From 124977534776ce8df68d117ef5adb6b74d897749 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 10 Apr 2026 07:06:36 +0000 Subject: [PATCH 01/16] nano: 8.7.1 -> 9.0 --- pkgs/by-name/na/nano/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/na/nano/package.nix b/pkgs/by-name/na/nano/package.nix index 6d043d70ea06..e4a2d0b1ea96 100644 --- a/pkgs/by-name/na/nano/package.nix +++ b/pkgs/by-name/na/nano/package.nix @@ -31,11 +31,11 @@ let in stdenv.mkDerivation rec { pname = "nano"; - version = "8.7.1"; + version = "9.0"; src = fetchurl { url = "mirror://gnu/nano/${pname}-${version}.tar.xz"; - hash = "sha256-dvDcskjy4vElHU7NIP0w+0AKNgo6N8bDQOClLC0c3t8="; + hash = "sha256-nzhDdLSWEQoltzrVpf67OEeDxuMYizcGP2d6yQgBP94="; }; nativeBuildInputs = [ texinfo ] ++ lib.optional enableNls gettext; From 018287dfea7130629fc00fd92f4b270903e198ba Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 27 Apr 2026 11:46:39 +0200 Subject: [PATCH 02/16] strace: 6.19 -> 7.0 ChangeLog: https://github.com/strace/strace/releases/tag/v7.0 --- pkgs/by-name/st/strace/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix index 9820ae631ab2..86f8b0fa4c42 100644 --- a/pkgs/by-name/st/strace/package.nix +++ b/pkgs/by-name/st/strace/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "strace"; - version = "6.19"; + version = "7.0"; src = fetchurl { url = "https://strace.io/files/${finalAttrs.version}/strace-${finalAttrs.version}.tar.xz"; - hash = "sha256-4HbIUe7AlySG7IQhZP3FRUf50Xq9PRRJ3osSD10pkUM="; + hash = "sha256-bJJBm+Py7FYLMXKKRlIhfFmGTIZCunsbN3GxsBOtB0s="; }; separateDebugInfo = true; From 1b68f40be1038282036247c6c847ae731d81ab6b Mon Sep 17 00:00:00 2001 From: r-vdp Date: Mon, 27 Apr 2026 20:20:15 +0200 Subject: [PATCH 03/16] nixos/getty: pass --issue-file explicitly util-linux 2.42 switched agetty's default issue-file lookup from a hardcoded "/etc/issue" to ${sysconfdir}, which is $out/etc in nixpkgs, so the greeting is no longer found. Point agetty at the real paths explicitly. The list matches what 2.41 searched. Placed before extraArgs so users can still override it. This is a non-mass-rebuild stopgap until util-linux is built with --sysconfdir=/etc on staging. Fixes #514060 --- nixos/modules/services/ttys/getty.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/ttys/getty.nix b/nixos/modules/services/ttys/getty.nix index f33a4edd2d66..35759716e08b 100644 --- a/nixos/modules/services/ttys/getty.nix +++ b/nixos/modules/services/ttys/getty.nix @@ -13,6 +13,8 @@ let baseArgs = [ "--login-program" "${cfg.loginProgram}" + "--issue-file" + "/etc/issue:/etc/issue.d:/run/issue:/run/issue.d" ] ++ optionals (cfg.autologinUser != null && !cfg.autologinOnce) [ "--autologin" From e873207cdcaeb27c4715ca88d01ec3c49cbf47b0 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 25 Apr 2026 01:53:40 +0000 Subject: [PATCH 04/16] libblake3: 1.8.4 -> 1.8.5 --- pkgs/by-name/li/libblake3/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix index d2d392071d73..08740597b3a3 100644 --- a/pkgs/by-name/li/libblake3/package.nix +++ b/pkgs/by-name/li/libblake3/package.nix @@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "libblake3"; - version = "1.8.4"; + version = "1.8.5"; outputs = [ "out" @@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "BLAKE3-team"; repo = "BLAKE3"; tag = finalAttrs.version; - hash = "sha256-Xz0LH0YpUjDishvXsW6VNK8msFlPXg08wFoSfbgws0g="; + hash = "sha256-4Oany3uk0759YIZgD1gsONSFU1Mn/GAMvsSeP33J9Ts="; }; sourceRoot = finalAttrs.src.name + "/c"; From 