Update discourse to latest(ish) ESR version from previous, soon-to-be unsupported, ESR version.
Upstream changes: https://releases.discourse.org/changelog/custom?end=v2026.7.0&start=v2026.1.4
Changes:
- simple version / dep updates of all plugins and discourse itself
- updated the update script to correctly handle changes to discourses's architecture, and fixed a bug
- the NamedTemporaryFiles were not flush()ed, which meant their content was not written
- discourse now has dependencies under `migrations/` which are specified by path. this requires downloading the `migrations/` directory during the update so `bundle lock` / `bundix` run successfully. the logic for performing this was borrowed from the gitlab package.
- the hashes for the newly added dart-sass download are automatically updated
- updated some patches to match changes in the targeted code (notification_email, prebuild-asset-processor)
- delete a no longer relevant patch (unicorn_logging_and_timeout) (discourse no longer uses unicorn internally, although the external interface is similar / pretends to still exist)
- added two new patches, safe-exec-from-nix-store and sass_embedded_vendored_dart_sass
- safe-exec-from-nix-store: add /nix/store to the list of executable paths for the container used to sandbox imagemagick, which by default only contains the standard FHS paths
- sass_embedded_vendored_dart_sass: patch sass-embedded to use a version of dart-sass provided by the package instead of downloading it's own which would fail. this patch also involves code in default.nix which sets DART_SASS_VENDORED to the path of a downloaded dart-sass version
- updated the comment on prebuild-asset-processor.patch to more accurately reflect what and why it exists
https://releases.discourse.org/changelog/v2026.1.4/
Fixes:
- CVE-2026-44779
Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44782
GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44783
Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44786
Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-45085
Chat misauthorization and information disclosure
- CVE-2026-44784
Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44785
Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-45775
Cross-site backup access via path traversal in multisite local backups
- (CVE Pending)
Don't leak restricted tag group names via tag info
- CVE-2026-34154
Subscription access bypass in discourse-subscriptions plugin
- CVE-2026-33514
Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-44780
Category queue reviewers can read raw incoming emails from queued posts
- (CVE Pending)
Prevent webhook payload disclosure on event redelivery
- CVE-2026-32244
Cached outdated summaries can leak removed content
3.5.x will be EOL by the end of January 2026. 2025.12.0 is the newest
released version. Ref: https://releases.discourse.org/
libv8-node is not compatible with NodeJS 24 in this version.
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build a08b3a4d19.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
...in the update script and remove it from the Gemfile.lock. Having
it there causes a failure with the error message:
Could not find libv8-node-16.10.0.0-aarch64-linux in any of the
sources (Bundler::GemNotFound)
And since we're not using the prebuilt binary packages anyway, we
don't need it there in the first place.
