From b6dbdcafefa4ee376d000124809737059792306f Mon Sep 17 00:00:00 2001 From: TANIGUCHI Kohei Date: Sun, 14 Dec 2025 02:40:12 +0900 Subject: [PATCH 01/14] mas: 2.2.2 -> 4.1.0 --- pkgs/by-name/ma/mas/package.nix | 34 ++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/ma/mas/package.nix b/pkgs/by-name/ma/mas/package.nix index 0e3eed2b9bbf..f6d23f94f493 100644 --- a/pkgs/by-name/ma/mas/package.nix +++ b/pkgs/by-name/ma/mas/package.nix @@ -2,6 +2,7 @@ lib, stdenvNoCC, fetchurl, + installShellFiles, libarchive, p7zip, testers, @@ -10,14 +11,30 @@ stdenvNoCC.mkDerivation rec { pname = "mas"; - version = "2.2.2"; + version = "4.1.0"; - src = fetchurl { - url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}.pkg"; - hash = "sha256-v+tiD5ZMVFzeShyuOt8Ss3yw6p8VjopHaMimOQznL6o="; - }; + src = + let + sources = + { + x86_64-darwin = { + arch = "x86_64"; + hash = "sha256-9GkAV2gitqtZ7Ew/QVXDj3tDTbh5uwBxPtYdLSnucZE="; + }; + aarch64-darwin = { + arch = "arm64"; + hash = "sha256-8zaZOPOCyLHOFmHhviJXIy5SB5trqQM/MFHhB9ygilQ="; + }; + } + .${stdenvNoCC.hostPlatform.system}; + in + fetchurl { + url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}-${sources.arch}.pkg"; + inherit (sources) hash; + }; nativeBuildInputs = [ + installShellFiles libarchive p7zip ]; @@ -36,8 +53,11 @@ stdenvNoCC.mkDerivation rec { installPhase = '' runHook preInstall - mkdir -p $out/bin - cp mas $out/bin + install -Dm755 usr/local/opt/mas/bin/mas $out/bin/mas + + installManPage usr/local/opt/mas/share/man/man1/mas.1 + installShellCompletion --bash usr/local/opt/mas/etc/bash_completion.d/mas + installShellCompletion --fish usr/local/opt/mas/share/fish/vendor_completions.d/mas.fish runHook postInstall ''; From 04fd13c64b47a5354ae63f23e4c23f68993fc64f Mon Sep 17 00:00:00 2001 From: Jonathan Binette Date: Sat, 20 Dec 2025 12:21:27 -0500 Subject: [PATCH 02/14] vintagestory: Fix wrong hash value --- pkgs/by-name/vi/vintagestory/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix index d981426e754a..d9c3654d7058 100644 --- a/pkgs/by-name/vi/vintagestory/package.nix +++ b/pkgs/by-name/vi/vintagestory/package.nix @@ -25,7 +25,7 @@ stdenv.mkDerivation rec { src = fetchurl { url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz"; - hash = "sha256-i1IsxT+pjkKbJjHwnMcyb12nxe21mwvnoRGHMabMETY="; + hash = "sha256-LkiL/8W9MKpmJxtK+s5JvqhOza0BLap1SsaDvbLYR0c="; }; nativeBuildInputs = [ From c421cc0e67efaa72cff33d12c02e6ef854c2097b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 21 Dec 2025 07:59:57 +0000 Subject: [PATCH 03/14] eigenwallet: 3.5.1 -> 3.6.1 --- pkgs/by-name/ei/eigenwallet/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ei/eigenwallet/package.nix b/pkgs/by-name/ei/eigenwallet/package.nix index ed08ad2e6dc4..300e3ae69549 100644 --- a/pkgs/by-name/ei/eigenwallet/package.nix +++ b/pkgs/by-name/ei/eigenwallet/package.nix @@ -12,11 +12,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "eigenwallet"; - version = "3.5.1"; + version = "3.6.1"; src = fetchurl { url = "https://github.com/eigenwallet/core/releases/download/${finalAttrs.version}/eigenwallet_${finalAttrs.version}_amd64.deb"; - hash = "sha256-+0eZWEqVkJW54ADTC2Ay6cGHqcqRBpxOYJkN5Unil0A="; + hash = "sha256-L0JNKbirnZSVNNhEzSpwq5JstfpSGSo5E83zmxoOuXU="; }; nativeBuildInputs = [ From aec0590a1770757ab3bc8cbb9563f6b76d6aa144 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 21 Dec 2025 12:37:25 +0000 Subject: [PATCH 04/14] homebank: 5.9.5 -> 