89f2772cfb4a6dba13c2b26dc4ad74df092b8bc1 Mon Sep 17 00:00:00 2001 From: Yureka Date: Sun, 26 Apr 2026 21:24:55 +0200 Subject: [PATCH 05/16] nixos: Set mmap ASLR entropy dynamically Related: https://github.com/NixOS/nixpkgs/pull/510943 https://github.com/NixOS/nixpkgs/pull/513672 --- nixos/modules/config/sysctl.nix | 45 +++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index 96bd0e961989..1d5a1487bb3d 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -66,11 +66,32 @@ in config = { - environment.etc."sysctl.d/60-nixos.conf".text = lib.concatStrings ( - lib.mapAttrsToList ( - n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n" - ) config.boot.kernel.sysctl - ); + environment.etc = { + "sysctl.d/55-nixos-aslr-entropy.conf".source = + pkgs.runCommand "55-nixos-aslr-entropy.conf" + { + inherit (config.boot.kernelPackages.kernel) configfile; + } + '' + mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$") + if [[ -z "$mmap_rnd_bits_max" ]]; then + echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid." + exit 1 + fi + mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$") + if [[ -z "$mmap_rnd_compat_bits_max" ]]; then + echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid." + exit 1 + fi + echo "vm.mmap_rnd_bits=$mmap_rnd_bits_max" >> $out + echo "vm.mmap_rnd_compat_bits=$mmap_rnd_compat_bits_max" >> $out + ''; + "sysctl.d/60-nixos.conf".text = lib.concatStrings ( + lib.mapAttrsToList ( + n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n" + ) config.boot.kernel.sysctl + ); + }; systemd.services.systemd-sysctl = { wantedBy = [ "multi-user.target" ]; @@ -92,20 +113,6 @@ in # the value below is used by default on several other distros. "fs.inotify.max_user_instances" = lib.mkDefault 524288; "fs.inotify.max_user_watches" = lib.mkDefault 524288; - - # Maximise address space randomisation. - "vm.mmap_rnd_bits" = lib.mkMerge [ - (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 ( - # Ideally, we'd want to set this to 33 on 4K pagesize - # kernels, but some vendor kernels e.g. linux_rpi can - # do a maximum of 24. - lib.mkDefault 24 - )) - (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32)) - ]; - "vm.mmap_rnd_compat_bits" = lib.mkIf ( - pkgs.stdenv.hostPlatform.isx86_64 || pkgs.stdenv.hostPlatform.isAarch64 - ) (lib.mkDefault 16); }; }; } From 246e00b5898e9d4026513e30d19f889c3c0ee56b Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Tue, 28 Apr 2026 13:08:07 +0200 Subject: [PATCH 06/16] ty: 0.0.32 -> 0.0.33 Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.33 Diff: https://github.com/astral-sh/ty/compare/0.0.32...0.0.33 --- pkgs/by-name/ty/ty/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index cab90cffbd0d..a8653f65abb9 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -14,14 +14,14 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.32"; + version = "0.0.33"; src = fetchFromGitHub { owner = "astral-sh"; repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-534/xT6JfbgEboH1q4R4JTl2/gLKKs1wU9eqoZf0Asw="; + hash = "sha256-cc/1piasUlv3wwYsXdJaKc8Ck9KF1/FjAjHv6XL6E7o="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-uQkrvSmvQXJj+WlGLI+2fHNQeCd1eYJrJJ1z3OZSHbA="; + cargoHash = "sha256-8DaJWHFBoVzpbkd9QmJ72a5NeKuX99lfDq3uUp+wd5I="; nativeBuildInputs = [ installShellFiles ]; From d453d9fc61058c4b4bfc4f8a24cae98a9263316c Mon Sep 17 00:00:00 2001 From: Luna Nova Date: Tue, 28 Apr 2026 12:45:34 -0700 Subject: [PATCH 07/16] linux/common-config: RANDOMIZE_KSTACK_OFFSET_DEFAULT=y Harden against attacks that depend on kernel stack offset by randomizing it on syscall entry by default Conditional on 7.1 for AArch64 due to significant perf impact on earlier versions --- pkgs/os-specific/linux/kernel/common-config.