Update discourse to latest(ish) ESR version from previous, soon-to-be unsupported, ESR version.
Upstream changes: https://releases.discourse.org/changelog/custom?end=v2026.7.0&start=v2026.1.4
Changes:
- simple version / dep updates of all plugins and discourse itself
- updated the update script to correctly handle changes to discourses's architecture, and fixed a bug
- the NamedTemporaryFiles were not flush()ed, which meant their content was not written
- discourse now has dependencies under `migrations/` which are specified by path. this requires downloading the `migrations/` directory during the update so `bundle lock` / `bundix` run successfully. the logic for performing this was borrowed from the gitlab package.
- the hashes for the newly added dart-sass download are automatically updated
- updated some patches to match changes in the targeted code (notification_email, prebuild-asset-processor)
- delete a no longer relevant patch (unicorn_logging_and_timeout) (discourse no longer uses unicorn internally, although the external interface is similar / pretends to still exist)
- added two new patches, safe-exec-from-nix-store and sass_embedded_vendored_dart_sass
- safe-exec-from-nix-store: add /nix/store to the list of executable paths for the container used to sandbox imagemagick, which by default only contains the standard FHS paths
- sass_embedded_vendored_dart_sass: patch sass-embedded to use a version of dart-sass provided by the package instead of downloading it's own which would fail. this patch also involves code in default.nix which sets DART_SASS_VENDORED to the path of a downloaded dart-sass version
- updated the comment on prebuild-asset-processor.patch to more accurately reflect what and why it exists
https://releases.discourse.org/changelog/v2026.1.4/
Fixes:
- CVE-2026-44779
Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44782
GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44783
Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44786
Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-45085
Chat misauthorization and information disclosure
- CVE-2026-44784
Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44785
Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-45775
Cross-site backup access via path traversal in multisite local backups
- (CVE Pending)
Don't leak restricted tag group names via tag info
- CVE-2026-34154
Subscription access bypass in discourse-subscriptions plugin
- CVE-2026-33514
Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-44780
Category queue reviewers can read raw incoming emails from queued posts
- (CVE Pending)
Prevent webhook payload disclosure on event redelivery
- CVE-2026-32244
Cached outdated summaries can leak removed content
3.5.x will be EOL by the end of January 2026. 2025.12.0 is the newest
released version. Ref: https://releases.discourse.org/
libv8-node is not compatible with NodeJS 24 in this version.
This moves all packages to the new top-level attributes introduced
previously.
This doesn't cause any rebuilds.
Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
This commit was created by a combination of scripts and tools:
- an ast-grep script to prefix things in meta with `lib.`,
- a modified nixf-diagnose / nixf combination to remove unused `with
lib;`, and
- regular nixfmt.
Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
discourse.plugins.discourse-ldap-auth has the interesting situation that
it – as only package – only has `ldap` as name and not prefixed with
`discourse-`. I feel like having a `ldap` derivation without further
context is bad, so I went this way.
It is more common to specify hash as the last attribute of fetcher
function args. Let's move fetcherVersion right above hash for all
occurrences.
Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
By being in sync with the pname, it makes it easier to walk back from
the pname that shows in the /nix/store back to the attribute.
This change should not cause any rebuild.
This reverts commit 65a333600d.
This wasn't tested for correctness with something like fodwatch [0],
and should not have been (self-)merged so quickly, especially without
further review.
It also resulted in the breakage of at least one package [1] (and that's
the one we know of and was caught).
A few packages that were updated in between this commit and this revert
were not reverted back to using `rev`, but other than that, this is a
1:1 revert.
[0]: https://codeberg.org/raphaelr/fodwatch
[1]: https://github.com/NixOS/nixpkgs/pull/396904 / 758551e458
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build a08b3a4d19.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
