "rev": "5e5ae2b77078dbe51fb798743de606e6f9a5e19d", + "sha256": "04x8ax197z0dr01nxrb6bh4q8c077ny5n812fx5mq56l54v2m1ks" }, "qtx11extras": { "url": "https://invent.kde.org/qt/qt/qtx11extras.git", - "rev": "e6e7633bbd0efcc56035fef77f3f45efccf03a64", - "sha256": "1h02f17cn6x19d4z37w9pvfivqm2c6qflrhm5n0fqydr1wwb6g3l" + "rev": "c44c4fa86fa0794c25baef4ee1f6272aca8c511a", + "sha256": "0287cvs9wqlzz6gnj81gi8rp50s2rdnigcmld3fgddsg8f3v7hdj" }, "qtxmlpatterns": { "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git", - "rev": "e645537910450ba8bf5ecfbb735f69acdeeef046", - "sha256": "08lnchs0svgrv45zc3jwinkqzvd4crzzpipm9g1ql426clcdyq8n" + "rev": "0b644263abca66503db1ce8a4e126cf358a34685", + "sha256": "1b1zzglvcdp7wvlpgk1gj8gmyy2r21yi6p8xiyvbccq5bbjpn0hw" } } diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix index b3f1e58e14b4..07b617c7b97d 100644 --- a/pkgs/development/libraries/qt-5/5.15/srcs.nix +++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix @@ -5,7 +5,7 @@ }: let - version = "5.15.17"; + version = "5.15.18"; mk = name: args: { inherit version; From 35a136f083f1b686c7bf3dbb5a25d206b0c822c9 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 5 Nov 2025 17:10:12 +0100 Subject: [PATCH 06/24] python3Packages.django_4: 4.2.25 -> 4.2.26 https://docs.djangoproject.com/en/4.2/releases/4.2.26/ https://www.djangoproject.com/weblog/2025/nov/05/security-releases/ Fixes: CVE-2025-64458, CVE-2025-64459 (cherry picked from commit 1e7d8a4584abc39dbe1034c6f4efced03752400e) --- pkgs/development/python-modules/django/4.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix index 302aa824551f..7f1492a3eb3b 100644 --- a/pkgs/development/python-modules/django/4.nix +++ b/pkgs/development/python-modules/django/4.nix @@ -45,7 +45,7 @@ buildPythonPackage rec { pname = "django"; - version = "4.2.25"; + version = "4.2.26"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -54,7 +54,7 @@ buildPythonPackage rec { owner = "django"; repo = "django"; rev = "refs/tags/${version}"; - hash = "sha256-HUNKvLDLZ1VmcyIN0QVMUJZgmd1zBulhzGzGgkZ/84E="; + hash = "sha256-2NkkQcsY+BDvLGtvjYfGwgAK2S6LDbbcl7CwbwuF5a0="; }; patches = [ From 4bccb3507bf6a00c12bf0b3e2981c7d270a72945 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 6 Nov 2025 09:17:08 +1000 Subject: [PATCH 07/24] go_1_24: 1.24.9 -> 1.24.10 Changelog: https://go.dev/doc/devel/release#go1.24 (cherry picked from commit 01607ddca80ebdaa6a088efc8eeddbb1d62dad21) --- pkgs/development/compilers/go/1.24.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix index c7106414bb2b..33bfca194bf4 100644 --- a/pkgs/development/compilers/go/1.24.nix +++ b/pkgs/development/compilers/go/1.24.nix @@ -27,11 +27,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "go"; - version = "1.24.9"; + version = "1.24.10"; src = fetchurl { url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz"; - hash = "sha256-xy+BulT+AO/n8+dJnUAJeSRogbE7d16am7hVQcEb5pU="; + hash = "sha256-NAANzEelF7ePzyZX7n0DMyilcHn+YMTti3uEJg0dGdM="; }; strictDeps = true; From d880823e7a97a6f4083077eb553679be1816d446 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 5 Nov 2025 13:20:29 +0100 Subject: [PATCH 08/24] nspr: 4.37 -> 4.38 https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/-FCacePkmj8 (cherry picked from commit b64885283de864bdaf94240279f602b7e94526dc) --- pkgs/by-name/ns/nspr/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix index 7e24a62ccf39..94327e147522 100644 --- a/pkgs/by-name/ns/nspr/package.nix +++ b/pkgs/by-name/ns/nspr/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation rec { pname = "nspr"; - version = "4.37"; + version = "4.38"; src = fetchurl { url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz"; - hash = "sha256-X5NE7Q4xhVvTj4izPJ2auU9wzlR+8yE+SI0VIPYYQPo="; + hash = "sha256-cu5z/8xu9ecGll+FXs9HDsOYbD4YjhKoqABudvazGm8="; }; patches = [ From 76dbb7463f34ac7c700416686a4ae329e9fdc248 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sun, 2 Nov 2025 14:53:11 +0100 Subject: [PATCH 09/24] xorg.xorgserver: 21.1.18 -> 21.1.20 Fixes CVE-2025-62229, CVE-2025-62230 and CVE-2025-62231. https://lists.x.org/archives/xorg-announce/2025-October/003635.html Changelog: https://lists.x.org/archives/xorg-announce/2025-October/003636.html https://lists.x.org/archives/xorg-announce/2025-October/003638.html (cherry picked from commit 6fd9ec48b661c775591e0d3222834c1bfbae2e2d) --- pkgs/servers/x11/xorg/default.nix | 6 +++--- pkgs/servers/x11/xorg/tarballs.list | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix index a6f07441e1c1..72afd2804df9 100644 --- a/pkgs/servers/x11/xorg/default.nix +++ b/pkgs/servers/x11/xorg/default.nix @@ -7795,11 +7795,11 @@ self: with self; { }: stdenv.mkDerivation (finalAttrs: { pname = "xorg-server"; - version = "21.1.18"; + version = "21.1.20"; builder = ./builder.sh; src = fetchurl { - url = "mirror://xorg/individual/xserver/xorg-server-21.1.18.tar.xz"; - sha256 = "0lk3268gzpll547zvaa64rdhs4z89d7w567lbd55swl71n9x2y68"; + url = "mirror://xorg/individual/xserver/xorg-server-21.1.20.tar.xz"; + sha256 = "sha256-dpW8YYJLOoG2utL3iwVADKAVAD3kAtGzIhFxBbcC6Tc="; }; hardeningDisable = [ "bindnow" diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list index e442dc2adce4..fb78dd2e2d67 100644 --- a/pkgs/servers/x11/xorg/tarballs.list +++ b/pkgs/servers/x11/xorg/tarballs.list @@ -207,4 +207,4 @@ mirror://xorg/individual/util/bdftopcf-1.1.2.tar.xz mirror://xorg/individual/util/imake-1.0.10.tar.xz mirror://xorg/individual/util/lndir-1.0.5.tar.xz mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz -mirror://xorg/individual/xserver/xorg-server-21.1.18.tar.xz +mirror://xorg/individual/xserver/xorg-server-21.1.20.tar.xz From b7d99ae3e3b305888b5dbad498f09fe56a4ceed7 Mon Sep 17 00:00:00 2001 From: Nikita Krasnov Date: Wed, 25 Jun 2025 12:45:41 +0300 Subject: [PATCH 10/24] perlPackages.XMLSAX: fix cross-compilation ``` perl -MXML::SAX -e "XML::SAX->add_parser(q(XML::SAX::PurePerl))->save_parsers()" ``` This line is already being executed in Makefile.PL, but it directly calls Perl binary [1] and thus has to be substituted with a cross version. Moreover, we now have to use the emulator. [1] https://metacpan.org/release/GRANTM/XML-SAX-1.02/source/Makefile.PL#L56 (cherry picked from commit e850369989fb0748b686e49b84e97f9b43dec9d1) --- pkgs/top-level/perl-packages.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index cfc52eeb00f3..2b68326c769c 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -38718,8 +38718,9 @@ with self; XMLNamespaceSupport XMLSAXBase ]; - postInstall = '' - perl -MXML::SAX -e "XML::SAX->add_parser(q(XML::SAX::PurePerl))->save_parsers()" + postPatch = '' + substituteInPlace Makefile.PL \ + --replace-fail "\$(PERL)" "${lib.getExe buildPackages.perl}" ''; meta = { description = "Simple API for XML"; From c742febb235c1ca023490cb0700fc034b010a8a5 Mon Sep 17 00:00:00 2001 From: Yongun Seong Date: Sun, 26 Oct 2025 20:44:31 +0900 Subject: [PATCH 11/24] perlPackages.XMLSAX: fix building on non-default perl (cherry picked from commit 81cced04726132189d7b5d2ba549aad978cdcf83) --- pkgs/top-level/perl-packages.