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 4761cdda962c..884b15c5ecd3 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -866,6 +866,14 @@ let INIT_ON_ALLOC_DEFAULT_ON = yes; + # Randomize kernel stack offset on syscall entry to make stack address dependent + # attacks harder, supported since 5.13. + # Only default enabled on AArch64 from 7.1 due to perf issues prior to that release + # that were resolved in "randomize_kstack: Maintain kstack_offset per task" + RANDOMIZE_KSTACK_OFFSET_DEFAULT = whenAtLeast ( + if stdenv.hostPlatform.isAarch64 then "7.1" else "5.13" + ) yes; + # Enable stack smashing protections in schedule() # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f SCHED_STACK_END_CHECK = yes; From 77531197175f7530c1489ba70b16ad00ae28f205 Mon Sep 17 00:00:00 2001 From: dramforever Date: Wed, 29 Apr 2026 19:51:34 +0800 Subject: [PATCH 08/16] linux/common-config: Set PSTORE=y for EFI_VARS_PSTORE=y Since EFI_VARS_PSTORE depends on PSTORE, also set PSTORE=y. Otherwise, build of configfile fails on at least riscv64, where the defconfig does not set CONFIG_PSTORE=y. Note that this still doesn't fix isLoongArch64 [1], so the check is still needed there. [1]: https://github.com/NixOS/nixpkgs/pull/509871#issuecomment-4243527972 --- pkgs/os-specific/linux/kernel/common-config.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 4761cdda962c..43804b9ecb99 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -1237,6 +1237,7 @@ let EFI = lib.mkIf stdenv.hostPlatform.isEfi yes; EFI_STUB = yes; # EFI bootloader in the bzImage itself EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER = whenOlder "6.2" yes; # initrd kernel parameter for EFI + PSTORE = yes; EFI_VARS_PSTORE = lib.mkIf (!stdenv.hostPlatform.isLoongArch64) yes; # Generic compression support for EFI payloads From bb297ea30b204e53a6936d0e741c9f8eff8865e5 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 10:03:08 +0000 Subject: [PATCH 09/16] linux_7_0: 7.0.2 -> 7.0.3 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 2a0c297414e2..fe2825f77f97 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -35,8 +35,8 @@ "lts": true }, "7.0": { - "version": "7.0.2", - "hash": "sha256:0qknrb9539vwh8314nklaj2s7y1djag5b7hbrf6a89s5541ilnak", + "version": "7.0.3", + "hash": "sha256:074zjl0v901a9hafgpcxyyd395qs7y4kr4fcpgg3ssc8ayzsvv8b", "lts": false } } From 5010ed73b8d49e427a8371a9dca3c96575c14579 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 10:03:11 +0000 Subject: [PATCH 10/16] linux_6_18: 6.18.25 -> 6.18.26 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index fe2825f77f97..b2c6cf933d3f 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -30,8 +30,8 @@ "lts": true }, "6.18": { - "version": "6.18.25", - "hash": "sha256:160qplwzx48rcvh53wz60c7xdnw11sdhfs6fysd2c2s3sh3hls19", + "version": "6.18.26", + "hash": "sha256:1v5h0w3s8p5m22jxg992x1jfpwyi80ia70cdgiv47q3n6xfjyxsk", "lts": true }, "7.0": { From cf998ff809f09ef90037a9083bf904c01dbfafcf Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 10:03:14 +0000 Subject: [PATCH 11/16] linux_6_12: 6.12.84 -> 6.12.85 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index b2c6cf933d3f..689fb929754a 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,8 +25,8 @@ "lts": true }, "6.12": { - "version": "6.12.84", - "hash": "sha256:1pajzxxp2jpjzjav4inbz58hm4xdacj10fp899wmalqzgcx4cvnm", + "version": "6.12.85", + "hash": "sha256:1v8a0z6znmr2m26l4744wndaimsh24zz6q4d7m4p8s0ayjcwjnp3", "lts": true }, "6.18": { From 21980cc1a04edb6596e1aed94af692b5aafc8456 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 10:03:16 +0000 Subject: [PATCH 12/16] linux_6_6: 6.6.136 -> 6.6.137 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 689fb929754a..8e8c8cf71a14 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -20,8 +20,8 @@ "lts": true }, "6.6": { - "version": "6.6.136", - "hash": "sha256:0wglpjmrwdghbdh3rs3qw5kyacrcdw77cqzwwmp7h798k0dd5ckg", + "version": "6.6.137", + "hash": "sha256:1i2npnsnhk41a88vimr521rxg77kljbkqmlyk1zrv7z4ic6ykwcj", "lts": true }, "6.12": { From 5a838789192297b23e6d2d2b653f5a2a6def504d Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 10:03:18 +0000 Subject: [PATCH 13/16] linux_6_1: 6.1.169 -> 6.1.170 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 8e8c8cf71a14..41257d015c50 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -5,8 +5,8 @@ "lts": false }, "6.1": { - "version": "6.1.169", - "hash": "sha256:0b7g7awbn1zryrh0pnjsh00d7j7ivda8i380jddhfj8ph1sfdjz0", + "version": "6.1.170", + "hash": "sha256:0i29gilsvl7vx7p6vqg0bc0d40ir1b968hyfjhdfms55g4pr2y5m", "lts": true }, "5.15": { From 33264a49e877f5f8454d797f3bf63f982dbfee89 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 10:03:22 +0000 Subject: [PATCH 14/16] linux_5_15: 5.15.203 -> 5.15.204 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 41257d015c50..17981dc68663 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -10,8 +10,8 @@ "lts": true }, "5.15": { - "version": "5.15.203", - "hash": "sha256:0r6w6glfpzp6qz0kbxzpmabxwgw1y5k9a407lj98gsap5bcfgsqb", + "version": "5.15.204", + "hash": "sha256:1kfvfvzhdgjcj1pa2aqks3iah00ilfpp1i9bmbwjr3na0crlrzcv", "lts": true }, "5.10": { From b7de90d9312f4d203e3c7a99ca01829a6d4b9a2b Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 10:03:24 +0000 Subject: [PATCH 15/16] linux_5_10: 5.10.253 -> 5.10.254 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 17981dc68663..37d28a722904 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -15,8 +15,8 @@ "lts": true }, "5.10": { - "version": "5.10.253", - "hash": "sha256:1j2sszv8j9s6qlrvbnyj1qf9aapl0srbps3g4bvf5s2hh29281zc", + "version": "5.10.254", + "hash": "sha256:17c63anhn63n2qki4n92xdr3cij6n3wmfa4sqai87kd1jyjkqivm", "lts": true }, "6.6": { From a21f98fabcd4ca6d672631732327643e2e0d6812 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 30 Apr 2026 22:22:13 +1000 Subject: [PATCH 16/16] nixVersions.nixComponents_2_34.nix-util-tests: disable failing test seems to consistently fail in GHA --- .../nix/modular/src/libutil-tests/package.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix index 5bd2fd66542e..33880fc37e4f 100644 --- a/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix +++ b/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix @@ -35,6 +35,10 @@ mkMesonExecutable (finalAttrs: { mesonFlags = [ ]; + excludedTestPatterns = lib.optionals (lib.versions.majorMinor version == "2.34") [ + "fchmodatTryNoFollow.fallbackWithoutProc" + ]; + passthru = { tests = { run = @@ -49,7 +53,8 @@ mkMesonExecutable (finalAttrs: { '' + '' export _NIX_TEST_UNIT_DATA=${resolvePath ./data} - ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage} + ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage} \ + --gtest_filter=-${lib.concatStringsSep ":" finalAttrs.excludedTestPatterns} touch $out '' );