5.9.6 --- pkgs/by-name/ho/homebank/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ho/homebank/package.nix b/pkgs/by-name/ho/homebank/package.nix index 55b449854b1c..8943f9d801d1 100644 --- a/pkgs/by-name/ho/homebank/package.nix +++ b/pkgs/by-name/ho/homebank/package.nix @@ -13,10 +13,10 @@ stdenv.mkDerivation rec { pname = "homebank"; - version = "5.9.5"; + version = "5.9.6"; src = fetchurl { url = "https://www.gethomebank.org/public/sources/homebank-${version}.tar.gz"; - hash = "sha256-/2yLD22kERM+KbhI6R9I/biN5ArQLLogqIQJMKPn7UM="; + hash = "sha256-8DIL/gTysY/e1DcuuJ5qY6vXUBY4uUWNoSzUaCQ+t3o="; }; nativeBuildInputs = [ From b231a44275f5af6fa7249274e0cb8b5445fda50d Mon Sep 17 00:00:00 2001 From: Justin Restivo Date: Sun, 21 Dec 2025 10:30:58 -0500 Subject: [PATCH 05/14] waffle: update src.owner --- pkgs/by-name/wa/waffle/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/wa/waffle/package.nix b/pkgs/by-name/wa/waffle/package.nix index f2bc46f65d83..477b92ec59bb 100644 --- a/pkgs/by-name/wa/waffle/package.nix +++ b/pkgs/by-name/wa/waffle/package.nix @@ -29,7 +29,7 @@ stdenv.mkDerivation rec { src = fetchFromGitLab { domain = "gitlab.freedesktop.org"; - owner = "libgbm"; + owner = "Mesa"; repo = "waffle"; rev = "v${version}"; sha256 = "sha256-Y7GRYLqSO572qA1eZ3jS8QlZ1X9xKpDtScaySTuPK/U="; From f62eca5783a122e8b0b5eab4777c859083c5ecd3 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 21 Dec 2025 16:04:25 +0000 Subject: [PATCH 06/14] mpvScripts.mpv-playlistmanager: 0-unstable-2025-09-03 -> 0-unstable-2025-12-17 --- pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix index 6f0d529e6b10..6c333dc56c08 100644 --- a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix +++ b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix @@ -8,13 +8,13 @@ buildLua { pname = "mpv-playlistmanager"; - version = "0-unstable-2025-09-03"; + version = "0-unstable-2025-12-17"; src = fetchFromGitHub { owner = "jonniek"; repo = "mpv-playlistmanager"; - rev = "b11621e1dc4afd24b41b887aff0748146176c4c1"; - hash = "sha256-0+ISjWb8aGdRjsFOPURBZzTmJ4X8ayzYfnxYICDmizA="; + rev = "75caa611c9dab164e74a04a62abfbf508e51d71e"; + hash = "sha256-wSyxcR+qIWozbDjrZT+B6SgFaigSWofExdsZ2fF7/uY="; }; passthru.updateScript = unstableGitUpdater { }; From a98688bd578b886ecb89b428768c1ac0c88f30a0 Mon Sep 17 00:00:00 2001 From: Ivan Petkov Date: Sat, 20 Dec 2025 10:21:01 -0800 Subject: [PATCH 07/14] photoprism: fix model linking Photoprism expects models to appear under $PHOTOPRISM_ASSETS_PATH/models/* and not just $PHOTOPRISM_ASSETS_PATH/*. Without this change models like facenet won't actually be loaded, and the following error will show up in logs: ``` vision: Could not find SavedModel .pb or .pbtxt at supplied export directory path: /nix/store/...-photoprism-251130-b3068414c/share/photoprism/models/facenet. Check that the directory exists and that you have the right permissions for accessing it. (init ) ``` --- pkgs/by-name/ph/photoprism/package.