Update discourse to latest(ish) ESR version from previous, soon-to-be unsupported, ESR version.
Upstream changes: https://releases.discourse.org/changelog/custom?end=v2026.7.0&start=v2026.1.4
Changes:
- simple version / dep updates of all plugins and discourse itself
- updated the update script to correctly handle changes to discourses's architecture, and fixed a bug
- the NamedTemporaryFiles were not flush()ed, which meant their content was not written
- discourse now has dependencies under `migrations/` which are specified by path. this requires downloading the `migrations/` directory during the update so `bundle lock` / `bundix` run successfully. the logic for performing this was borrowed from the gitlab package.
- the hashes for the newly added dart-sass download are automatically updated
- updated some patches to match changes in the targeted code (notification_email, prebuild-asset-processor)
- delete a no longer relevant patch (unicorn_logging_and_timeout) (discourse no longer uses unicorn internally, although the external interface is similar / pretends to still exist)
- added two new patches, safe-exec-from-nix-store and sass_embedded_vendored_dart_sass
- safe-exec-from-nix-store: add /nix/store to the list of executable paths for the container used to sandbox imagemagick, which by default only contains the standard FHS paths
- sass_embedded_vendored_dart_sass: patch sass-embedded to use a version of dart-sass provided by the package instead of downloading it's own which would fail. this patch also involves code in default.nix which sets DART_SASS_VENDORED to the path of a downloaded dart-sass version
- updated the comment on prebuild-asset-processor.patch to more accurately reflect what and why it exists
https://releases.discourse.org/changelog/v2026.1.4/
Fixes:
- CVE-2026-44779
Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44782
GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44783
Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44786
Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-45085
Chat misauthorization and information disclosure
- CVE-2026-44784
Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44785
Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-45775
Cross-site backup access via path traversal in multisite local backups
- (CVE Pending)
Don't leak restricted tag group names via tag info
- CVE-2026-34154
Subscription access bypass in discourse-subscriptions plugin
- CVE-2026-33514
Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-44780
Category queue reviewers can read raw incoming emails from queued posts
- (CVE Pending)
Prevent webhook payload disclosure on event redelivery
- CVE-2026-32244
Cached outdated summaries can leak removed content
3.5.x will be EOL by the end of January 2026. 2025.12.0 is the newest
released version. Ref: https://releases.discourse.org/
libv8-node is not compatible with NodeJS 24 in this version.
This moves all packages to the new top-level attributes introduced
previously.
This doesn't cause any rebuilds.
Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
This commit was created by a combination of scripts and tools:
- an ast-grep script to prefix things in meta with `lib.`,
- a modified nixf-diagnose / nixf combination to remove unused `with
lib;`, and
- regular nixfmt.
Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
discourse.plugins.discourse-ldap-auth has the interesting situation that
it – as only package – only has `ldap` as name and not prefixed with
`discourse-`. I feel like having a `ldap` derivation without further
context is bad, so I went this way.
It is more common to specify hash as the last attribute of fetcher
function args. Let's move fetcherVersion right above hash for all
occurrences.
Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
By being in sync with the pname, it makes it easier to walk back from
the pname that shows in the /nix/store back to the attribute.
This change should not cause any rebuild.
This reverts commit 65a333600d.
This wasn't tested for correctness with something like fodwatch [0],
and should not have been (self-)merged so quickly, especially without
further review.
It also resulted in the breakage of at least one package [1] (and that's
the one we know of and was caught).
A few packages that were updated in between this commit and this revert
were not reverted back to using `rev`, but other than that, this is a
1:1 revert.
[0]: https://codeberg.org/raphaelr/fodwatch
[1]: https://github.com/NixOS/nixpkgs/pull/396904 / 758551e458