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 2b68326c769c..ea8d8b0dfd47 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -38720,7 +38720,7 @@ with self; ]; postPatch = '' substituteInPlace Makefile.PL \ - --replace-fail "\$(PERL)" "${lib.getExe buildPackages.perl}" + --replace-fail "\$(PERL)" "${lib.getExe perl.perlOnBuild}" ''; meta = { description = "Simple API for XML"; From a6c9ae3da51245aa9e25c30e4123c2b175f8a4ac Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 2 Jun 2025 19:51:08 +0000 Subject: [PATCH 12/24] minio: 2025-03-12T18-04-18Z -> 2025-05-24T17-08-30Z (cherry picked from commit 06f6ebf644392208a6e26d436892b871322c3057) --- pkgs/servers/minio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 2d11908f0b32..b8bf29be44e9 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -30,16 +30,16 @@ let in buildGoModule rec { pname = "minio"; - version = "2025-03-12T18-04-18Z"; + version = "2025-05-24T17-08-30Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - hash = "sha256-wN8eiBn1XGsaxeuFvJ9KJtL5flBfNq0dYcuIbkgl2Ko="; + hash = "sha256-BB7uEBc0JSJ3nBAy+0i6s4js7Nv/jYw51tbIE6bWjkI="; }; - vendorHash = "sha256-z8uaMUdboJzQ2pSeG6IGhArnxH40+INrBAjpnmZMdg8="; + vendorHash = "sha256-0UoEIlxbAveYlCbGZ2z1q+RAksJrVjdE+ymc6ozDGcE="; doCheck = false; From b746a7218c8fbaaee56160f4187aa886e7a0caf6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 24 Jun 2025 01:34:05 +0000 Subject: [PATCH 13/24] minio: 2025-05-24T17-08-30Z -> 2025-06-13T11-33-47Z (cherry picked from commit f0e3dc0dcc84fc9fe5f7a41f674243ac2bb18a64) --- pkgs/servers/minio/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index b8bf29be44e9..5bed1a79d65a 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -30,13 +30,13 @@ let in buildGoModule rec { pname = "minio"; - version = "2025-05-24T17-08-30Z"; + version = "2025-06-13T11-33-47Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - hash = "sha256-BB7uEBc0JSJ3nBAy+0i6s4js7Nv/jYw51tbIE6bWjkI="; + hash = "sha256-pck/K/BJZC0OdjgeCr+3ErkOyqmVTCdZv61jG24tp2E="; }; vendorHash = "sha256-0UoEIlxbAveYlCbGZ2z1q+RAksJrVjdE+ymc6ozDGcE="; From b75ed85e0e11b9fea53688ae7b1ae1ef6d9100c0 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 19 Jul 2025 01:34:28 +0000 Subject: [PATCH 14/24] minio: 2025-06-13T11-33-47Z -> 2025-07-18T21-56-31Z (cherry picked from commit 09be7dca3a0d827c8021854853d11a1db727e75f) --- pkgs/servers/minio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 5bed1a79d65a..0296130ba6a3 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -30,16 +30,16 @@ let in buildGoModule rec { pname = "minio"; - version = "2025-06-13T11-33-47Z"; + version = "2025-07-18T21-56-31Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - hash = "sha256-pck/K/BJZC0OdjgeCr+3ErkOyqmVTCdZv61jG24tp2E="; + hash = "sha256-kQxCrL1hzyEttpqCtJiK6so8L1bKvKaVU5wGWfb24fM="; }; - vendorHash = "sha256-0UoEIlxbAveYlCbGZ2z1q+RAksJrVjdE+ymc6ozDGcE="; + vendorHash = "sha256-XxvSTdHC8l3EwRP8odtcyGv9dlCTCl9dho8BOg6J8zY="; doCheck = false; From f250657e7d3588eca384393fdd19ebe1fe7c1f1c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 2 Sep 2025 05:46:57 +0000 Subject: [PATCH 15/24] minio: 2025-07-18T21-56-31Z -> 2025-07-23T15-54-02Z (cherry picked from commit 1fd7e687bc8a67d6f24e4a9fca668f3d01079a6c) --- pkgs/servers/minio/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 0296130ba6a3..430f5a6574fa 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -30,13 +30,13 @@ let in buildGoModule rec { pname = "minio"; - version = "2025-07-18T21-56-31Z"; + version = "2025-07-23T15-54-02Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - hash = "sha256-kQxCrL1hzyEttpqCtJiK6so8L1bKvKaVU5wGWfb24fM="; + hash = "sha256-hBkWekmzTuvA8aiUrZjQXFEDB2+vT42bBy9fl9iXBlo="; }; vendorHash = "sha256-XxvSTdHC8l3EwRP8odtcyGv9dlCTCl9dho8BOg6J8zY="; From cd2ce1aab67a72dd42a0cd103073219716cd1fe3 Mon Sep 17 00:00:00 2001 From: misilelab Date: Tue, 9 Sep 2025 08:50:26 +0900 Subject: [PATCH 16/24] minio: 2025-07-23T15-54-02Z -> 2025-09-07T16-13-09Z https://github.com/minio/minio/releases/tag/RELEASE.2025-09-07T16-13-09Z Signed-off-by: misilelab (cherry picked from commit ff6b7e46be5ed56e246d44fd7d038e62e3f41c97) --- pkgs/servers/minio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 430f5a6574fa..64ae1151400e 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -30,16 +30,16 @@ let in buildGoModule rec { pname = "minio"; - version = "2025-07-23T15-54-02Z"; + version = "2025-09-07T16-13-09Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - hash = "sha256-hBkWekmzTuvA8aiUrZjQXFEDB2+vT42bBy9fl9iXBlo="; + hash = "sha256-0IVxxeM+h3josP+wnS3q4Nrmd3fT9V+KlHxlwz3QyIQ="; }; - vendorHash = "sha256-XxvSTdHC8l3EwRP8odtcyGv9dlCTCl9dho8BOg6J8zY="; + vendorHash = "sha256-JrDLUVGtwYqwwB+Suutewi6snHyIpG3DOnDn5O0C+L0="; doCheck = false; From 98dba649eaa923a2861d9634faa2f414feda7b3f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 17 Oct 2025 01:01:44 +0000 Subject: [PATCH 17/24] minio: 2025-09-07T16-13-09Z -> 2025-10-15T17-29-55Z (cherry picked from commit 1a9efda28b2bb11d1f10aeade83175eb93001709) --- pkgs/servers/minio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 64ae1151400e..48b422fd72c7 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -30,16 +30,16 @@ let in buildGoModule rec { pname = "minio"; - version = "2025-09-07T16-13-09Z"; + version = "2025-10-15T17-29-55Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - hash = "sha256-0IVxxeM+h3josP+wnS3q4Nrmd3fT9V+KlHxlwz3QyIQ="; + hash = "sha256-HbjmCJYkWyRRHKriLP6QohaXYLk3QEVfi32Krq3ujjo="; }; - vendorHash = "sha256-JrDLUVGtwYqwwB+Suutewi6snHyIpG3DOnDn5O0C+L0="; + vendorHash = "sha256-BFnTJE9QFWmPsx90hDTG8MusdnwaBPYJxM5bCFk3hew="; doCheck = false; From 2b13164ef7d0462773b0e7241a25eb25219a51c3 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sun, 26 Oct 2025 18:38:43 +0100 Subject: [PATCH 18/24] lz4: apply fix for CVE-2025-62813 Security issue is disputed by upstream but taking it up to MITRE to change the status is not fast so we might as well apply the patch to avoid false positive. https://github.com/lz4/lz4/issues/1667 (cherry picked from commit d81ba7d1f23ae8383875e7c77dde8dc671677cc9) --- pkgs/by-name/lz/lz4/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/lz/lz4/package.nix b/pkgs/by-name/lz/lz4/package.nix index 23c13065ae40..bab192f7c424 100644 --- a/pkgs/by-name/lz/lz4/package.nix +++ b/pkgs/by-name/lz/lz4/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch, cmake, valgrind, testers, @@ -18,6 +19,14 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-/dG1n59SKBaEBg72pAWltAtVmJ2cXxlFFhP+klrkTos="; }; + patches = [ + (fetchpatch { + name = "CVE-2025-62813.patch"; + url = "https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82.patch"; + hash = "sha256-qOvK0A3MGX14WdhThV7m4G6s+ZMP6eA/07A2BY5nesY="; + }) + ]; + nativeBuildInputs = [ cmake ]; From d738c95a47956709468687672f658529ac4ae5cf Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Mon, 9 Jun 2025 06:37:43 +0100 Subject: [PATCH 19/24] libdrm: 2.4.124 -> 2.4.125 Changes: https://lists.x.org/archives/xorg-announce/2025-June/003606.html (cherry picked from commit b5825dab3e5e33de4a8261e94bcffa7f552fe635) --- pkgs/by-name/li/libdrm/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix index ec0ca411f563..3a1500279b38 100644 --- a/pkgs/by-name/li/libdrm/package.nix +++ b/pkgs/by-name/li/libdrm/package.nix @@ -16,11 +16,11 @@ stdenv.mkDerivation