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ph/photoprism/package.nix b/pkgs/by-name/ph/photoprism/package.nix index 4322acdc6896..d2f553938735 100644 --- a/pkgs/by-name/ph/photoprism/package.nix +++ b/pkgs/by-name/ph/photoprism/package.nix @@ -84,10 +84,14 @@ stdenv.mkDerivation (finalAttrs: { # install frontend ln -s ${frontend}/assets/* ${assets_path} + rm ${assets_path}/models + mkdir -p ${assets_path}/models + ln -s ${frontend}/assets/models/* ${assets_path}/models/ + # install tensorflow models - ln -s ${nasnet}/nasnet ${assets_path} - ln -s ${nsfw}/nsfw ${assets_path} - ln -s ${facenet}/facenet ${assets_path} + ln -s ${nasnet}/nasnet ${assets_path}/models/ + ln -s ${nsfw}/nsfw ${assets_path}/models/ + ln -s ${facenet}/facenet ${assets_path}/models/ runHook postInstall ''; From 232fe85fd401250e480f5781cea407fc38061ca2 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 21 Dec 2025 19:13:50 +0100 Subject: [PATCH 08/14] meshcentral: make reproducible Closes #472246 While there's a refactoring of the package ongoing (#460508), the fix is trivial enough. --- pkgs/tools/admin/meshcentral/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/admin/meshcentral/default.nix b/pkgs/tools/admin/meshcentral/default.nix index cec69a3cc4fa..61da02c2bfcf 100644 --- a/pkgs/tools/admin/meshcentral/default.nix +++ b/pkgs/tools/admin/meshcentral/default.nix @@ -41,6 +41,8 @@ yarn2nix-moretea.mkYarnPackage { ln -s $out/libexec/meshcentral/deps/meshcentral/meshcentral.js $out/bin/meshcentral ''; + doDist = false; + publishBinsFor = [ ]; passthru.updateScript = ./update.sh; From 2c5819ab739c648ef5dd8c155c06b0b58cb9f532 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 21 Dec 2025 20:35:31 +0000 Subject: [PATCH 09/14] opencode: 1.0.180 -> 1.0.184 --- pkgs/by-name/op/opencode/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix index 4edb59bc7484..fc5d4ee7ab59 100644 --- a/pkgs/by-name/op/opencode/package.nix +++ b/pkgs/by-name/op/opencode/package.nix @@ -13,12 +13,12 @@ }: let pname = "opencode"; - version = "1.0.180"; + version = "1.0.184"; src = fetchFromGitHub { owner = "sst"; repo = "opencode"; tag = "v${version}"; - hash = "sha256-Jwniz/mxMrzR6FL5fL3JRG1mkMP57wxpdtPBpSFxNfY="; + hash = "sha256-qEVFORKMoaLTsBbs2D9aLaD1W4vbQppJ6fB+bHWLcgM="; }; node_modules = stdenvNoCC.mkDerivation { From 60cda4ad679a62779e61c7d3ea48a875bb05ff67 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 21 Dec 2025 23:37:25 +0000 Subject: [PATCH 10/14] vscode-extensions.google.colab: 0.1.3 -> 0.1.4 --- .../editors/vscode/extensions/google.colab/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/google.colab/default.nix b/pkgs/applications/editors/vscode/extensions/google.colab/default.nix index 2cf56a07eb38..1484591b90a3 100644 --- a/pkgs/applications/editors/vscode/extensions/google.colab/default.nix +++ b/pkgs/applications/editors/vscode/extensions/google.colab/default.nix @@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension { mktplcRef = { publisher = "google"; name = "colab"; - version = "0.1.3"; - hash = "sha256-aK2Bfis9eTyNTaFldnjV9P0TK/G0gRBFRp9QvlajS5Y="; + version = "0.1.4"; + hash = "sha256-15n8e7KHMHU16oScivd6aY8v5vnzlH+4ME9Z6qt3AHw="; }; meta = { From b46e11f8bfc3854abbd6d2d2fbba089972e7f481 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 22 Dec 2025 02:08:33 +0000 Subject: [PATCH 11/14] faustPhysicalModeling: 2.79.3 -> 2.83.1 --- pkgs/by-name/fa/faustPhysicalModeling/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fa/faustPhysicalModeling/package.nix b/pkgs/by-name/fa/faustPhysicalModeling/package.nix index 553bf428d792..789cdae0e3ee 100644 --- a/pkgs/by-name/fa/faustPhysicalModeling/package.nix +++ b/pkgs/by-name/fa/faustPhysicalModeling/package.nix @@ -8,13 +8,13 @@ }: stdenv.mkDerivation rec { pname = "faustPhysicalModeling"; - version = "2.79.3"; + version = "2.83.1"; src = fetchFromGitHub { owner = "grame-cncm"; repo = "faust"; rev = version; - sha256 = "sha256-j5ADlKZriwLARpEJ/4xgvyAhF5ld9Hl2gXZS3NPJJj8="; + sha256 = "sha256-c1I5ha9QvnC7jKdycAhW/iAzUcEA7NopXAquIS001Y8="; }; nativeBuildInputs = [ From 94d1675a97d843ff5c60cbf8cf2c39da4858847b Mon Sep 17 00:00:00 2001 From: aleksana Date: Mon, 22 Dec 2025 13:06:06 +0800 Subject: [PATCH 12/14] matrix-conduit: fix vulnerability in invite over federation --- ...t_fields_for_invites_over_federation.patch | 91 +++++++++++++++++++ pkgs/by-name/ma/matrix-conduit/package.nix | 5 + 2 files changed, 96 insertions(+) create mode 100644 pkgs/by-name/ma/matrix-conduit/fix_validate_event_fields_for_invites_over_federation.patch diff --git a/pkgs/by-name/ma/matrix-conduit/fix_validate_event_fields_for_invites_over_federation.patch b/pkgs/by-name/ma/matrix-conduit/fix_validate_event_fields_for_invites_over_federation.patch new file mode 100644 index 000000000000..c7641fb16fd3 --- /dev/null +++ b/pkgs/by-name/ma/matrix-conduit/fix_validate_event_fields_for_invites_over_federation.patch @@ -0,0 +1,91 @@ +From a0f57159572c81c8ae6f9c9440e5cd74315b8570 Mon Sep 17 00:00:00 2001 +From: Jason Volk +Date: Sun, 21 Dec 2025 22:04:07 +0000 +Subject: [PATCH] fix: validate event fields for invites over federation. + +--- + src/api/server_server.rs | 61 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 61 insertions(+) + +diff --git a/src/api/server_server.rs b/src/api/server_server.rs +index adc764ff..d29f6031 100644 +--- a/src/api/server_server.rs ++++ b/src/api/server_server.rs +@@ -2132,6 +2132,44 @@ pub async fn create_invite_route( + CanonicalJsonValue::String(event_id.to_string()), + ); + ++ let event_room_id: OwnedRoomId = serde_json::from_value( ++ signed_event ++ .get("room_id") ++ .ok_or(Error::BadRequest( ++ ErrorKind::InvalidParam, ++ "Event had no room_id field.", ++ ))? ++ .clone() ++ .into(), ++ ) ++ .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "room_id is not a room id."))?; ++ ++ if room_id != event_room_id { ++ return Err(Error::BadRequest( ++ ErrorKind::InvalidParam, ++ "room_id parameter does not match event.", ++ )); ++ } ++ ++ let event_type: StateEventType = serde_json::from_value( ++ signed_event ++ .get("type") ++ .ok_or(Error::BadRequest( ++ ErrorKind::InvalidParam, ++ "Event had no type field.", ++ ))? ++ .clone() ++ .into(), ++ ) ++ .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "type is not an event type."))?; ++ ++ if event_type != StateEventType::RoomMember { ++ return Err(Error::BadRequest( ++ ErrorKind::InvalidParam, ++ "Invite event was not m.room.member type.", ++ )); ++ } ++ + let sender: OwnedUserId = serde_json::from_value( + signed_event + .get("sender") +@@ -2144,6 +2182,29 @@ pub async fn create_invite_route( + ) + .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "sender is not a user id."))?; + ++ if sender.server_name() != sender_servername { ++ return Err(Error::BadRequest( ++ ErrorKind::InvalidParam, ++ "Invite sender must match the origin server.", ++ )); ++ } ++ ++ let event_content: RoomMemberEventContent = serde_json::from_value( ++ signed_event ++ .get("content") ++ .ok_or_else(|| Error::BadRequest(ErrorKind::InvalidParam, "Missing event content."))? ++ .clone() ++ .into(), ++ ) ++ .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Invalid event content."))