Drop the module-level `with lib`. Require settings.hostname
instead of defaulting a string option to null. Fix package
meta.description and remove unused derivation attrs.
Assisted-by: Grok Build (xAI Grok 4.6)
Fixes (high-severity) security vulnerabilities, of which a priviledge escalation and a multitude of XSS vulnerabilities.
Fixes: GHSA-52p2-r8wf-jcrf
Fixes: CVE-2026-64638
Announcement: https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
Fixes (high-severity) security vulnerabilities, of which a priviledge escalation and a multitude of XSS vulnerabilities.
Fixes: GHSA-52p2-r8wf-jcrf
Fixes: CVE-2026-64638
Announcement: https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
Fixes (high-severity) security vulnerabilities, of which a priviledge escalation and a multitude of XSS vulnerabilities.
Fixes: GHSA-52p2-r8wf-jcrf
Fixes: CVE-2026-64638
Announcement: https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
Update discourse to latest(ish) ESR version from previous, soon-to-be unsupported, ESR version.
Upstream changes: https://releases.discourse.org/changelog/custom?end=v2026.7.0&start=v2026.1.4
Changes:
- simple version / dep updates of all plugins and discourse itself
- updated the update script to correctly handle changes to discourses's architecture, and fixed a bug
- the NamedTemporaryFiles were not flush()ed, which meant their content was not written
- discourse now has dependencies under `migrations/` which are specified by path. this requires downloading the `migrations/` directory during the update so `bundle lock` / `bundix` run successfully. the logic for performing this was borrowed from the gitlab package.
- the hashes for the newly added dart-sass download are automatically updated
- updated some patches to match changes in the targeted code (notification_email, prebuild-asset-processor)
- delete a no longer relevant patch (unicorn_logging_and_timeout) (discourse no longer uses unicorn internally, although the external interface is similar / pretends to still exist)
- added two new patches, safe-exec-from-nix-store and sass_embedded_vendored_dart_sass
- safe-exec-from-nix-store: add /nix/store to the list of executable paths for the container used to sandbox imagemagick, which by default only contains the standard FHS paths
- sass_embedded_vendored_dart_sass: patch sass-embedded to use a version of dart-sass provided by the package instead of downloading it's own which would fail. this patch also involves code in default.nix which sets DART_SASS_VENDORED to the path of a downloaded dart-sass version
- updated the comment on prebuild-asset-processor.patch to more accurately reflect what and why it exists
https://releases.discourse.org/changelog/v2026.1.4/
Fixes:
- CVE-2026-44779
Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44782
GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44783
Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44786
Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-45085
Chat misauthorization and information disclosure
- CVE-2026-44784
Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44785
Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-45775
Cross-site backup access via path traversal in multisite local backups
- (CVE Pending)
Don't leak restricted tag group names via tag info
- CVE-2026-34154
Subscription access bypass in discourse-subscriptions plugin
- CVE-2026-33514
Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-44780
Category queue reviewers can read raw incoming emails from queued posts
- (CVE Pending)
Prevent webhook payload disclosure on event redelivery
- CVE-2026-32244
Cached outdated summaries can leak removed content