rec { pname = "libdrm"; - version = "2.4.124"; + version = "2.4.125"; src = fetchurl { url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz"; - hash = "sha256-rDYpP2HKSq+vSxaip6//MSqk9cN8n715fenjwIY8o3k="; + hash = "sha256-1LrpJ5elD4GpNSR2LgQQpJzYTPoPmXeVvAFyrI+x2Wo="; }; outputs = [ From 8c59aadcfd21a735068b7feb6ecd44680bd063a3 Mon Sep 17 00:00:00 2001 From: Raphael Robatsch Date: Tue, 4 Nov 2025 22:11:04 +0100 Subject: [PATCH 20/24] mbedtls: 3.6.4 -> 3.6.5 Changes: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.5 (cherry picked from commit e1c031bebe89772d6d5e6643625697e7691307fe) --- pkgs/development/libraries/mbedtls/3.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix index 05793b55d070..f9ddbfd83d82 100644 --- a/pkgs/development/libraries/mbedtls/3.nix +++ b/pkgs/development/libraries/mbedtls/3.nix @@ -1,8 +1,8 @@ { callPackage, fetchurl }: callPackage ./generic.nix { - version = "3.6.4"; - hash = "sha256-y5YqKtjW4IXyIZkoJvwCGC4scx0qdeV40rynHza4NUE="; + version = "3.6.5"; + hash = "sha256-CAMksh7i4mg5zVTYLB/SZWFVmgQBMhPnislLCD9j7+o="; patches = [ # Fixes the build with GCC 14 on aarch64. From a8e70bc2ea1d42bd4a7b7e1e65e2d26497bc660f Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sat, 8 Nov 2025 16:58:05 +0100 Subject: [PATCH 21/24] grub2: apply patch for CVE-2025-4382 (cherry picked from commit 753b67e7d99f792eb6909a8da7d4cb2cf55124fc) --- pkgs/tools/misc/grub/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix index 4e795fd6607e..d81d576aa6c1 100644 --- a/pkgs/tools/misc/grub/default.nix +++ b/pkgs/tools/misc/grub/default.nix @@ -495,6 +495,11 @@ stdenv.mkDerivation rec { url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997"; hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE="; }) + (fetchpatch { + name = "CVE-2025-4382.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d"; + hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE="; + }) ]; postPatch = From 0792d144feb5bcd118016adc5ff5995ea3f9ff2a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 15 Oct 2025 02:00:51 +0000 Subject: [PATCH 22/24] cacert: 3.115 -> 3.117 (cherry picked from commit 9e6e5635fa756616446d9810d23ffc748b9dbeba) --- pkgs/by-name/ca/cacert/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix index 281b77a8a922..8df8d1d51bd9 100644 --- a/pkgs/by-name/ca/cacert/package.nix +++ b/pkgs/by-name/ca/cacert/package.nix @@ -23,7 +23,7 @@ let lib.concatStringsSep "\n\n" extraCertificateStrings ); - srcVersion = "3.115"; + srcVersion = "3.117"; version = if nssOverride != null then nssOverride.version else srcVersion; meta = with lib; { homepage = "https://curl.haxx.se/docs/caextract.html"; @@ -47,7 +47,7 @@ let owner = "nss-dev"; repo = "nss"; rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM"; - hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA="; + hash = "sha256-sAs0TiV3TK/WtgHvEjl2KFAgebyWZYmcRcmxjpn2AME="; }; dontBuild = true; From c3e40fa7833209779ce8cdad2b2627671f7471f0 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Wed, 19 Nov 2025 23:11:40 +0100 Subject: [PATCH 23/24] grub2: apply November security fixes https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html Fixes CVE-2025-54770, CVE-2025-54771, CVE-2025-61661, CVE-2025-61662, CVE-2025-61663 and CVE-2025-61664. (cherry picked from commit e6066a2284d49cbd182ee190de1114ef25f098ef) --- pkgs/tools/misc/grub/default.nix | 41 ++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix index d81d576aa6c1..562f9419ab2e 100644 --- a/pkgs/tools/misc/grub/default.nix +++ b/pkgs/tools/misc/grub/default.nix @@ -500,6 +500,47 @@ stdenv.mkDerivation rec { url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d"; hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE="; }) + # https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html + (fetchpatch { + name = "1_commands_test_fix_error_in_recursion_depth_calculation.