?; ++ ++ if event_content.membership != MembershipState::Invite { ++ return Err(Error::BadRequest( ++ ErrorKind::InvalidParam, ++ "Membership of invite event must be invite.", ++ )); ++ } ++ + let invited_user: Box<_> = serde_json::from_value( + signed_event + .get("state_key") +-- +GitLab + diff --git a/pkgs/by-name/ma/matrix-conduit/package.nix b/pkgs/by-name/ma/matrix-conduit/package.nix index 4bbd6dd8e167..5cc269af4c56 100644 --- a/pkgs/by-name/ma/matrix-conduit/package.nix +++ b/pkgs/by-name/ma/matrix-conduit/package.nix @@ -21,6 +21,11 @@ rustPlatform.buildRustPackage (finalAttrs: { hash = "sha256-rJyuR8Ie/JiNKNjQL21+Q1PWliEAm+lwGraGeDxEHyY="; }; + patches = [ + # https://gitlab.com/famedly/conduit/-/merge_requests/784 + ./fix_validate_event_fields_for_invites_over_federation.patch + ]; + cargoHash = "sha256-4ZA+3f8Kt+1JAm9KXnMRxAF+X9z8HSJoJe6Ny63SlnA="; # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite. From e83c053e58f479bf6278f512b2dd6cad9dd031d8 Mon Sep 17 00:00:00 2001 From: ZHAO Jin-Xiang Date: Thu, 18 Dec 2025 22:53:04 +0800 Subject: [PATCH 13/14] gemini-cli: remove python dependency --- pkgs/by-name/ge/gemini-cli/package.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ge/gemini-cli/package.nix b/pkgs/by-name/ge/gemini-cli/package.nix index 478e668c85a2..2bbc6b8c46df 100644 --- a/pkgs/by-name/ge/gemini-cli/package.nix +++ b/pkgs/by-name/ge/gemini-cli/package.nix @@ -8,6 +8,7 @@ clang_20, libsecret, ripgrep, + nodejs, nix-update-script, }: @@ -59,14 +60,18 @@ buildNpmPackage (finalAttrs: { --replace-fail "settings.merged.general?.disableUpdateNag" "(settings.merged.general?.disableUpdateNag ?? true)" ''; - # Prevent npmDeps from getting into the closure - disallowedReferences = [ finalAttrs.npmDeps ]; + # Prevent npmDeps and python from getting into the closure + disallowedReferences = [ + finalAttrs.npmDeps + nodejs.python + ]; installPhase = '' runHook preInstall mkdir -p $out/{bin,share/gemini-cli} npm prune --omit=dev + rm node_modules/shell-quote/print.py # remove python demo to prevent python from getting into the closure cp -r node_modules $out/share/gemini-cli/ rm -f $out/share/gemini-cli/node_modules/@google/gemini-cli From a929e0bc44a8585749d991ef8410aecccba9b57f Mon Sep 17 00:00:00 2001 From: codgician <15964984+codgician@users.noreply.github.com> Date: Mon, 22 Dec 2025 14:19:27 +0800 Subject: [PATCH 14/14] open-webui: 0.6.42 -> 0.6.43 Diff: https://github.com/open-webui/open-webui/compare/v0.6.42...v0.6.43 Changelog: https://github.com/open-webui/open-webui/blob/v0.6.43/CHANGELOG.md --- pkgs/by-name/op/open-webui/package.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix index 43755f228634..c263c0f70131 100644 --- a/pkgs/by-name/op/open-webui/package.nix +++ b/pkgs/by-name/op/open-webui/package.nix @@ -9,13 +9,13 @@ }: let pname = "open-webui"; - version = "0.6.42"; + version = "0.6.43"; src = fetchFromGitHub { owner = "open-webui"; repo = "open-webui"; tag = "v${version}"; - hash = "sha256-nUrGF0IcIsU9JLyuyhzNldx948t7sNWWB6cIlBFxX8c="; + hash = "sha256-gkCG2SIYCF89IFi6neslvZNFyoC6PrMM2Vda/a3mc0k="; }; frontend = buildNpmPackage rec { @@ -32,7 +32,7 @@ let url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2"; }; - npmDepsHash = "sha256-BKQmeMV0NAgWgx9c+wL6GyrJb8agtmInlQidfzlEZZM="; + npmDepsHash = "sha256-bw0f6jlA09s7Ptd8+q8RHRFZgnyE+ecsfY30XdKlyRM="; # See https://github.com/open-webui/open-webui/issues/15880 npmFlags = [ @@ -131,6 +131,7 @@ python3Packages.buildPythonApplication rec { langchain langchain-classic langchain-community + langchain-text-splitters langdetect ldap3 loguru