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cc9d621dd06bfa12eac511b37b4ceda5bd2f8246"; + hash = "sha256-GpLpqTKr2ke/YaxnZIO1Kh9wpde44h2mvwcODcAL/nk="; + }) + (fetchpatch { + name = "2_CVE-2025-54771.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4fb4cbc941981894a00ba8e75d634a41967a27f"; + hash = "sha256-yWowlAMVXdfIyC+BiB00IZvTwIybvaPhxAyz0MPjQuY="; + }) + (fetchpatch { + name = "3_CVE-2025-54770.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=10e58a14db20e17d1b6a39abe38df01fef98e29d"; + hash = "sha256-1ROc5n7sApw7aGr+y8gygFqVkifLdgOD3RPaW9b8aQQ="; + }) + (fetchpatch { + name = "4_CVE-2025-61662.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8ed78fd9f0852ab218cc1f991c38e5a229e43807"; + hash = "sha256-mG+vcZHbF4duY2YoYAzPBQRHfWvp5Fvgtm0XBk7JqqM="; + }) + (fetchpatch { + name = "5_CVE-2025-61663_CVE-2025-61664.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05d3698b8b03eccc49e53491bbd75dba15f40917"; + hash = "sha256-kgtXhZmAQpassEf8+RzqkghAzLrCcRoRMMnfunF/0J8="; + }) + (fetchpatch { + name = "6_tests_lib_functional_test_unregister_commands_on_module_unload.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9df1e693e70c5a274b6d60dc76efe2694b89c2fc"; + hash = "sha256-UzyYkpP7vivx2jzxi7BMP9h9OB2yraswrMW4g9UWsbI="; + }) + (fetchpatch { + name = "7_CVE-2025-61661.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=549a9cc372fd0b96a4ccdfad0e12140476cc62a3"; + hash = "sha256-2mlDoVXY7Upwx4QBeAMOHUtoUlyx1MDDmabnrwK1gEY="; + }) + (fetchpatch { + name = "8_commands_usbtest_ensure_string_length_is_sufficient_in_usb_string_processing.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7debdce1e98907e65223a4b4c53a41345ac45e53"; + hash = "sha256-2ALvrmwxvpjQYjGNrQ0gyGotpk0kgmYlJXMF1xXrnEw="; + }) ]; postPatch = From 95c6d0162b914869daeac508565ae7c4cfde4416 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sun, 23 Nov 2025 19:24:06 +0100 Subject: [PATCH 24/24] libpng: patch CVE-2025-65018 This one looks like the most severe from the bunch: https://www.openwall.com/lists/oss-security/2025/11/22/1 I didn't feel like pulling several full libpng updates into the almost-dying NixOS 25.05, so picking this as a compromise, at least for now. Certainly feel free to pick more. --- pkgs/development/libraries/libpng/default.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix index 42846a114cb5..2c73986661a8 100644 --- a/pkgs/development/libraries/libpng/default.nix +++ b/pkgs/development/libraries/libpng/default.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchurl, + fetchpatch, zlib, apngSupport ? true, testers, @@ -26,6 +27,21 @@ stdenv.mkDerivation (finalAttrs: { url = "mirror://sourceforge/libpng/libpng-${finalAttrs.version}.tar.xz"; hash = "sha256-86qLcAOZirkqTpkGwY0ZhT6Zn507ypvRZo9U+oFwfLE="; }; + + patches = [ + # see https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g + (fetchpatch { + name = "CVE-2025-65018.1.patch"; + url = "https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d.diff"; + hash = "sha256-pC7G/6IUCWkt9nE5RHnn8jT24KAo91y3f3+d2Us/gB0="; + }) + (fetchpatch { + name = "CVE-2025-65018.2.patch"; + url = "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea.diff"; + hash = "sha256-jleVnBrsrTmRJqDo87slb7f8yETh3HN9geEwNBRZaGY="; + }) + ]; + postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1" + lib.optionalString stdenv.hostPlatform.isFreeBSD ''